SimpleHttpOperator with identity tokens

Triggering Cloud Run from Airflow is two steps. Mint an identity token from the Airflow service account. Pass it as the Authorization header on a SimpleHttpOperator call. Cloud Run authorizes the request, runs dbt, and returns 200 (or 500 on failure).

Airflow to Cloud Run handshake

Airflow mints an identity token at task time, includes it on the POST, and Cloud Run IAM verifies before invoking the runner.

airflow/dags/pipeline-ecommerce-bq-dbt.py
python
from airflow.providers.http.operators.http import SimpleHttpOperator
from google.oauth2 import id_token
from google.auth.transport.requests import Request as GoogleRequest

def get_identity_token(audience):
    return id_token.fetch_id_token(GoogleRequest(), audience)

trigger_dbt = SimpleHttpOperator(
    task_id='trigger_dbt_build',
    http_conn_id='cloud_run_dbt',
    endpoint='/run_transformation',
    method='POST',
    headers={"Authorization": f"Bearer {get_identity_token(CLOUD_RUN_DBT_URL)}"},
    response_check=lambda response: response.status_code == 200,
    extra_options={'timeout': 3600},
)

A SimpleHttpOperator call with the identity token. The header is generated at task time so the token never sits stale in Airflow.

The audience parameter is exactly the Cloud Run URL. Setting it correctly is what makes the token valid for that specific service. Wrong audience = 403 with "audience mismatch".

For DAGs that run multiple Cloud Run calls in quick succession, yes. Tokens last an hour. Cache via a TaskGroup or Variable. For a single daily call, the token is fresh per run, no cache needed.