blocks|key|1034510|text|您需要一个指向函数url的ping的auth头。看起来应该是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1034511|headers+=+{
++++....
++++'Authorization':+'Bearer+some-long-hash-token'
}|code-block|syntax|javascript|1034512|下面是如何获取令牌：|1034513|import+requests
token_response+=+requests.get(
++++'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience='+%2B
++++'https://[your+zone]-[your+app+name].cloudfunctions.net/[your+function+name]',+
++++headers={'Metadata-Flavor':+'Google'})
++++
return+token_response.content.decode("utf-8")|1034514|“只允许内部通信量”不像预期的那样工作。我的App应用程序和函数在同一个项目中，它不工作。我不得不打开“允许所有流量”，并使用标头方法。|1034515|示例：|1034516|def+get_access_token():
++++import+requests
++++token_response+=+requests.get(
++++++++'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience='+%2B
++++++++'https://us-central1-my_app.cloudfunctions.net/my_function',+
++++++++headers={'Metadata-Flavor':+'Google'})
++++++++
++++return+token_response.content.decode("utf-8")
++++
def+test():
++++url_string+=+f"https://us-central1-my_app.cloudfunctions.net/my_function?message=it%2520worked"
++++
++++access_token+=+get_access_token()
++++

++++print(
++++++++requests.get(url_string,+headers={'Authorization':+f"Bearer+{access_token}"}
++++)|1034517|entityMap^0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|W|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|X|8|@]|9|@]|A|$]]|$1|O|3|P|5|D|7|Y|8|@]|9|@]|A|$E|F]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

You need an auth header for the ping to the function url. It should look like:
<pre><code>headers = {
 ....
 'Authorization': 'Bearer some-long-hash-token'
}
</code></pre>
Here is how to get the token:
<pre><code>import requests
token_response = requests.get(
 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=' +
 'https://[your zone]-[your app name].cloudfunctions.net/[your function name]', 
 headers={'Metadata-Flavor': 'Google'})
 
return token_response.content.decode(&quot;utf-8&quot;)
</code></pre>
'Allow internal traffic only' does not work as expected. My App Engine app is in the same project as the Functions, and it does not work. I had to turn on 'Allow all traffic', and use the header method.
Example:
<pre><code>def get_access_token():
 import requests
 token_response = requests.get(
 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=' +
 'https://us-central1-my_app.cloudfunctions.net/my_function', 
 headers={'Metadata-Flavor': 'Google'})
 
 return token_response.content.decode(&quot;utf-8&quot;)
 
def test():
 url_string = f&quot;https://us-central1-my_app.cloudfunctions.net/my_function?message=it%20worked&quot;
 
 access_token = get_access_token()
 

 print(
 requests.get(url_string, headers={'Authorization': f&quot;Bearer {access_token}&quot;}
 )
</code></pre>

blocks|key|1034581|text|正如文档中所提到的，只允许内部通信量提到以下内容：|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|1034582|只允许来自同一项目中的VPC网络或VPC服务控制边界的请求。所有其他请求均被拒绝。|blockquote|1034583|请注意，由于App标准是一种无服务器产品，它不是VPC的一部分，因此从该产品发出的请求不被视为“内部”调用，实际上调用来自实例的公共IP，因此您将得到HTTP403错误消息。|1034584|此外，使用VPC无服务器连接器也不能工作，因为这更像是连接VPC中资源的桥梁(比如VM或Memorystore实例)，而不是云函数，因为这也是一个没有服务器的产品，而且它在VPC中没有IP。|1034585|我认为这里有三种选择：|1034586|使用：
由于App使用VM实例，这些实例将是VPC的一部分，即使在设置“只允许内部通信”选项时，您也会达到此功能。|ordered-list-item|1034587|使用VM作为代理：
您可以创建一个VPC无服务器连接器并将其分配给App引擎中的应用程序。然后，您可以创建一个VM并使用VM作为代理实现该函数。这不是最好的选择，因为成本，但最终是一个选择。|1034588|最后一个选项认为函数可以使用允许所有流量选项：
您可以将云函数上的某些安全性设置为只允许特定的服务帐户，并且可以使用此示例代码进行身份验证。
编辑的：
这个选项的代码示例由其他答案中的@gaefan共享。|1034589|entityMap|0|LINK|mutability|MUTABLE|url|https://cloud.google.com/functions/docs/networking/network-settings#ingress_settings|1|https://cloud.google.com/appengine/kb#static-ip|2|https://cloud.google.com/vpc/docs/configure-serverless-vpc-access|3|4|https://cloud.google.com/appengine/docs/standard/python3/connecting-vpc|5|https://cloud.google.com/functions/docs/securing/authenticating#function-to-function|6|https://stackoverflow.com/a/63637654/12265927^0|A|8|2|2|0|0|0|1P|7|1|0|5|A|2|0|0|0|H|A|3|X|5|4|0|E|6|1Z|3|1M|5|5|2E|4|6|0^^$0|@$1|2|3|4|5|6|7|1E|8|@$9|1F|A|1G|B|C]]|D|@$9|1H|A|1I|1|1J]]|E|$]]|$1|F|3|G|5|H|7|1K|8|@]|D|@]|E|$]]|$1|I|3|J|5|6|7|1L|8|@]|D|@$9|1M|A|1N|1|1O]]|E|$]]|$1|K|3|L|5|6|7|1P|8|@]|D|@$9|1Q|A|1R|1|1S]]|E|$]]|$1|M|3|N|5|6|7|1T|8|@]|D|@]|E|$]]|$1|O|3|P|5|Q|7|1U|8|@]|D|@]|E|$]]|$1|R|3|S|5|Q|7|1V|8|@]|D|@$9|1W|A|1X|1|1Y]|$9|1Z|A|20|1|21]]|E|$]]|$1|T|3|U|5|Q|7|22|8|@$9|23|A|24|B|C]|$9|25|A|26|B|C]]|D|@$9|27|A|28|1|29]|$9|2A|A|2B|1|2C]]|E|$]]|$1|V|3|-4|5|6|7|2D|8|@]|D|@]|E|$]]]|W|$X|$5|Y|Z|10|E|$11|12]]|13|$5|Y|Z|10|E|$11|14]]|15|$5|Y|Z|10|E|$11|16]]|17|$5|Y|Z|10|E|$11|16]]|18|$5|Y|Z|10|E|$11|19]]|1A|$5|Y|Z|10|E|$11|1B]]|1C|$5|Y|Z|10|E|$11|1D]]]]

As mentioned in the <a href="https://cloud.google.com/functions/docs/networking/network-settings#ingress_settings" rel="nofollow noreferrer">docs</a>, Allow internal traffic only mentions the following:
<blockquote>
Only requests from VPC networks in the same project or VPC Service Controls perimeter are allowed. All other requests are rejected.
</blockquote>
Please note that since App Engine Standard is a serverless product, it is not part of the VPC and then the requests made from this product are not considered &quot;Internal&quot; calls, actually the calls are made from the <a href="https://cloud.google.com/appengine/kb#static-ip" rel="nofollow noreferrer">Public IPs of the instances</a> and for this reason you get an HTTP 403 error message.
Also using a <a href="https://cloud.google.com/vpc/docs/configure-serverless-vpc-access" rel="nofollow noreferrer">VPC Serverless Connector</a> won't work since this more a bridge to reach resources in the VPC (like VMs or Memorystore instances) but not a Cloud Function because this is also a Serverless product and it does not have an IP in the VPC.
I think here are three options:
<ol>
<li>Using App Engine Flex:
Since App Engine Flex uses VM instances, these instances will be part of the VPC and you'll reach the Function even when setting the &quot;Allow internal traffic only&quot; option.
</li>
<li>Use a VM as a proxy:
You can create a <a href="https://cloud.google.com/vpc/docs/configure-serverless-vpc-access" rel="nofollow noreferrer">VPC Serverless Connector</a> and assign it to the app in <a href="https://cloud.google.com/appengine/docs/standard/python3/connecting-vpc" rel="nofollow noreferrer">App Engine</a>. Then you can create a VM and reach the function using the VM as a proxy. This is not the best option because of the costs but at the end is an option.
</li>
<li>The last option considers that the function can use the Allow All Traffic option:
You can set some security on the Cloud Function to only allow a particular Service Account and you can use <a href="https://cloud.google.com/functions/docs/securing/authenticating#function-to-function" rel="nofollow noreferrer">this sample code</a> to authenticate.
EDITED:
A good sample of the code for this option was shared by @gaefan in the <a href="https://stackoverflow.com/a/63637654/12265927">other answer</a>.
</li>
</ol>

blocks|key|283436|text|@GAEfan是正确的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|283437|作为补充:我使用了官方的Google库来给我提供必要的标题。|283438|const+{GoogleAuth}+=+require('google-auth-library');
//+Instead+of+specifying+the+type+of+client+you'd+like+to+use+(JWT,+OAuth2,+etc)
//+this+library+will+automatically+choose+the+right+client+based+on+the+environment.
const+googleCloudFunctionURL+=+'https://europe-west1-project.cloudfunctions.net/function';
(async+function()+{
++const+auth+=+new+GoogleAuth();
++let+googleCloudFunctionClient+=+await+auth.getIdTokenClient(googleCloudFunctionURL);
++console.log(await+googleCloudFunctionClient.getRequestHeaders(googleCloudFunctionURL));
})();|code-block|syntax|javascript|283439|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

@GAEfan is correct.
As an addition: I used the official Google Auth library to give me the necessary headers.
<pre class="lang-js prettyprint-override"><code>const {GoogleAuth} = require('google-auth-library');
// Instead of specifying the type of client you'd like to use (JWT, OAuth2, etc)
// this library will automatically choose the right client based on the environment.
const googleCloudFunctionURL = 'https://europe-west1-project.cloudfunctions.net/function';
(async function() {
 const auth = new GoogleAuth();
 let googleCloudFunctionClient = await auth.getIdTokenClient(googleCloudFunctionURL);
 console.log(await googleCloudFunctionClient.getRequestHeaders(googleCloudFunctionURL));
})();

</code></pre>

I have an App Engine project.
I also have a Google Cloud Function.
And I want to call that Google Cloud Function from the App Engine project. I just can't seem to get that to work.
Yes, if I make the function full public (i.e. set the Cloud Function to 'allow all traffic' and create a rule for 'allUsers' to allow calling the function) it works. But if I limit either of the two settings, it stops working immediately and I get 403's.
The App and Function are in the same project, so I would at least assume that setting the Function to 'allow internal traffic only' should work just fine, provided that I have a rule for 'allUsers' to allow calling the function.
How does that work? How does one generally call a (non-public) Google Cloud Function from Google App Engine?

How can I call a Google Cloud Function from Google App Engine?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我有一个App项目。我也有一个谷歌云功能。我想从App项目中调用Google函数。我只是不能让它起作用。是的，如果我使函数完全公开(即将云函数设置为“允许所有通信量”，并为“allUsers”创建一个允许调用该函数的规则)，它就能工作。但是如果我限制这两种设置中的任何一种，它就会立即停止工作，我得到403。应用程序和函...

问如何从调用Google函数？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何从调用Google函数？EN