Quickstart: Secure traffic to a service with the gcloud CLI

This page shows you how to deploy an API on API Gateway to secure traffic to a backend service.

Use the following steps to deploy a new API to access a backend service on Cloud Run functions using the Google Cloud CLI. This quickstart also describes how to use an API key to protect your backend from unauthorized access.

Before you begin

In the Google Cloud console, go to the Dashboard page and select or create a Google Cloud project.
Go to Dashboard

Note: If you don't plan to keep the resources you create in this quickstart, create a new project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.
Confirm that billing is enabled for your project.
Enable billing
Verify that the Google Cloud CLI is downloaded and installed on your machine.
Download the gcloud CLI
Update gcloud components:
```
gcloud components update
```
Set the default project. Replace PROJECT_ID with your Google Cloud project ID.
```
gcloud config set project PROJECT_ID
```

Enable required services

API Gateway requires that you enable the following Google Cloud services:

Name	Service name
API Gateway API	`apigateway.googleapis.com`
Service Management API	`servicemanagement.googleapis.com`
Service Control API	`servicecontrol.googleapis.com`

To enable required services:

Google Cloud console

In the Google Cloud console, go to the APIs & Services > API Library page.

Go to API Library
On the API Library page, enter the required API name into the search bar.
In the search results, select the API page.
On the API page, click Enable.
Repeat these steps for each of the services listed in the preceding table.

Google Cloud CLI

Use the following commands to enable the services:

gcloud services enable apigateway.googleapis.com
gcloud services enable servicemanagement.googleapis.com
gcloud services enable servicecontrol.googleapis.com

For more information about the gcloud services, see gcloud services.

Deploy an API backend

API Gateway sits in front of a deployed backend service and handles all incoming requests. In this quickstart, API Gateway routes incoming calls to a Cloud Run function backend named helloGET that contains the Node.js function shown below.

const functions = require('@google-cloud/functions-framework');

// Register an HTTP function with the Functions Framework that will be executed
// when you make an HTTP request to the deployed function's endpoint.
functions.http('helloGET', (req, res) => {
  res.send('Hello World!');
});

Follow the steps in Quickstart: Deploy a Cloud Run function using the Google Cloud CLI to download the sample Cloud Run functions code and deploy the Cloud Run function backend service. Your administrator will need to grant additional roles to your account and and to the Cloud Build service account, as described in this quick start.

Copy the Service URL that is displayed when the Cloud Run function is deployed. You'll need it when creating the API config in a subsequent step.

Create an API

Now you are ready to create your API on API Gateway.

Enter the following command, where:
- API_ID specifies the name of your API. See API ID requirements for API naming guidelines.
```
gcloud api-gateway apis create API_ID 
```
For example:
```
gcloud api-gateway apis create my-api
```

On successful completion, you can use the following command to view details about the new API:

gcloud api-gateway apis describe API_ID

For example:

gcloud api-gateway apis describe my-api

This command returns the following:

  createTime: '2020-02-29T21:52:20.297426875Z'
  displayName: my-api
  managedService: my-api-123abc456def1.apigateway.my-project.cloud.goog
  name: projects/my-project/locations/global/apis/my-api
  state: ACTIVE
  updateTime: '2020-02-29T21:52:20.647923711Z'

Copy the value of the managedService property. This value is used to enable your API in a subsequent step.

Create an API config

Before API Gateway can be used to manage traffic to your deployed API backend, it needs an API config.