google-cloud-platform - (Terraform、云运行)错误 : Forbidden Your client does not have permission to get URL/from this server

Question

我正在尝试使用下面的 Terraform 代码在 Cloud Run 上运行一个 docker 镜像:

provider "google" {
  credentials = file("myCredentials.json")
  project     = "myproject-214771"
  region      = "asia-northeast1"
}

resource "google_cloud_run_service" "default" {
  name     = "hello-world"
  location = "asia-northeast1"

  template {
    spec {
      containers {
        image = "gcr.io/myproject-214771/hello-world:latest"
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}

然后，docker镜像运行成功:

但是当我访问 URL 时，它会显示:

Error: Forbidden Your client does not have permission to get URL /from this server

我的 Terraform 代码是否有任何错误？

Answer 1

将下面的代码添加(复制并粘贴)到您的 Terraform 代码中以允许对公共(public) API 或网站进行未经身份验证的调用:

data "google_iam_policy" "noauth" {
  binding {
    role = "roles/run.invoker"
    members = [
      "allUsers",
    ]
  }
}

resource "google_cloud_run_service_iam_policy" "noauth" {
  location    = google_cloud_run_service.default.location
  project     = google_cloud_run_service.default.project
  service     = google_cloud_run_service.default.name

  policy_data = data.google_iam_policy.noauth.policy_data
}

所以这是完整代码:

provider "google" {
  credentials = file("myCredentials.json")
  project     = "myproject-214771"
  region      = "asia-northeast1"
}

resource "google_cloud_run_service" "default" {
  name     = "hello-world"
  location = "asia-northeast1"

  template {
    spec {
      containers {
        image = "gcr.io/myproject-214771/hello-world:latest"
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}

data "google_iam_policy" "noauth" {
  binding {
    role = "roles/run.invoker"
    members = [
      "allUsers",
    ]
  }
}

resource "google_cloud_run_service_iam_policy" "noauth" {
  location    = google_cloud_run_service.default.location
  project     = google_cloud_run_service.default.project
  service     = google_cloud_run_service.default.name

  policy_data = data.google_iam_policy.noauth.policy_data
}

最后，您的网址会正确显示您的网站:

此外，现在"Authentication"是"Allow unauthenticated":

不要忘记将角色“Cloud Run Admin” 添加到您的服务帐户:

否则，您不能允许对公共(public) API 或网站进行未经身份验证的调用，您将收到以下错误:

Error setting IAM policy for cloudrun service"v1/projects/myproject-214771/locations/asia-northeast1/services/hello-world":googleapi: Error 403: Permission 'run.services.setIamPolicy' denied onresource'projects/myproject-214771/locations/asia-northeast1/services/hello-world'(or resource may not exist).

此外，对于以下这些角色，您不能允许对公共(public) API 或网站进行未经身份验证的调用:

只有 “Cloud Run Admin” 角色可以允许对公共(public) API 或网站进行未经身份验证的调用。