Search code examples
google-app-enginegoogle-cloud-storagegoogle-app-engine-pythongoogle-cloud-scheduleridentity-aware-proxy

How to run a Cloud Scheduler job with App Engine HTTP when protected by IAP

I have a Python app on Google App Engine Standard which is secured using Google Cloud Identity Aware Proxy (IAP).

I would like to trigger a part of my app every day by using Cloud Scheduler. (It is calling an API, doing calculations, and stores results in Google Cloud Storage.)

To do so, I tried triggering a POST request on an "App Engine HTTP". example URL: "/refresh_data"

When running the job, I get the following error:

jsonPayload: {
status: "FAILED_PRECONDITION"
relativeUrl: "/refresh_data"
jobName: "..."
@type: "type.googleapis.com/google.cloud.scheduler.logging.AttemptFinished"
targetType: "APP_ENGINE_HTTP"
}

I can't find any documentation relative to the "FAILED_PRECONDITION" error so I'm feeling kind of stuck here.

As an alternative, I tried to trigger a POST request to a simple "HTTP" and by granting the Owner access level in IAP to the service account I am using for Cloud Scheduler. This time, the error message I get is the following :

 jsonPayload: {
 status: "UNAUTHENTICATED"
 @type: "type.googleapis.com/google.cloud.scheduler.logging.AttemptFinished"
 jobName: "..."
 targetType: "HTTP"
 url: "https:.../refresh_data"
 }

I really don't understand how to make this work... The Cloud Scheduler documentation barely documents the "App Engine HTTP" option, and nothing is documented relative to te use of IAP...

Any help would be much appreciated :)

Solution

  • It's the dark side of IAP. I sent this feedback to Google months ago. Same thing with Pubsub, you can't trigger and App Engine IAP protected from these serverless product, even if you use a service account with the correct authorization.