Google Pub/Sub push message not working for IAP enabled app engine

╄→尐↘猪︶ㄣ 提交于 2019-12-04 21:23:44

Note: This answer uses BETA commands and features.

To enable IAP enabled App Engine access to Pub/Sub push notifications:

  • Enable Pub/Sub to create Identity Tokens
  • Create a service account that Pub/Sub will use for its identity to IAP
  • Create a push Pub/Sub subscription with the service account
  • Add the Pub/Sub service account email address to IAP

Allow the Pub/Sub service (Service Agent) to create Identity Tokens on behalf of a service account:

gcloud projects add-iam-policy-binding PROJECT-ID \
     --member=serviceAccount:service-PROJECT-NUMBER@gcp-sa-pubsub.iam.gserviceaccount.com \
     --role=roles/iam.serviceAccountTokenCreator

Create a service account that Pub/Sub will use for its identity to IAP:

gcloud iam service-accounts create pubsub-invoker \
     --display-name "Pub/Sub Invoker Service Account"

Create a push Pub/Sub subscription with the service account:

gcloud beta pubsub subscriptions create mySubscription --topic myTopic \
   --push-endpoint=SERVICE-URL/ \
   --push-auth-service-account=pubsub-invoker@PROJECT-ID.iam.gserviceaccount.com

Add the service account email address pubsub-invoker@PROJECT-ID.iam.gserviceaccount.com to IAP for App Engine.

I don't know of a CLI command for this step. Do this step in the Google Cloud Console.

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!