GCP Cloud Scheduler调用HTTP云函数返回INTERNAL错误如何修复？

你遇到的错误核心是Cloud Scheduler调用云函数时的OIDC令牌配置缺失、权限绑定校验失败两个问题，按以下步骤修复即可：

• 补全Scheduler作业的oidc_token配置
  谷歌云函数的OIDC身份验证要求请求携带的JWT令牌aud（受众）参数必须与云函数的HTTPS触发URL完全一致，你当前的Terraform配置里oidc_token块仅填写了服务账号邮箱，缺失了必填的audience参数，修改后的配置如下：

resource "google_cloud_scheduler_job" "test" {
  name             = "Function_Name_Schedule_Job"
  description      = "Triggers ${google_cloudfunctions_function.Function_Name.name} function every 8 hours."
  time_zone        = "Asia/Singapore"
  schedule         =  "59 7,15,23 * * *"
  region           = "${var.Region}"
  retry_config {
    retry_count        = 5
    max_retry_duration = "520s"
  }
  http_target  {
    uri                     = "${google_cloudfunctions_function.Function_Name.https_trigger_url}"
    oidc_token {
      service_account_email = "${google_service_account.ServiceAccount.email}"
      # 新增audience参数，值和触发URL保持一致
      audience              = "${google_cloudfunctions_function.Function_Name.https_trigger_url}"
    }
  }
  depends_on = ["google_cloudfunctions_function.Function_Name"]
}

• 验证服务账号的invoker权限绑定
  确认你已经将roles/cloudfunctions.invoker角色正确绑定到目标云函数资源，授权对象为你创建的服务账号，Terraform对应配置示例如下：

resource "google_cloudfunctions_function_iam_binding" "invoker" {
  project        = google_cloudfunctions_function.Function_Name.project
  region         = google_cloudfunctions_function.Function_Name.region
  cloud_function = google_cloudfunctions_function.Function_Name.name
  role           = "roles/cloudfunctions.invoker"
  members = [
    "serviceAccount:${google_service_account.ServiceAccount.email}"
  ]
}

• 最后确认所用服务账号未被禁用，2.20.3版本的谷歌云Terraform Provider兼容上述配置，修改后重新执行terraform apply即可生效。

内容的提问来源于stack exchange，提问作者johnnyrocket33