虽然我能够提供一个HTTP触发的GCP云功能并公开调用它,但我似乎不能提供我的第二个被公开调用的函数。
我的Terraform服务帐户指定了编辑器角色。
google_cloudfunctions_function_iam_member.v2invoker: Creating...
╷
│ Error: Error applying IAM policy for cloudfunctions cloudfunction "projects/myproject/locations/us-central1/functions/v2": Error setting IAM policy for cloudfunctions cloudfunction "projects/myproject/locations/us-central1/functions/v2": googleapi: Error 403: Permission 'cloudfunctions.functions.setIamPolicy' denied on resource 'projects/myproject/locations/us-central1/functions/v2' (or resource may not exist).
│
│ with google_cloudfunctions_function_iam_member.v2invoker,
│ on main.tf line 460, in resource "google_cloudfunctions_function_iam_member" "v2invoker":
│ 460: resource "google_cloudfunctions_function_iam_member" "v2invoker" {
澄清--函数资源本身是正确的,只有iam_member
资源是不正确的。
我的Terraform配置:
resource "google_cloudfunctions_function" "v2" {
name = "v2"
runtime = "nodejs12"
available_memory_mb = 128
source_archive_bucket = google_storage_bucket.functions.name
source_archive_object = google_storage_bucket_object.nodejs_functions.name
entry_point = "v2"
trigger_http = true
}
resource "google_cloudfunctions_function_iam_member" "v2invoker" {
project = google_cloudfunctions_function.v2.project
region = google_cloudfunctions_function.v2.region
cloud_function = google_cloudfunctions_function.v2.name
role = "roles/cloudfunctions.invoker"
member = "allUsers"
}
output "function-v2" {
value = google_cloudfunctions_function.v2.https_trigger_url
}
为第一个(成功)函数添加了terraform配置:
resource "google_cloudfunctions_function" "helloWorld" {
name = "helloWorld"
runtime = "nodejs12"
available_memory_mb = 128
source_archive_bucket = google_storage_bucket.functions.name
source_archive_object = google_storage_bucket_object.nodejs_functions.name
entry_point = "helloWorld"
trigger_http = true
}
# IAM entry so all users can invoke the function
resource "google_cloudfunctions_function_iam_member" "invoker" {
project = google_cloudfunctions_function.helloWorld.project
region = google_cloudfunctions_function.helloWorld.region
cloud_function = google_cloudfunctions_function.helloWorld.name
role = "roles/cloudfunctions.invoker"
member = "allUsers"
}
output "function-helloWorld" {
value = google_cloudfunctions_function.helloWorld.https_trigger_url
}
terraform使用的当前服务帐户是我用"Editor“角色创建的。
发布于 2021-10-27 11:04:37
根据GCP IAM文件:
注意:编辑器角色包含为大多数Google服务创建和删除资源的权限。但是,它不包含为所有服务执行所有操作的权限。有关如何检查角色是否具有所需权限的更多信息,请参见上面一节。
您的编辑器角色绝对无法在云函数上执行cloudfunctions.functions.setIamPolicy
操作(正如错误消息提到的那样)。
将 云功能管理角色 分配给服务帐户.
它绝对应该拥有与云功能相关的所有权限,包括但不限于在函数上设置IAM策略。
https://stackoverflow.com/questions/69743361
复制