The Cloud Run service I am working on was implemented requiring authentication (IAM managed).

The service should now be extended to handle GitHub events as a GitHub App. As I understand this means the service needs to be publicly accessible now.

We opted to add middleware which protects the legacy routes and leave the GitHub routes open, since GitHub has its own security mechanic for calling back to GitHub.

There is some logic now to check the iss and hd claims to have certain values to make sure the ID token is valid.

Now I just realized though, that this not enough. I also want to check that the identity has permissions to invoke the Cloud Run service.

How would I do that? I couldn’t find any API in that regard.