You have multiple Cloud Run microservices: some must be publicly reachable, others require Google identity authentication. Use the most secure, low-management approach to allow public access to some services while restricting others to authenticated users. How do you configure access?

The correct approach is to host public and restricted code as separate Cloud Run services. This allows granular control over access. Enabling IAP only for restricted services provides robust, managed authentication for those services. Setting Cloud Run ingress to 'Internal and Cloud Load Balancing' for the public services allows them to be exposed publicly, typically via a Load Balancer, without requiring IAP. This is the most secure and low-management solution because IAP handles authentication without custom code, and public services remain unauthenticated as required. Incorrect options: Enabling IAP for all microservices and building a new microservice for routing is overly complex and introduces unnecessary management overhead and a single point of failure. Enabling IAP for all microservices and managing ACLs with allAuthenticatedUsers for public services is less secure, as IAP still processes requests for public services, adding latency and unnecessary complexity. Using Cloud Endpoints with Firebase Authentication is a valid authentication method but is generally more complex to set up and manage for simple Cloud Run services compared to IAP, which is deeply integrated with Cloud Run.