IssueTracker

Also, curious how other customers are solving this problem currently? Is there a workaround that our customers can use?

A workaround for this is to use a Pub/Sub push subscription that invokes your Cloud Function over HTTP. This is the officially supported way of doing it.

This is essentially what is being set up a function is created with a Cloud Storage bucket trigger.

• ProjectA - where the Cloud Function resides, NOT the Cloud Storage bucket we wish to see notifications from
• FunctionA - function handling the bucket notifications
• ProjectB - where the bucket, Pub/Sub topic and Pub/Sub subscription reside
• BucketB - bucket NOT in ProjectA that we want to have events invoke FunctionA
• SubscriptionB - push subscription used to pass bucket changes to an HTTP endpoint (FunctionA)
• TopicB - topic where messages about changes to BucketB go
• ServiceaccountB - service account configured in TopicB that has permissions to invoke FunctionA in ProjectA

ProjectA: Configure the Cloud Function

1. create FunctionA
2. make sure FunctionA is HTTP invokable
3. grant permissions for a service account in ProjectB to invoke the function by adding it as a principal under Permissions in the FunctionA config (eg ServiceaccountB@projectb.iam.gserviceaccount.com)
4. get the HTTP trigger of FunctionA under the Trigger tab https://us-central1-projecta.cloudfunctions.net/FunctionA
5. save it

ProjectB: Create Pub/Sub TopicB and enable notifications

1. create TopicB
2. enable notifications on the bucket using gsutil notification create -t TopicB -f json gs://BucketB

ProjectB: Create a push subscription on TopicB

1. create SubscriptionB
2. set the push target at https://us-central1-projecta.cloudfunctions.net/FunctionA
3. enable authentication and set it as ServiceaccountB@projectb.iam.gserviceaccount.com
4. save SubscriptionB

Test by writing an object to BucketB, you should see invocations in the logs for FunctionA, or you will see Pub/Sub errors on SubscriptionB in ProjectB. The body of the POST to FunctionA will be data from the bucket.

The implementation of this feature is infeasible given the architecture of GCP and the way that the Cloud Function creation UI works, in that it needs to populate options by iterating all IAM allowed projects. It may be possible to add an entry field and verify later, but this is not part of the current product roadmap.

An update here; the product team would like to keep this open for consideration as they do believe it's something worth solving. However, we don't have a timeline for this, it is advised to use the workaround mentioned in the previous comment for the time being.

+1'ing from Cloud Marketplace. Our 3rd party SaaS partners need to integrate with Pub/Sub topics from a Google-owned project (ref). We want to encourage partners to use GCP for their underlying implementation to help further enterprise GCP adoption, but this limitation adds friction since they'd need to repipe the Pub/Sub events to a topic in their own project.

Here is the solution: Pub/Sub — Push Messages to Cloud Function Endpoint in a different GCP Project

Step 1: Ensure In API and services , Pub/Sub API is enabled

Step 2: In Project A, Go to Pub/Sub then create a pubsub topic from GUI by providing the topic ID as required with default settings (In projectA created topic projects/projectid/topics/dhanatest) and here is how we create topic from UI:

Step 3:In Project B, create a basic cloud function in python of 1st gen with http trigger (check Require https) and here is attached cloud function(function-dp) code I used in Project-- B and in the service account in Runtime , please give service account which has roles Cloud Functions Invoker, Pub/Sub Publisher, Pub/Sub Subscriber, Logging Admin () and Go to Cloud Functions from search UI and below is how to create simple cloud function from UI:

Step 4:

4a) Create a push subscription in Project B taking Project A’s topic from UI and click on Enable Authentication.

4b) After clicking Enable Authentication , It asks for Endpoint Url and service account ,so In Endpoint Url , Give https url from cloud function and for service account , give service account with roles Cloud Functions Invoker, Pub/Sub Publisher, Pub/Sub Subscriber, Logging Admin, leave remaining fields default and click on create to create subscription

Step 5:Now, Publish message from Project A and see the cloud function logs, We should see Function executed successfully with return code:200

Note:We can do the above thing not only from UI , we can do from Python code also to creaste subscriptionand here is the attached code, we can run from cloud shell the python file.