Trigger functions from Pub/Sub using Eventarc Stay organized with collections Save and categorize content based on your preferences.
This tutorial demonstrates how to write and trigger an event-driven Cloud Run functions with aPub/Sub trigger.
You can configure the routing of events, including the event source and theevent target, by specifying filters for an Eventarc trigger.For the example in this tutorial, publishing a message to a Pub/Subtopic triggers the event, and a request is sent to your function in the form ofan HTTP request.
If you are new to Pub/Sub and want to learn more, see thePub/Subdocumentation for quickstarts and key references.
Note: You can also useHTTP-triggered functionsto listen toPub/Sub push subscriptions. Usingan HTTP function enables a single function to subscribe to multiplePub/Sub topics.Objectives
In this tutorial, you will:
Costs
In this document, you use the following billable components of Google Cloud:
To generate a cost estimate based on your projected usage, use thepricing calculator.
Before you begin
Security constraints defined by your organization might prevent you from completing the following steps. For troubleshooting information, seeDevelop applications in a constrained Google Cloud environment.
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
Install the Google Cloud CLI.
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.
Toinitialize the gcloud CLI, run the following command:
gcloudinit
Create or select a Google Cloud project.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.Roles required to select or create a project
- Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
- Create a project: To create a project, you need the Project Creator role (
roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.createpermission.Learn how to grant roles.
Create a Google Cloud project:
gcloud projects createPROJECT_ID
Replace
PROJECT_IDwith a name for the Google Cloud project you are creating.Select the Google Cloud project that you created:
gcloud config set projectPROJECT_ID
Replace
PROJECT_IDwith your Google Cloud project name.
Verify that billing is enabled for your Google Cloud project.
Install the Google Cloud CLI.
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.
Toinitialize the gcloud CLI, run the following command:
gcloudinit
Create or select a Google Cloud project.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.Roles required to select or create a project
- Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
- Create a project: To create a project, you need the Project Creator role (
roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.createpermission.Learn how to grant roles.
Create a Google Cloud project:
gcloud projects createPROJECT_ID
Replace
PROJECT_IDwith a name for the Google Cloud project you are creating.Select the Google Cloud project that you created:
gcloud config set projectPROJECT_ID
Replace
PROJECT_IDwith your Google Cloud project name.
Verify that billing is enabled for your Google Cloud project.
- If you are not using Cloud Shell, update the Google Cloud CLIcomponents and log in using your account:
gcloudcomponentsupdategcloudauthlogin
- Enable the APIs:
gcloudservicesenableartifactregistry.googleapis.com\cloudbuild.googleapis.com\eventarc.googleapis.com\run.googleapis.com\logging.googleapis.com\pubsub.googleapis.com
- Set the configuration variables used in this tutorial:
exportREGION=us-central1gcloudconfigsetrun/region${REGION}gcloudconfigsetrun/platformmanagedgcloudconfigseteventarc/location${REGION}
- Create a service account:
SERVICE_ACCOUNT=eventarc-trigger-sagcloudiamservice-accountscreate$SERVICE_ACCOUNT
If you are under a domain restriction organization policyrestricting unauthenticated invocations for your project, you will need to access your deployed service as described underTesting private services.
Required roles
You or your administrator must grant the deployer account, the trigger identity,and optionally, the Pub/Sub service agent and the Cloud Storageservice agent the following IAM roles.
Required roles for the deployer account
If you are the project creator, you are granted thebasic Owner role(
roles/owner). By default, this Identity and Access Management (IAM) roleincludes the permissions necessary for full access to most Google Cloudresources and you can skip this step.If you are not the project creator, required permissions must be granted onthe project to the appropriateprincipal. For example, a principal can bea Google Account (for end users) or a service account (for applications andcompute workloads). For more information, see theRoles and permissions pagefor your event destination.
To get the permissions that you need to complete this tutorial, ask your administrator to grant you the following IAM roles on your project:
- Cloud Run Source Developer (
roles/run.sourceDeveloper) - Project IAM Admin (
roles/resourcemanager.projectIamAdmin) - Service Account User (
roles/iam.serviceAccountUser) - Service Usage Admin (
roles/serviceusage.serviceUsageAdmin) - Logs View Accessor (
roles/logging.viewAccessor)
For more information about granting roles, seeManage access to projects, folders, and organizations.
You might also be able to get the required permissions throughcustom roles or otherpredefined roles.
Note that by default,Cloud Build permissions include permissions to upload and download Artifact Registry artifacts.
- Cloud Run Source Developer (
Required roles for the trigger identity
Make note of theCompute Enginedefault service account as you will you attach it to an Eventarc trigger to representthe identity of the trigger for testing purposes. This service account is automatically createdafter enabling or using a Google Cloud service that uses Compute Engine, and with thefollowing email format:
PROJECT_NUMBER-compute@developer.gserviceaccount.com
Replace
PROJECT_NUMBERwith your Google Cloudproject number. You can find your project number on theWelcomepage of the Google Cloud console or by running the following command:gcloudprojectsdescribePROJECT_ID--format='value(projectNumber)'
For production environments, we strongly recommendcreating a new service accountand granting it one or more IAM roles that contain theminimum permissions requiredand follow the principle ofleast privilege.
Note:The
iam.automaticIamGrantsForDefaultServiceAccountsorganization policy constraint prevents the Editor role from being automatically granted to default service accounts. If you created your organization after May 3, 2024, this constraint is enforced by default.We strongly recommend that you enforce this constraint to disable the automatic role grant. If you disable the automatic role grant, you must decide which roles to grant to the default service accounts, and thengrant these roles yourself.
If the default service account already has the Editor role, we recommend that you replace the Editor role with less permissive roles.To safely modify the service account's roles, usePolicy Simulator to see the impact of the change, and thengrant and revoke the appropriate roles.
- By default, Cloud Run services are only callable by ProjectOwners, Project Editors, and Cloud Run Admins and Invokers.You cancontrolaccess on a per-service basis; however, for testing purposes, grant theCloud RunInvoker role (
run.invoker) on the Google Cloud project to theCompute Engine service account. This grants the role on allCloud Run services and jobs in a project.gcloudprojectsadd-iam-policy-bindingPROJECT_ID\--member=serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com\--role=roles/run.invoker
Note that if you create a trigger for an authenticatedCloud Run service without granting the Cloud RunInvoker role, the trigger is created successfully and is active. However, thetrigger will not work as expected and a message similar to the following appearsin the logs:
The request was not authenticated. Either allowunauthenticated invocations or set the proper Authorization header. - Grant theEventarcEvent Receiver role (
roles/eventarc.eventReceiver) on theproject to the Compute Engine default service account so thatthe Eventarc trigger can receive events from event providers.gcloudprojectsadd-iam-policy-bindingPROJECT_ID\--member=serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com\--role=roles/eventarc.eventReceiver
Optional role for the Cloud Storage service agent
- Before creating a trigger for direct events from Cloud Storage,grant thePub/SubPublisher role (
roles/pubsub.publisher) to theCloud Storage service agent:SERVICE_ACCOUNT="$(gcloudstorageservice-agent--project=PROJECT_ID)"gcloudprojectsadd-iam-policy-bindingPROJECT_ID\--member="serviceAccount:${SERVICE_ACCOUNT}"\--role='roles/pubsub.publisher'
Optional role for the Pub/Sub service agent
- If you enabled the Cloud Pub/Sub service agent on or before April8, 2021, to support authenticated Pub/Sub push requests, granttheServiceAccount Token Creator role (
roles/iam.serviceAccountTokenCreator)to the service agent. Otherwise, this role is granted by default:gcloudprojectsadd-iam-policy-bindingPROJECT_ID\--member=serviceAccount:service-PROJECT_NUMBER@gcp-sa-pubsub.iam.gserviceaccount.com\--role=roles/iam.serviceAccountTokenCreator
Create a Pub/Sub topic
In Cloud Run, Pub/Sub topics are not automatically createdwhen you deploy a function. Before deploying your function, publish a message tothis Pub/Sub topic to trigger the function:
gcloudpubsubtopicscreateYOUR_TOPIC_NAME
Prepare the application
Clone the sample app repository to your local machine:
Node.js
git clone https://github.com/GoogleCloudPlatform/nodejs-docs-samples.gitPython
git clone https://github.com/GoogleCloudPlatform/python-docs-samples.gitGo
git clone https://github.com/GoogleCloudPlatform/golang-samples.gitJava
git clone https://github.com/GoogleCloudPlatform/java-docs-samples.git.NET
git clone https://github.com/GoogleCloudPlatform/dotnet-docs-samples.gitRuby
git clone https://github.com/GoogleCloudPlatform/ruby-docs-samples.gitPHP
git clone https://github.com/GoogleCloudPlatform/php-docs-samples.gitChange to the directory that contains the sample code for accessing Pub/Sub:
Node.js
cd nodejs-docs-samples/functions/v2/helloPubSub/Python
cd python-docs-samples/functions/v2/pubsub/Go
cd golang-samples/functions/functionsv2/hellopubsub/Java
cd java-docs-samples/functions/v2/pubsub/.NET
cd dotnet-docs-samples/functions/helloworld/HelloPubSub/Ruby
cd ruby-docs-samples/functions/helloworld/pubsub/PHP
cd php-docs-samples/functions/helloworld_pubsub/Take a look at the sample code:
Node.js
constfunctions=require('@google-cloud/functions-framework');// Register a CloudEvent callback with the Functions Framework that will// be executed when the Pub/Sub trigger topic receives a message.functions.cloudEvent('helloPubSub',cloudEvent=>{// The Pub/Sub message is passed as the CloudEvent's data payload.constbase64name=cloudEvent.data.message.data;constname=base64name?Buffer.from(base64name,'base64').toString():'World';console.log(`Hello,${name}!`);});Python
importbase64fromcloudevents.httpimportCloudEventimportfunctions_framework# Triggered from a message on a Cloud Pub/Sub topic.@functions_framework.cloud_eventdefsubscribe(cloud_event:CloudEvent)->None:# Print out the data from Pub/Sub, to prove that it workedprint("Hello, "+base64.b64decode(cloud_event.data["message"]["data"]).decode()+"!")Go
// Package helloworld provides a set of Cloud Functions samples.packagehelloworldimport("context""fmt""log""github.com/GoogleCloudPlatform/functions-framework-go/functions""github.com/cloudevents/sdk-go/v2/event")funcinit(){functions.CloudEvent("HelloPubSub",helloPubSub)}// MessagePublishedData contains the full Pub/Sub message// See the documentation for more details:// https://cloud.google.com/eventarc/docs/cloudevents#pubsubtypeMessagePublishedDatastruct{MessagePubSubMessage}// PubSubMessage is the payload of a Pub/Sub event.// See the documentation for more details:// https://cloud.google.com/pubsub/docs/reference/rest/v1/PubsubMessagetypePubSubMessagestruct{Data[]byte`json:"data"`}// helloPubSub consumes a CloudEvent message and extracts the Pub/Sub message.funchelloPubSub(ctxcontext.Context,eevent.Event)error{varmsgMessagePublishedDataiferr:=e.DataAs(&msg);err!=nil{returnfmt.Errorf("event.DataAs: %w",err)}name:=string(msg.Message.Data)// Automatically decoded from base64.ifname==""{name="World"}log.Printf("Hello, %s!",name)returnnil}Java
importcom.google.cloud.functions.CloudEventsFunction;importcom.google.gson.Gson;importfunctions.eventpojos.PubSubBody;importio.cloudevents.CloudEvent;importjava.nio.charset.StandardCharsets;importjava.util.Base64;importjava.util.logging.Logger;publicclassSubscribeToTopicimplementsCloudEventsFunction{privatestaticfinalLoggerlogger=Logger.getLogger(SubscribeToTopic.class.getName());@Overridepublicvoidaccept(CloudEventevent){// The Pub/Sub message is passed as the CloudEvent's data payload.if(event.getData()!=null){// Extract Cloud Event data and convert to PubSubBodyStringcloudEventData=newString(event.getData().toBytes(),StandardCharsets.UTF_8);Gsongson=newGson();PubSubBodybody=gson.fromJson(cloudEventData,PubSubBody.class);// Retrieve and decode PubSub message dataStringencodedData=body.getMessage().getData();StringdecodedData=newString(Base64.getDecoder().decode(encodedData),StandardCharsets.UTF_8);logger.info("Hello, "+decodedData+"!");}}}.NET
usingCloudNative.CloudEvents;usingGoogle.Cloud.Functions.Framework;usingGoogle.Events.Protobuf.Cloud.PubSub.V1;usingMicrosoft.Extensions.Logging;usingSystem.Threading;usingSystem.Threading.Tasks;namespaceHelloPubSub;publicclassFunction:ICloudEventFunction<MessagePublishedData>{privatereadonlyILogger_logger;publicFunction(ILogger<Function>logger)=>_logger=logger;publicTaskHandleAsync(CloudEventcloudEvent,MessagePublishedDatadata,CancellationTokencancellationToken){stringnameFromMessage=data.Message?.TextData;stringname=string.IsNullOrEmpty(nameFromMessage)?"world":nameFromMessage;_logger.LogInformation("Hello {name}",name);returnTask.CompletedTask;}}Ruby
require"functions_framework"require"base64"FunctionsFramework.cloud_event"hello_pubsub"do|event|# The event parameter is a CloudEvents::Event::V1 object.# See https://cloudevents.github.io/sdk-ruby/latest/CloudEvents/Event/V1.htmlname=Base64.decode64event.data["message"]["data"]rescue"World"# A cloud_event function does not return a response, but you can log messages# or cause side effects such as sending additional events.logger.info"Hello,#{name}!"endPHP
use CloudEvents\V1\CloudEventInterface;use Google\CloudFunctions\FunctionsFramework;// Register the function with Functions Framework.// This enables omitting the `FUNCTIONS_SIGNATURE_TYPE=cloudevent` environment// variable when deploying. The `FUNCTION_TARGET` environment variable should// match the first parameter.FunctionsFramework::cloudEvent('helloworldPubsub', 'helloworldPubsub');function helloworldPubsub(CloudEventInterface $event): void{ $log = fopen(getenv('LOGGER_OUTPUT') ?: 'php://stderr', 'wb'); $cloudEventData = $event->getData(); $pubSubData = base64_decode($cloudEventData['message']['data']); $name = $pubSubData ? htmlspecialchars($pubSubData) : 'World'; fwrite($log, "Hello, $name!" . PHP_EOL);}
base64-encodedstring in thedata property of thePubsubMessageobject. To extract this data, you may need to decode it as shown in thepreceding sample code.Deploy an event-driven function
To deploy the function, run the following command in the directory that containsthe sample code:
Node.js
gcloud run deployFUNCTION \ --source . \ --function helloPubSub \ --base-imageBASE_IMAGE \Replace:
- FUNCTION with the name of the function you are deploying. Ifyou omit this parameter, you will be prompted to enter a name when you run thecommand.
- BASE_IMAGE with the base image environment for your function, for example,
nodejs24. For more details about base images and the packages included in each image, seeSupported language runtimes and base images.
Python
gcloud run deployFUNCTION \ --source . \ --function subscribe \ --base-imageBASE_IMAGE \Replace:
- FUNCTION with the name of the function you are deploying. Ifyou omit this parameter, you will be prompted to enter a name when you run thecommand.
- BASE_IMAGE with the base image environment for your function, for example,
python313. For more details about base images and the packages included in each image, seeSupported language runtimes and base images.
Go
gcloud run deployFUNCTION \ --source . \ --function HelloPubSub \ --base-imageBASE_IMAGE \Replace:
- FUNCTION with the name of the function you are deploying. Ifyou omit this parameter, you will be prompted to enter a name when you run thecommand.
- BASE_IMAGE with the base image environment for your function, for example,
go125. For more details about base images and the packages included in each image, seeSupported language runtimes and base images.
Java
gcloud run deployFUNCTION \ --source . \ --function functions.SubscribeToTopic \ --base-imageBASE_IMAGE \Replace:
- FUNCTION with the name of the function you are deploying. Ifyou omit this parameter, you will be prompted to enter a name when you run thecommand.
- BASE_IMAGE with the base image environment for your function, for example,
java21. For more details about base images and the packages included in each image, seeSupported language runtimes and base images.
.NET
gcloud run deployFUNCTION \ --source . \ --function HelloPubSub.Function \ --base-imageBASE_IMAGE \Replace:
- FUNCTION with the name of the function you are deploying. Ifyou omit this parameter, you will be prompted to enter a name when you run thecommand.
- BASE_IMAGE with the base image environment for your function, for example,
dotnet8. For more details about base images and the packages included in each image, seeSupported language runtimes and base images.
Ruby
gcloud run deployFUNCTION \ --source . \ --function hello_pubsub \ --base-imageBASE_IMAGE \Replace:
- FUNCTION with the name of the function you are deploying. Ifyou omit this parameter, you will be prompted to enter a name when you run thecommand.
- BASE_IMAGE with the base image environment for your function, for example,
ruby34. For more details about base images and the packages included in each image, seeSupported language runtimes and base images.
PHP
gcloud run deployFUNCTION \ --source . \ --function helloworldPubsub \ --base-imageBASE_IMAGE \Replace:
- FUNCTION with the name of the function you are deploying. Ifyou omit this parameter, you will be prompted to enter a name when you run thecommand.
- BASE_IMAGE with the base image environment for your function, for example,
php84. For more details about base images and the packages included in each image, seeSupported language runtimes and base images.
If you are prompted to create a repository in the specified region, respond bypressingy.When the deployment is complete, the Google Cloud CLI displays a URL wherethe service is running.
Create an Eventarc trigger
To deploy the function with a Pub/Sub trigger, run the following commandin the directory that contains the sample code:
Create an Eventarc Pub/Sub trigger:
gcloudeventarctriggerscreateTRIGGER_NAME\--location=${REGION}\--destination-run-service=FUNCTION\--destination-run-region=${REGION}\--event-filters="type=google.cloud.pubsub.topic.v1.messagePublished"\--service-account=PROJECT_NUMBER-compute@developer.gserviceaccount.com
Replace:
- TRIGGER_NAME with the name for your trigger.
- FUNCTION with the name of your function.
- PROJECT_NUMBER with your Google Cloud project number.
Note that when creating an Eventarc trigger for the firsttime in a Google Cloud project, there might be a delay in provisioningthe Eventarc service agent. This issue can usually be resolvedby attempting to create the trigger again. For more information, seePermission denied errors.
Confirm that the trigger was successfully created. Note that although yourtrigger is created immediately, it can take up to two minutes for a triggerto be fully functional.
gcloudeventarctriggerslist--location=${REGION}
The output should be similar to the following:
NAME: helloworld-eventsTYPE: google.cloud.pubsub.topic.v1.messagePublishedDESTINATION: Cloud Run service: helloworld-eventsACTIVE: YesLOCATION: us-central1
Trigger the function
To test the Pub/Sub function:
Assign the topic to a variable:
TOPIC_ID=$(gcloud eventarc triggers describeTRIGGER_NAME --location $REGION --format='value(transport.pubsub.topic)')Publish a message to the topic:
gcloud pubsub topics publish $TOPIC_ID --message="Hello World"
The Cloud Run service logs the body of the incoming message. You canview this in the Logs section of your Cloud Run instance:
- Navigate to theGoogle Cloud console.
- Click the function.
Select theLogs tab.
Logs might take a few moments to appear. If you don't see them immediately, check again after a few moments.
Look for the "Hello World!" message.
Clean up
If you created a new project for this tutorial,delete the project.If you used an existing project and want to keep it without the changes addedin this tutorial,delete the resources created for the tutorial.
Delete the project
The easiest way to eliminate billing is to delete the project that you created for the tutorial.
To delete the project:
Delete tutorial resources
Delete the Cloud Run service you deployed in this tutorial:
gcloudrunservicesdeleteSERVICE_NAME
Where
SERVICE_NAMEis your chosen service name.You can also delete Cloud Run services from theGoogle Cloud console.
Remove any gcloud CLI default configurations you added duringthe tutorial setup.
For example:
gcloud config unset run/regionor
gcloud config unset projectDelete other Google Cloud resources created in this tutorial:
- Delete the Eventarc trigger:
Replacegcloud eventarc triggers deleteTRIGGER_NAME
TRIGGER_NAMEwith the name of yourtrigger.
- Delete the Eventarc trigger:
What's next
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-12-17 UTC.