gcp-periodic mode using http gets permission error when scheduler job tries to trigger cloud function

Describe the bug Not sure if it’s a bug or a feature request since GCP is still beta. I ran a gcp-periodic mode policy which deployed a Cloud Scheduler job and Cloud Function with Http trigger successfully. But Cloud Scheduler job did not have auth header setup so it gets permission error when scheduler job tries to trigger cloud function via HTTP.

To Reproduce Ran this policy ` policies:

• name: custodian-periodic-test resource: gcp.sql-instance mode: type: gcp-periodic service-account: ‘[e-mail]’ schedule: ‘0 0 * * 1-5’ `

Expected behavior I’ve played around with it. If I manually setup Auth header by adding OIDC token to the Cloud Scheduler job using the service-account ‘[e-mail]’, permission issue goes away and scheduler job triggers cloud function correctly.

[kapilt]

its one topic per periodic policy, custodian already has support for creating the pub/sub topic as we use it for doing api audit log response (cloudtrail style) policies. at least for gcp serverless we already have support for deleting things, we do need to wire processing gcp serverless policies that into mugc though, but its a relatively light lift.

[kapilt]

thats fair re reference to service account and that sounds reasonable to support, but i think we’ll still want to switch to default pub/sub as its less to configure for the user, is there a concern with pub/sub, just wondering why http endpoint is useful.