Authorizing Eventarc to Invoke Private Cloud Run

What the Cloud Run Invoker role is:

The Cloud Run Invoker (roles/run.invoker) role is a predefined Identity and Access Management (IAM) role in Google Cloud. It provides the specific run.routes.invoke and run.services.invoke permissions required to send HTTP requests to private, authenticated Cloud Run services and jobs.

How it meets the security and invocation requirements:

• Authorizes cross-service invocation (✓): Eventarc uses an associated user-managed service account to generate identity tokens (OIDC) when dispatching events. Granting roles/run.invoker allows this identity to authenticate against the target service.
• Resolves authentication failures (✓): When an authenticated Cloud Run service rejects unauthenticated requests, Eventarc requires valid invocation privileges. Granting this role provides the required authorization header during automated event delivery.
• Adheres to least privilege (✓): Granting roles/run.invoker directly on the specific Cloud Run service—rather than across the entire project—restricts invocation rights strictly to the target container without granting administrative control.

Key advantages and capabilities:

• Service-level granularity: Can be applied directly to a single Cloud Run resource rather than globally across the project.
• Zero code changes: Solves authentication purely through Google Cloud IAM configuration without altering pipeline or container application code.
• Secure inter-service communication: Prevents exposing internal pipeline services to unauthenticated public traffic while maintaining automated event flows.
• Native Eventarc integration: Allows Eventarc to seamlessly sign and pass authorization tokens on behalf of the configured service account.

Why this is optimal:

Cloud Run services are deployed private by default. When routing events from services such as Dataflow or Cloud Storage to authenticated Cloud Run targets via Eventarc, binding roles/run.invoker to the trigger's designated service account is the Google-recommended approach for secure, reliable event delivery.