I've managed to work around this by creating a function with Pulumi, then deploying it once with gcloud (to enable Allow Unauthenticated) and then deploy again with Pulumi, but this is madness...

Looks like it changed sometime in late 2019 and Pulumi/Terraform didn't catch up with it yet

our tests ensure we can curl the endpoint

Notice that I am attaching a FunctionIamMember to the function

So when I call the function I get a 403 response, but if I create the same function with

gcloud

and

--allow-unauthenticated

flag, then it's fine

Weirdly, that flag doesn't seem to be related to

member

or IAM permissions

It's already set to

allUsers

so in theory it's public but somehow this flag is required to be able to invoke it publicly

Here's my exact code for creating a function:

fxn = cloudfunctions.Function(
    "add_post_to_feeds",
    entry_point="add_post_to_feeds",
    environment_variables=config_values,
    region="us-central1",
    runtime="python37",
    source_archive_bucket=bucket.name,
    source_archive_object=source_archive_object.name,
    trigger_http=True)

invoker = cloudfunctions.FunctionIamMember(
    "invoker",
    project=fxn.project,
    region=fxn.region,
    cloud_function=fxn.name,
    role="roles/cloudfunctions.invoker",
    member="allUsers",
)

# Export the DNS name of the bucket and the cloud function URL.
pulumi.export("bucket_name", bucket.url)
pulumi.export("fxn_url", fxn.https_trigger_url)

did you try allUnathenticated?

in the members?

@broad-dog-22463 I'm trying to google for it and see nothing, so I assume this option doesn't exist

@broad-dog-22463 It didn't help... I still have to deploy a pulumi-created function once with

gcloud

in ourder to enable that flag 😞

Seems like

serverless

framework might have similar issues to Pulumi and Terraform with this https://forum.serverless.com/t/setting-iam-policies-for-google-http-functions-since-all-new-gcloud-http-functions-after-nov-1-2019-will-default-private/8686

Can you open an issue on this for us?

We need to escalate it it seems

I've figured it out, looks like the problem was that my service account used with Pulumi didn't have

Cloud Functions Admin

role in IAM so it couldn't properly create the invoker. The weird thing is that Pulumi didn't show any errors about this until today for me, it was creating the function and invoker but I was getting 403 and redeploying a function with

gcloud

CLI would solve the problem... But today Pulumi started failing to create the invoker specifically so this is how I've found by trial and error that adding that IAM role solves the problem...