GCP Gen2云函数调用权限配置及Terraform资源部署异常求助

问题描述 #

我用Terraform在GCP上部署了一个Gen2云函数，但尝试调用时碰到了权限报错：

Your client does not have permission to get URL /getAllEmployees from this server.

更麻烦的是，我配置的google_cloud_run_service_iam_binding资源一直部署失败，明明已经设置了members = ["allUsers"]来开放调用权限，可还是没办法正常访问函数。想请大家帮忙看看问题出在哪。

我的Terraform代码 #

provider "google" {
  project     = var.project_id
  region      = var.region
  credentials = "../tf-key.json"
}

resource "google_storage_bucket" "bucket" {
  name     = "${var.project_id}-bucket1"
  location = var.region
}

resource "google_storage_bucket_object" "source_code" {
  name   = "objects"
  bucket = "terraform-cloud-functions-ems-bucket1"
  source = "D:/gcf-terraform/gcf-1.zip"
}

resource "google_cloudfunctions2_function" "function" {
  name        = "getAllEmployees"
  location    = "us-central1"
  description = "Retrieve all employees."

  build_config {
    runtime     = "go121"
    entry_point = "GetAllEmployees"

    source {
      storage_source {
        bucket = "terraform-cloud-functions-ems-bucket1"
        object = "objects"
      }
    }
  }

  service_config {
    min_instance_count             = 1
    max_instance_count             = 10
    available_memory               = "128Mi"
    timeout_seconds                = 120
    all_traffic_on_latest_revision = false
    service_account_email          = "terraform-gcf@terraform-cloud-functions-ems.iam.gserviceaccount.com"
  }
}

resource "google_cloud_run_service_iam_binding" "default" {
  location = "google_cloudfunctions2_function.function.location"
  service  = "google_cloudfunctions2_function.function.name"
  role     = "roles/run.invoker"
  members  = ["allUsers"]
}

问题排查与修复方案 #

看了你的配置，发现几个关键问题导致IAM绑定资源部署失败和权限错误：

1. Terraform资源引用语法错误
   你在google_cloud_run_service_iam_binding里把资源属性用引号包起来了，这会让Terraform把它当成字符串，而不是去解析实际的资源值。应该去掉引号，让Terraform正确引用函数的位置和名称：

   location = google_cloudfunctions2_function.function.location
   service  = google_cloudfunctions2_function.function.name
   

2. 资源类型大小写错误
   你写了Resource "google_cloud_run_service_iam_binding"（首字母大写），但Terraform的资源类型必须全小写，这会直接导致资源无法被识别，自然部署失败。要改成全小写的resource。

3. 验证服务账号权限
   确保你用来部署的服务账号terraform-gcf@terraform-cloud-functions-ems.iam.gserviceaccount.com拥有roles/run.admin或者至少能修改Cloud Run服务IAM权限的权限，否则Terraform无法完成IAM绑定的配置。

4. 手动验证权限（可选）
   如果修改配置后还是有问题，可以先通过gcloud命令手动给函数添加调用权限，验证是否是Terraform配置的问题：

   # 针对Gen2云函数的Cloud Run服务添加权限
   gcloud run services add-iam-policy-binding getAllEmployees \
     --region=us-central1 \
     --member="allUsers" \
     --role="roles/run.invoker"
   

修改后的完整IAM绑定资源配置应该是这样的：

resource "google_cloud_run_service_iam_binding" "default" {
  location = google_cloudfunctions2_function.function.location
  service  = google_cloudfunctions2_function.function.name
  role     = "roles/run.invoker"
  members  = ["allUsers"]
}

部署完修改后的配置后，再去GCP控制台检查Cloud Run服务的IAM权限，确认allUsers是否已经被授予roles/run.invoker角色，之后再尝试调用函数应该就能正常访问了。

备注：内容来源于stack exchange，提问作者Shreyas Awankar