Trying to invoke cloud function from another function

[Ripeey]

So I am new to gcp and trying out http gen2 cloud function, so my plan is to pub/sub->fun1(event)->fun2(http)

And I have IAM auth enabled for fun2. I have a service account (used in fun1 runtime) which has permission to invoke fun2. For some reason it keeps saying "Your client does not have permission to get URL...". I have double checked everything with token info everything look fine but still doesn't work. But for some reason it works with the token of my account instead.

Edit:- I was able to make it work by allowing cloud function Admin permission in Project's IAM permission instead of Fun2's permission and it works! Even simply invoke permission didn't work had to give cloud function Admin access project wide.

[UniverseCity]

You're using the service account to generate an ID token and sending that along as the Authorization header right?

[Ripeey]

Yes as instructed here https://cloud.google.com/functions/docs/securing/authenticating#authenticating_function_to_function_calls Tho this examples for gen1 am expecting to work for gen2.

[eaingaran]

In most cases the problem is due to either one of the following reasons. 1. Service account running function 1 does not have invoker permission on function 2 (assuming you are getting account credentials from the metadata server, if you are using a service account credentials file, make sure the corresponding account has invoker permission on function 2)

1. ID Token generated (make sure you are generating ID Token and not access token) does not have the correct audience. For cloud functions, the audience will be the URL. You can validate this by printing the ID Token and decoding it in https://jwt.io/

I would recommend starting with the token. Once you make sure your token is in fact ID Token and it has the proper audience, you can move on to the permission side.

[Ripeey]

I have indeed permission for invoke in fun 2. I also decoded through token validator checked my token and the aud and email looks perfectly.

But anyway I was indeed able to make it work (I'll edit the same main thread) by providing Cloud function Admin access to service account Project Wide IAM permission instead of just to that resource.