Getting permission denied error when calling Google cloud function from Cloud scheduler

Ayush Mandloi

Sep 20

0 views1

I am trying to invoke Google cloud function which is Http triggered by cloud scheduler. But whenever I try to run cloud scheduler it always says permission denied error

 httpRequest: {
  status: 403   
 }
 insertId: "14igacagbanzk3b"  
 jsonPayload: {
  @type: "type.googleapis.com/google.cloud.scheduler.logging.AttemptFinished"   
  jobName: "projects/***********/locations/europe-west1/jobs/twilio-cloud-scheduler"   
  status: "PERMISSION_DENIED"   
  targetType: "HTTP"   
  url: "https://europe-west1-********.cloudfunctions.net/function-2"   
 }
 logName: "projects/*******/logs/cloudscheduler.googleapis.com%2Fexecutions"  
 receiveTimestamp: "2020-09-20T15:11:13.240092790Z"  
 resource: {
  labels: {
   job_id: "***********"    
   location: "europe-west1"    
   project_id: "**********"    
  }
  type: "cloud_scheduler_job"   
 }
 severity: "ERROR"  
 timestamp: "2020-09-20T15:11:13.240092790Z"  
}

Solutions I tried -

Tried putting Google cloud function in the same region as the App engine as suggested by some users.
Gave access to Google provided cloud scheduler sa service-****@gcp-sa-cloudscheduler.iamaccount.gserviceaccount.com owner role and Cloud Functions Admin role
My cloud function has ingress setting of Allow all traffic.

My cloud scheduler only works when I run below command

gcloud functions add-iam-policy-binding cloud-function --member="allUsers" --role="roles/cloudfunctions.invoker"

1 answer

Accepted answer · original discussion

guillaume blaquiere

Sep 20

Permalink

On Cloud Scheduler page, you have to add a service account to use to call the private Cloud Function. In the Cloud Scheduler set up, you have to

Click on SHOW MORE on the bottom
Select Add OIDC token in the Auth Header section
Add a service account email in the service account email for the Scheduler
Fill in the Audience with the same base URL as the Cloud Functions (the URL provided when you deployed it)

The service account email for the Scheduler must be granted with the role cloudfunctions.invoker

Your perspective belongs here.

0 question comments

Use comments to ask for clarification. Post a solution as an answer.

No question comments on this page.