Identity tokens and Cloud Run auth

A public /run_transformation endpoint that anyone can curl is a way to drain your BigQuery budget. Cloud Run IAM solves this: deploy the service with --no-allow-unauthenticated so unauthenticated requests are rejected. Callers must present an identity token from a service account that has roles/run.invoker on the service.

cloud_run_dbt/scripts/run_via_token.sh

bash

curl -X POST \
  -H "Authorization: Bearer $(gcloud auth print-identity-token)" \
  "${CLOUD_RUN_DBT_URL}/run_transformation" \
  -d '{}'

A real call to the production endpoint. The identity token is generated on the fly by gcloud, signed with the user's credentials.

In production, the caller is Airflow. Airflow stores a service account JSON, exchanges it for an identity token at call time, and passes the token in the Authorization header. The Airflow integration covers that wiring.

Two roles. roles/run.invoker on the Cloud Run service (allows POSTing). roles/iam.serviceAccountTokenCreator on its own service account (allows minting identity tokens). Scope both to the specific service. Never grant roles/owner.

Quiz: Quiz

Loading practice…