Add GCP FunctionIamMember to grant public access to Functions
Fixes:
MODIFY
gcp-cs-functions/FunctionsStack.cs
gcp-cs-functions/FunctionsStack.cs
@@ -26,6 +26,15 @@ class FunctionsStack : Stack
AvailableMemoryMb = 128
});
+ var invoker = new FunctionIamMember("invoker", new FunctionIamMemberArgs
+ {
+ Project = function.Project,
+ Region = function.Region,
+ CloudFunction = function.Name,
+ Role = "roles/cloudfunctions.invoker",
+ Member = "allUsers"
+ });
+
// Export the URL of the function
this.PythonEndpoint = function.HttpsTriggerUrl;
}

MODIFY
gcp-go-functions-raw/main.go
gcp-go-functions-raw/main.go
@@ -40,6 +40,17 @@ func main() {
return err
}
+ invoker, err := cloudfunctions.NewFunctionsIamMember(ctx, "invoker", &cloudfunctions.FunctionsIamMemberArgs{
+ Project: function.Project,
+ Region: function.Region,
+ CloudFunction: function.Region,
+ Role: pulumi.String("roles/cloudfunctions.invoker"),
+ Member: pulumi.String("allUsers"),
+ })
+ if err != nil {
+ return err
+ }
+
// Export the tigger URL.
ctx.Export("function", function.HttpsTriggerUrl)
return nil

MODIFY
gcp-go-functions/main.go
gcp-go-functions/main.go
@@ -40,6 +40,17 @@ func main() {
return err
}
+ invoker, err := cloudfunctions.NewFunctionsIamMember(ctx, "invoker", &cloudfunctions.FunctionsIamMemberArgs{
+ Project: function.Project,
+ Region: function.Region,
+ CloudFunction: function.Region,
+ Role: pulumi.String("roles/cloudfunctions.invoker"),
+ Member: pulumi.String("allUsers"),
+ })
+ if err != nil {
+ return err
+ }
+
// Export the tigger URL.
ctx.Export("function", function.HttpsTriggerUrl)
return nil

MODIFY
gcp-py-functions/__main__.py
gcp-py-functions/__main__.py
@@ -67,6 +67,15 @@ fxn = cloudfunctions.Function(
source_archive_object=source_archive_object.name,
trigger_http=True)
+invoker = cloudfunctions.FunctionIamMember(
+ "invoker",
+ project=fxn.project,
+ region=fxn.region,
+ cloud_function=fxn.name,
+ role="roles/cloudfunctions.invoker",
+ member="allUsers",
+)
+
# Export the DNS name of the bucket and the cloud function URL.
pulumi.export("bucket_name", bucket.url)
pulumi.export("fxn_url", fxn.https_trigger_url)

MODIFY
gcp-py-serverless-raw/__main__.py
gcp-py-serverless-raw/__main__.py
@@ -20,6 +20,15 @@ py_function = cloudfunctions.Function(
available_memory_mb=128,
)
+py_invoker = cloudfunctions.FunctionIamMember(
+ "py-invoker",
+ project=py_function.project,
+ region=py_function.region,
+ cloud_function=py_function.name,
+ role="roles/cloudfunctions.invoker",
+ member="allUsers",
+)
+
export("python_endpoint", py_function.https_trigger_url)
go_bucket_object = storage.BucketObject(
@@ -39,4 +48,13 @@ go_function = cloudfunctions.Function(
available_memory_mb=128,
)
+go_invoker = cloudfunctions.FunctionIamMember(
+ "go-invoker",
+ project=go_function.project,
+ region=go_function.region,
+ cloud_function=go_function.name,
+ role="roles/cloudfunctions.invoker",
+ member="allUsers",
+)
+
export("go_endpoint", go_function.https_trigger_url)

MODIFY
gcp-ts-functions/index.ts
gcp-ts-functions/index.ts
@@ -6,4 +6,12 @@ const greeting = new gcp.cloudfunctions.HttpCallbackFunction("greeting", (req, r
res.send(`Greetings from ${req.body.name || "Google Cloud Functions"}!`);
});
+const invoker = new gcp.cloudfunctions.FunctionIamMember("invoker", {
+ project: greeting.function.project,
+ region: greeting.function.region,
+ cloudFunction: greeting.function.name,
+ role: "roles/cloudfunctions.invoker",
+ member: "allUsers",
+});
+
export const url = greeting.httpsTriggerUrl;

MODIFY
gcp-ts-serverless-raw/index.ts
gcp-ts-serverless-raw/index.ts
@@ -23,6 +23,14 @@ const functionPython = new gcp.cloudfunctions.Function("python-func", {
availableMemoryMb: 128,
});
+const pyInvoker = new gcp.cloudfunctions.FunctionIamMember("py-invoker", {
+ project: functionPython.project,
+ region: functionPython.region,
+ cloudFunction: functionPython.name,
+ role: "roles/cloudfunctions.invoker",
+ member: "allUsers",
+});
+
export const pythonEndpoint = functionPython.httpsTriggerUrl;
// Google Cloud Function in Go
@@ -43,4 +51,12 @@ const functionGo = new gcp.cloudfunctions.Function("go-func", {
availableMemoryMb: 128,
});
+const goInvoker = new gcp.cloudfunctions.FunctionIamMember("go-invoker", {
+ project: functionGo.project,
+ region: functionGo.region,
+ cloudFunction: functionGo.name,
+ role: "roles/cloudfunctions.invoker",
+ member: "allUsers",
+});
+
export const goEndpoint = functionGo.httpsTriggerUrl;

Add GCP FunctionIamMember to grant public access to Functions

Fixes: #640