How to invoke Cloud Function from Cloud Scheduler with Authentication

I’ve looked everywhere and it seems people either use pubsub, app engine http or http with no auth. Not too many people out there showing their work for accessing functions via authentication w/ oidc tokens to access google functions.

I checked out: Cannot invoke Google Cloud Function from GCP Scheduler but nothing seemed to work.

Documentation I followed: https://cloud.google.com/scheduler/docs/http-target-auth#using-gcloud_1

1. created a new service account
2. set roles (Cloud scheduler service agent/Cloud functions service agent/Cloud scheduler admin/cloud functions invoker…even tried owner!)
3. deployed google function that doesn’t allow public (unauthenticated) access (a simple helloworld function)
4. setup cron job on cloud scheduler to run every minute against the new deployed function with this configuration:
   • url = helloworld function
   • oidc-token
   • newly created service account
   • audience set to hello world function url

outcome on cloud scheduler logs:

Expand all | Collapse all{
 httpRequest: {
 }
 insertId: "ibboa4fg7l1s9"  
 jsonPayload: {
  @type: "type.googleapis.com/google.cloud.scheduler.logging.AttemptFinished"   
  jobName: "projects/project/locations/region/jobs/tester"   
  status: "PERMISSION_DENIED"   
  targetType: "HTTP"   
  url: "https://region-project.cloudfunctions.net/tester"   
 }
 logName: "projects/project/logs/cloudscheduler.googleapis.com%2Fexecutions"  
 receiveTimestamp: "2020-04-15T17:50:14.287689800Z"  
 resource: {…}  
 severity: "ERROR"  
 timestamp: "2020-04-15T17:50:14.287689800Z" 

I saw one solution that showed someone creating a new project to get to this to work, are there any others??

Appreciate any help provided.

UPDATE

New Google Function – running in central (same as my app engine app)

New Service Account – w/ Owner role

New Scheduled Task – Info

New Scheduled Task – Status

New Scheduled Task – Logs

ACTUAL FIX

If you’re missing the cloudscheduler service account (ex: [e-mail]) Http auth tasks wont work. To fix, I had to disable api and renable and it gave me the service account, I didnt use this service account but, that was the only changing factor after I did this to make it work.

Answer

These are the exact steps you have to take. Be sure not to skip the second step, it sets invoker permissions on the service account so that the scheduler is able to invoke the HTTP Cloud Function with that service account’s OIDC information. Note: for simplicity, I choose the default service account here, however, it would be wise to create a separate service account for this purpose with less privileges.

# Create cloud function
gcloud functions deploy my_function 
  --entry-point=my_entrypoint 
  --runtime=python37 
  --trigger-http 
  --region=europe-west1 
  --project=${PROJECT_ID}

# Set invoke permissions
gcloud functions add-iam-policy-binding my_function 
  --region=europe-west1 
  --member=serviceAccount:${PROJECT_ID}@appspot.gserviceaccount.com 
  --role="roles/cloudfunctions.invoker" 
  --project=${PROJECT_ID}

# Deploy scheduler
gcloud scheduler jobs create http my_job 
  --schedule="every 60 minutes" 
  --uri="https://europe-west1-${PROJECT_ID}.cloudfunctions.net/my_function/" 
  --http-method=POST 
  --oidc-service-account-email="${PROJECT_ID}@appspot.gserviceaccount.com" 
  --oidc-token-audience="https://europe-west1-${PROJECT_ID}.cloudfunctions.net/my_function" 
  --project=${PROJECT_ID}