How to avoid allUsers in CloudRun invoker permission for corporate environment

[tszebeni-asml]

In a corporate environment usually (e.g. in our case) using allUsers is forbidden. In domain restricted sharing org policy we only allow identities belonging to our Cloud Identity to be assigned in iam policies.

How to create a Cloud Run service in a corporate environment, which:

• does not rely on allUsers
• uses only INTERNAL communication (egress internal)
• supports custom domain (ilb HTTPS)

Please advise, Thanks

Reference:

cloud-foundation-fabric/blueprints/serverless/cloud-run-corporate/main.tf

Line 140 in 454a30b

"roles/run.invoker" = ["allUsers"]

[wiktorn]

If it uses ilb, will IAM grant to domain:your-cloud-identity-domain-here.com work for your case?

[ludoo]

Blueprints are meant as examples, you're expected to tweak them to suit your needs. :)