Missing support for run.googleapis.com/invoker-iam-disabled annotation in google_cloud_run_v2_service

[rgrzesk]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

Description
The google_cloud_run_v2_service resource does not support setting the run.googleapis.com/invoker-iam-disabled annotation, which is Google's recommended way to allow public (unauthenticated) access to Cloud Run services.
According to Google's official documentation, there are two methods to allow public access:

Disable the Cloud Run Invoker IAM check (recommended) - uses annotation run.googleapis.com/invoker-iam-disabled: 'true'
Assign the Cloud Run Invoker IAM role to allUsers

Currently, Terraform only supports method #2 via google_cloud_run_v2_service_iam_member, which creates a UI inconsistency where the GCP Console shows "Require authentication" selected despite the service being publicly accessible.
New or Affected Resource(s)

google_cloud_run_v2_service

Potential Terraform Configuration
Current workaround:
hclresource "google_cloud_run_v2_service" "default" {
  name     = "my-service"
  location = "us-central1"
  // config
}

resource "google_cloud_run_v2_service_iam_member" "public" {
  name     = google_cloud_run_v2_service.default.name
  location = google_cloud_run_v2_service.default.location
  role     = "roles/run.invoker"
  member   = "allUsers"
}
UI shows: "Require authentication" ⚠️ (with warning about allUsers access)
Desired configuration:
hclresource "google_cloud_run_v2_service" "default" {
  name     = "my-service"
  location = "us-central1"
  
  template {
    annotations = {
      "run.googleapis.com/invoker-iam-disabled" = "true"
    }
  }
  // rest of config
}

UI would show: "Allow public access" ✓
References

Google Cloud Run: Allowing public (unauthenticated) access
Related issue for Cloud Functions v2: #23360
Related IAM inconsistency issue: #18831

Additional Context
The annotation is available via gcloud (--allow-unauthenticated) and works correctly when set manually in the Console or via YAML. Supporting this annotation in Terraform would align with Google's recommended approach and provide better UX consistency between Terraform-managed resources and the GCP Console.

New or Affected Resource(s)

• google_7.13.0

Potential Terraform Configuration

resource "google_cloud_run_v2_service" "default" {
  name     = "my-service"
  location = "us-central1"
  
  template {
    annotations = {
      "run.googleapis.com/invoker-iam-disabled" = "true"
    }
  }
  // rest of config
}

References

No response

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.