Using Workflows to connect services Stay organized with collections Save and categorize content based on your preferences.
Note: This content applies only to Cloud Run functions—formerly Cloud Functions (2nd gen).
For the 1st gen version of this document, see theWorkflows tutorial (1st gen).
This tutorial shows you how to use Workflows to link a series ofservices together. By connecting two public HTTP services usingCloud Run functions, an external REST API, and a privateCloud Run service, you can create a flexible, serverless application.
Objectives
In this tutorial, you use the Google Cloud CLI to create a single workflow,connecting one service at a time:
- Deploy two Cloud Run functions: the first function generates a random number, and then passes that number to the second function which multiplies it.
- Using Workflows, connect the two HTTP functions together. Execute the workflow and return a result that is then passed to an external API.
- Using Workflows, connect an external HTTP API that returns the
logfor a given number. Execute the workflow and return a result that is then passed to a Cloud Run service. - Deploy a Cloud Run service that allows authenticated access only. The service returns the
math.floorfor a given number. - Using Workflows, connect the Cloud Run service, execute the entire workflow, and return a final result.
The following diagram shows both an overview of the process as well as avisualization of the final workflow:
Costs
In this document, you use the following billable components of Google Cloud:
To generate a cost estimate based on your projected usage, use thepricing calculator.
Before you begin
Security constraints defined by your organization might prevent you from completing the following steps. For troubleshooting information, seeDevelop applications in a constrained Google Cloud environment.
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
Install the Google Cloud CLI.
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.
Toinitialize the gcloud CLI, run the following command:
gcloudinit
Create or select a Google Cloud project.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.Roles required to select or create a project
- Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
- Create a project: To create a project, you need the Project Creator role (
roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.createpermission.Learn how to grant roles.
Create a Google Cloud project:
gcloud projects createPROJECT_ID
Replace
PROJECT_IDwith a name for the Google Cloud project you are creating.Select the Google Cloud project that you created:
gcloud config set projectPROJECT_ID
Replace
PROJECT_IDwith your Google Cloud project name.
Verify that billing is enabled for your Google Cloud project.
Enable the Artifact Registry, Cloud Build, Cloud Run, Cloud Run functions, Cloud Storage, and Workflows APIs:
Roles required to enable APIs
To enable APIs, you need the Service Usage Admin IAM role (
roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enablepermission.Learn how to grant roles.gcloudservicesenableartifactregistry.googleapis.com
cloudbuild.googleapis.com run.googleapis.com cloudfunctions.googleapis.com storage.googleapis.com workflows.googleapis.com Install the Google Cloud CLI.
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.
Toinitialize the gcloud CLI, run the following command:
gcloudinit
Create or select a Google Cloud project.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.Roles required to select or create a project
- Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
- Create a project: To create a project, you need the Project Creator role (
roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.createpermission.Learn how to grant roles.
Create a Google Cloud project:
gcloud projects createPROJECT_ID
Replace
PROJECT_IDwith a name for the Google Cloud project you are creating.Select the Google Cloud project that you created:
gcloud config set projectPROJECT_ID
Replace
PROJECT_IDwith your Google Cloud project name.
Verify that billing is enabled for your Google Cloud project.
Enable the Artifact Registry, Cloud Build, Cloud Run, Cloud Run functions, Cloud Storage, and Workflows APIs:
Roles required to enable APIs
To enable APIs, you need the Service Usage Admin IAM role (
roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enablepermission.Learn how to grant roles.gcloudservicesenableartifactregistry.googleapis.com
cloudbuild.googleapis.com run.googleapis.com cloudfunctions.googleapis.com storage.googleapis.com workflows.googleapis.com - Update the Google Cloud CLI components:
gcloudcomponentsupdate
- If you are running commands inside Cloud Shell, you are already authenticated with the gcloud CLI; otherwise, sign in using your account:
gcloudauthlogin
- Set the default location used in this tutorial:
gcloudconfigsetprojectPROJECT_IDexportREGION=REGIONgcloudconfigsetfunctions/region${REGION}gcloudconfigsetrun/region${REGION}gcloudconfigsetworkflows/location${REGION}
Replace
REGIONwith the supported Workflowslocation of your choice. If you are the project creator, you are granted thebasic Owner role(
roles/owner). By default, this Identity and Access Management (IAM) roleincludes the permissions necessary for full access to most Google Cloudresources and you can skip this step.If you are not the project creator, required permissions must be granted onthe project to the appropriateprincipal. For example, a principal can bea Google Account (for end users) or a service account (for applications andcompute workloads). For more information, see theRoles and permissions pagefor your event destination.
Required permissions
To get the permissions that you need to complete the tutorial, ask your administrator to grant you the following IAM roles on your project:
- Cloud Build Editor (
roles/cloudbuild.builds.editor) - Cloud Functions Developer (
roles/cloudfunctions.developer) - Cloud Run Admin (
roles/run.admin) - Create Service Accounts (
roles/iam.serviceAccountCreator) - Project IAM Admin (
roles/resourcemanager.projectIamAdmin) - Service Account User (
roles/iam.serviceAccountUser) - Service Usage Consumer (
roles/serviceusage.serviceUsageConsumer) - Storage Admin (
roles/storage.admin) - Workflows Editor (
roles/workflows.editor)
For more information about granting roles, seeManage access to projects, folders, and organizations.
You might also be able to get the required permissions throughcustom roles or otherpredefined roles.
Note:IAM basic roles might also contain permissions to complete the tutorial. You shouldn't grant basic roles in a production environment, but you can grant them in a development or test environment.- Cloud Build Editor (
- When you deploy your workflow, you associate it with a specified serviceaccount. Create a service account for Workflows to use:
exportSERVICE_ACCOUNT=workflows-sagcloudiamservice-accountscreate${SERVICE_ACCOUNT}
- All Cloud Run services are deployed privately by defaultand are only callable by Project Owners, Project Editors, Cloud RunAdmins, and Cloud Run Invokers. To allow the service account tocall an authenticated Cloud Run service, grant the
run.invokerrole to the Workflows service account:gcloudprojectsadd-iam-policy-bindingPROJECT_ID\--member"serviceAccount:${SERVICE_ACCOUNT}@PROJECT_ID.iam.gserviceaccount.com"\--role"roles/run.invoker"
Deploy the first Cloud Run functions
After receiving an HTTP request, this HTTP function generates a random numberbetween 1 and 100, and then returns the number in JSON format.
Create a directory called
randomgenand change to it:mkdir~/randomgencd~/randomgenCreate a text file with the filename
main.pythat contains the followingPython code:importfunctions_frameworkimportrandomfromflaskimportjsonify@functions_framework.httpdefrandomgen(request):randomNum=random.randint(1,100)output={"random":randomNum}returnjsonify(output)To support a dependency on Flask for HTTP processing, create a text file forthe pip package manager. Give it the filename
requirements.txtand add thefollowing:flask>=1.0.2functions-framework==3.0.0Deploy the function with an HTTP trigger, and allow unauthenticated access:
gcloudfunctionsdeployrandomgen-function\--gen2\--runtimepython310\--entry-point=randomgen\--trigger-http\--allow-unauthenticated
The function might take a few minutes to deploy. Alternatively, you canuse the Cloud Run functions interfacein the Google Cloud console to deploy the function.
Once the
randomgenfunction is deployed, you can confirm thehttpsTrigger.urlproperty:gcloudfunctionsdescriberandomgen-function\--gen2\--format="value(serviceConfig.uri)"
Save the URL. You will need to add it to your Workflow source file inlater exercises.
You can try out the function with the following curl command:
curl$(gcloudfunctionsdescriberandomgen-function\--gen2\--format="value(serviceConfig.uri)")
A number is randomly generated and returned.
Deploy the second Cloud Run functions
After receiving an HTTP request, this HTTP function extracts theinput fromthe JSON body, multiplies it by 2, and returns the result in JSON format.
Navigate back to your home directory:
cd~Create a directory called
multiplyand change to it:mkdir~/multiplycd~/multiplyCreate a text file with the filename
main.pythat contains the followingPython code:importfunctions_frameworkfromflaskimportjsonify@functions_framework.httpdefmultiply(request):request_json=request.get_json()output={"multiplied":2*request_json['input']}returnjsonify(output)To support a dependency on Flask for HTTP processing, create a text file forthe pip package manager. Give it the filename
requirements.txtand add thefollowing:flask>=1.0.2functions-framework==3.0.0Deploy the function with an HTTP trigger, and allow unauthenticated access:
gcloudfunctionsdeploymultiply-function\--gen2\--runtimepython310\--entry-point=multiply\--trigger-http\--allow-unauthenticated
The function might take a few minutes to deploy. Alternatively, you canuse the Cloud Run functions interfacein the Google Cloud console to deploy the function.
Once the
multiplyfunction is deployed, you can confirm thehttpsTrigger.urlproperty:gcloudfunctionsdescribemultiply-function\--gen2\--format="value(serviceConfig.uri)"
Save the URL. You will need to add it to your Workflow source file inlater exercises.
You can try out the function with the following curl command:
curl-XPOSTMULTIPLY_FUNCTION_URL\-H"Authorization: Bearer$(gcloudauthprint-identity-token)"\-H"Content-Type: application/json"\-d'{"input": 5}'
The number 10 should be returned.
Connect the two Cloud Run functions in a workflow
A workflow is made up of a series of steps described using theWorkflows syntax, which can be written in either YAML or JSONformat. This is the workflow's definition. For a detailed explanation, see theSyntax reference page.
Navigate back to your home directory:
cd~Create a text file with the filename
workflow.yamlthat contains the followingcontent:-randomgen_function:call:http.getargs:url:RANDOMGEN_FUNCTION_URLresult:randomgen_result-multiply_function:call:http.postargs:url:MULTIPLY_FUNCTION_URLbody:input:${randomgen_result.body.random}result:multiply_result-return_result:return:${multiply_result}- Replace
RANDOMGEN_FUNCTION_URLwith the URL of yourrandomgenfunction. - Replace
MULTIPLY_FUNCTION_URLwith the URL of yourmultiplyfunction.
This source file links the two HTTP functions together and returns a final result.
Note: To make a request to a Cloud Run function that accepts onlyauthenticated calls, use OIDC to authenticate. For more information, seeMake authenticated requests from a workflow.- Replace
After creating the workflow, you can deploy it, which makes it ready forexecution.
gcloudworkflowsdeployWORKFLOW_NAME\--source=workflow.yaml\--service-account=${SERVICE_ACCOUNT}@PROJECT_ID.iam.gserviceaccount.com
Replace
WORKFLOW_NAMEwith a name for your workflow.Execute the workflow:
gcloudworkflowsrunWORKFLOW_NAME
An execution is a single run of the logic contained in a workflow's definition.All workflow executions are independent, and the rapid scaling ofWorkflows allows for a high number of concurrent executions.
After the workflow is executed, the output should resemble the following:
result: '{"body":{"multiplied":120},"code":200,"headers":{"Alt-Svc":"h3-29=\":443\";...startTime: '2021-05-05T14:17:39.135251700Z'state: SUCCEEDED...
Connect a public REST service in the workflow
Update your existing workflow and connect a public REST API(math.js)that can evaluate mathematical expressions. For example,curl https://api.mathjs.org/v4/?'expr=log(56)'.
Note that since you have deployed your workflow, you can also edit it throughtheWorkflows page in the Google Cloud console.
Edit the source file for your workflow and replace it with the followingcontent:
-randomgen_function:call:http.getargs:url:RANDOMGEN_FUNCTION_URLresult:randomgen_result-multiply_function:call:http.postargs:url:MULTIPLY_FUNCTION_URLbody:input:${randomgen_result.body.random}result:multiply_result-log_function:call:http.getargs:url:https://api.mathjs.org/v4/query:expr:${"log(" + string(multiply_result.body.multiplied) + ")"}result:log_result-return_result:return:${log_result}- Replace
RANDOMGEN_FUNCTION_URLwith the URL of yourrandomgenfunction. - Replace
MULTIPLY_FUNCTION_URLwith the URL of yourmultiplyfunction.
This links the external REST service to the Cloud Run functions,and returns a final result.
- Replace
Deploy the modified workflow:
gcloudworkflowsdeployWORKFLOW_NAME\--source=workflow.yaml\--service-account=${SERVICE_ACCOUNT}@PROJECT_ID.iam.gserviceaccount.com
Deploy a Cloud Run service
Deploy a Cloud Run service that, after receiving an HTTPrequest, extractsinput from the JSON body, calculates itsmath.floor, andreturns the result.
Create a directory called
floorand change to it:mkdir~/floorcd~/floorCreate a text file with the filename
app.pythat contains the followingPython code:importjsonimportloggingimportosimportmathfromflaskimportFlask,requestapp=Flask(__name__)@app.route('/',methods=['POST'])defhandle_post():content=json.loads(request.data)input=float(content['input'])returnf"{math.floor(input)}",200if__name__!='__main__':# Redirect Flask logs to Gunicorn logsgunicorn_logger=logging.getLogger('gunicorn.error')app.logger.handlers=gunicorn_logger.handlersapp.logger.setLevel(gunicorn_logger.level)app.logger.info('Service started...')else:app.run(debug=True,host='0.0.0.0',port=int(os.environ.get('PORT',8080)))In the same directory, create a
Dockerfilewith the following content:# Use an official lightweight Python image.# https://hub.docker.com/_/pythonFROMpython:3.7-slim# Install production dependencies.RUNpipinstallFlaskgunicorn# Copy local code to the container image.WORKDIR/appCOPY..# Run the web service on container startup. Here we use the gunicorn# webserver, with one worker process and 8 threads.# For environments with multiple CPU cores, increase the number of workers# to be equal to the cores available.CMDexecgunicorn--bind0.0.0.0:8080--workers1--threads8app:appCreate an Artifact Registry standard repository where you can store yourDocker container image:
gcloudartifactsrepositoriescreateREPOSITORY\--repository-format=docker\--location=${REGION}
Replace
REPOSITORYwith a unique name for therepository.Build the container image:
exportSERVICE_NAME=floorgcloudbuildssubmit--tag${REGION}-docker.pkg.dev/PROJECT_ID/REPOSITORY/${SERVICE_NAME}
Deploy the container image to Cloud Run, ensuring that it onlyaccepts authenticated calls:
gcloudrundeploy${SERVICE_NAME}\--image${REGION}-docker.pkg.dev/PROJECT_ID/REPOSITORY/${SERVICE_NAME}:latest\--no-allow-unauthenticated
When you see the service URL, the deployment is complete. You will need tospecify that URL when updating the workflow definition.
Connect the Cloud Run service in the workflow
Update your existing workflow and specify the URL for the Cloud Runservice.
Navigate back to your home directory:
cd~Edit the source file for your workflow and replace it with the followingcontent:
-randomgen_function:call:http.getargs:url:RANDOMGEN_FUNCTION_URLresult:randomgen_result-multiply_function:call:http.postargs:url:MULTIPLY_FUNCTION_URLbody:input:${randomgen_result.body.random}result:multiply_result-log_function:call:http.getargs:url:https://api.mathjs.org/v4/query:expr:${"log(" + string(multiply_result.body.multiplied) + ")"}result:log_result-floor_function:call:http.postargs:url:CLOUD_RUN_SERVICE_URLauth:type:OIDCbody:input:${log_result.body}result:floor_result-create_output_map:assign:-outputMap:randomResult:${randomgen_result}multiplyResult:${multiply_result}logResult:${log_result}floorResult:${floor_result}-return_output:return:${outputMap}- Replace
RANDOMGEN_FUNCTION_URLwith the URL of yourrandomgenfunction. - Replace
MULTIPLY_FUNCTION_URLwith the URL of yourmultiplyfunction. - Replace
CLOUD_RUN_SERVICE_URLwith yourCloud Run service URL.
This connects the Cloud Run service in the workflow. Notethat the
authkey ensures that an authentication token is being passed inthe call to the Cloud Run service. For more information,seeMake authenticated requests from a workflow.- Replace
Deploy the modified workflow:
gcloudworkflowsdeployWORKFLOW_NAME\--source=workflow.yaml\--service-account=${SERVICE_ACCOUNT}@PROJECT_ID.iam.gserviceaccount.com
Execute the final workflow:
gcloudworkflowsrunWORKFLOW_NAME
The output should resemble the following:
result: '{"floorResult":{"body":"4","code":200 ... "logResult":{"body":"4.02535169073515","code":200 ... "multiplyResult":{"body":{"multiplied":56},"code":200 ... "randomResult":{"body":{"random":28},"code":200 ...startTime: '2023-11-13T21:22:56.782669001Z'state: SUCCEEDED
Congratulations! You have deployed and executed a workflow that connects aseries of services together.
To create more complex workflows using expressions, conditional jumps,Base64 encoding or decoding, subworkflows, and more, refer to theWorkflows syntax referenceand theStandard library overview.
Clean up
If you created a new project for this tutorial,delete the project.If you used an existing project and want to keep it without the changes addedin this tutorial,delete resources created for the tutorial.
Delete the project
The easiest way to eliminate billing is to delete the project that you created for the tutorial.
To delete the project:
Delete tutorial resources
Delete the Cloud Run serviceyou deployed in this tutorial.
Delete the workflowyou created in this tutorial.
Delete the container imagefrom Artifact Registry.
Remove the Google Cloud CLI default configurations you added during thetutorial setup:
gcloudconfigunsetfunctions/regiongcloudconfigunsetrun/regiongcloudconfigunsetworkflows/locationgcloudconfigunsetproject
What's next
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-02-19 UTC.