3

I am testing out a very basic Pub/Sub subscription. I have the push endpoint set to an App I have deployed through a Python Flex service in App Engine. The service is in a project with Identity-Aware Proxy enabled. The IAP is configured to allow through users authenticated with our domain.

I do not see any of the push requests being processed by my app.

I turned off the IAP protection and then I see that the requests are processed. I turn it back on and they are no longer processed.

1

1 Answer 1

6

Note: This answer uses BETA commands and features.

To enable IAP enabled App Engine access to Pub/Sub push notifications:

  • Enable Pub/Sub to create Identity Tokens
  • Create a service account that Pub/Sub will use for its identity to IAP
  • Create a push Pub/Sub subscription with the service account
  • Add the Pub/Sub service account email address to IAP

Allow the Pub/Sub service (Service Agent) to create Identity Tokens on behalf of a service account:

gcloud projects add-iam-policy-binding PROJECT-ID \
     --member=serviceAccount:service-PROJECT-NUMBER@gcp-sa-pubsub.iam.gserviceaccount.com \
     --role=roles/iam.serviceAccountTokenCreator

Create a service account that Pub/Sub will use for its identity to IAP:

gcloud iam service-accounts create pubsub-invoker \
     --display-name "Pub/Sub Invoker Service Account"

Create a push Pub/Sub subscription with the service account:

gcloud beta pubsub subscriptions create mySubscription --topic myTopic \
   --push-endpoint=SERVICE-URL/ \
   --push-auth-service-account=pubsub-invoker@PROJECT-ID.iam.gserviceaccount.com

Add the service account email address pubsub-invoker@PROJECT-ID.iam.gserviceaccount.com to IAP for App Engine.

I don't know of a CLI command for this step. Do this step in the Google Cloud Console.

30
  • It worked !! Thank you. May I know what the above commands do ?
    – Jefila
    Oct 1, 2019 at 1:36
  • I listed what each command does in my answer at both the top and for each command. Oct 1, 2019 at 1:42
  • John. It worked yesterday when I tried pubsub with IAP enabled. But it is not working today.
    – Jefila
    Oct 1, 2019 at 2:30
  • What is not working? You need to be specific. Check the Stackdriver logs for error messages. Oct 1, 2019 at 2:34
  • 2
    This solution worked for me, with a minor change. I had to set the Subscription's push authentication Audience field value to the IAP web app's OAuth Client ID. I found this ID here: console.cloud.google.com/apis/credentials
    – am9u
    Nov 26, 2019 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.