EventarcAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

• Events from Google CloudDirect events come from services such as Cloud Storage, and audit log events cover calls to services that don’t send direct events. A trigger names the type and the details you care about.
• Pub/Sub messages as eventsAny system that can publish to Pub/Sub can become an event source, and the trigger wraps the message in a CloudEvent for the destination.
• Destinations that fit serverlessCloud Run services and functions, GKE services, Workflows and internal HTTP endpoints receive events over HTTP, with Google-signed identity.
• One event formatEverything arrives as a CloudEvent, with the attributes in ce- headers. A handler written for one source understands the others.
• A message bus (Advanced)Publish your own events to a regional bus, and let many teams subscribe. A bus can also receive events from Google Cloud sources.
• Enrollments and CELAn enrollment subscribes a pipeline to a bus with a CEL condition over the message, so each consumer gets only its share.
• Pipelines that reshape messagesA pipeline can transform a message with a template and convert between JSON, Avro and Protobuf before it delivers to one destination.
• Retries from Pub/SubStandard triggers use Pub/Sub underneath, so redelivery, backoff and a dead-letter topic work the way they do on any Pub/Sub subscription.

Event

A record that something happened, in the CloudEvents format: attributes such as id, source, type and subject, plus a data payload.

Trigger (Standard)

A named rule that says which events to take, from which source, and where to deliver them. It has a location, a destination and a service account.

Direct event

An event a Google Cloud service publishes itself, such as google.cloud.storage.object.v1.finalized when a new object is stored.

Audit log event

An event made from a Cloud Audit Logs entry, with the type google.cloud.audit.log.v1.written. Data Access logs must be on for services that don’t log those calls by default.

Transport topic

The Pub/Sub topic that carries a Standard trigger’s events. Eventarc creates it and a push subscription for you.

Message bus (Advanced)

The regional channel that receives events from your publishers and Google Cloud sources. There is one per project and region.

Google API source

The link that lets a bus receive events from Google Cloud services in the project.

Enrollment

A subscription to a bus. A CEL condition selects the messages, and the matching ones go to a pipeline.

Pipeline

The delivery step: an optional transformation, then one destination such as an HTTP endpoint, a workflow, a Pub/Sub topic or another bus.

CEL (Common Expression Language)

A small expression language used in enrollments and transformations, for example message.type == 'com.example.order.placed'.

CloudEvents

A vendor-neutral event specification from the CNCF. In HTTP delivery, the attributes become ce- headers (binary mode) or fields in a JSON body.

Trigger service account

The identity that Eventarc uses to receive events and to call the destination. It needs the event receiver role and permission to invoke the target.

Dead-letter topic

A Pub/Sub topic that receives messages a subscription could not deliver after the allowed attempts. It is set on the subscription.

Trigger a Cloud Run service from a bucket with gcloud

1. Pick the editionStandard fits events from Google Cloud and Pub/Sub into one destination each. Advanced fits your own events, many subscribers and transformations. You can use both in one project.
2. Enable the APIsTurn on Eventarc, Cloud Run and Pub/Sub, and the Eventarc publishing API if you plan to use a bus.
3. Create a service account for triggersGive it the event receiver role. Use one per application, not the default Compute Engine account.
4. Deploy a private receiving serviceKeep the Cloud Run service closed to the public, and allow only the trigger’s identity to invoke it.
5. Create the triggerName the event type and the bucket, point it at the service, and pass the service account. The trigger’s location has to match the bucket’s location.
6. Add a dead-letter topic on the transport subscriptionEventarc creates a Pub/Sub subscription for the trigger. Set a dead-letter topic and a retry window there, so a failing handler doesn’t lose events.
7. Test with a real eventUpload a file and read the service’s log. Check that the handler answers with a 2xx quickly, since anything else means a retry.
8. Add an Advanced bus for your own eventsCreate the bus, a pipeline to the service, and an enrollment with a CEL condition. Publish a test message.
9. Watch the subscription and the serviceUndelivered message counts and the oldest message age on the transport subscription show trouble before anyone complains.

• Return a 2xx answer quickly and do long work afterwards, because slow handlers cause redelivery.
• Keep events small: send an object name or an ID, not a copy of the data.
• Set minimum instances on Cloud Run for latency-sensitive handlers, or accept the cold start.
• Filter in the trigger or the CEL condition, so the handler isn’t invoked for events it ignores.
• Use regional triggers in the same region as the source and the destination to cut latency and egress.
• Let Pub/Sub absorb bursts: check the subscription’s backlog before you scale the handler.
• Use pipelines to adjust message shape once, instead of every consumer repeating the work.
• Treat delivery as at least once, and design handlers for duplicates and for events out of order.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Eventarc.

• Remember the free monthly allowance of 50,000 chargeable events on Standard, and that events from Google and Pub/Sub sources aren’t charged by Eventarc itself.
• Add the Pub/Sub transport to your estimate, since Standard bills it on its own.
• Narrow audit log filters to one method and resource, because each matching log entry is an event.
• Fix failing handlers: retries multiply requests, transport traffic and Cloud Run time.
• On Advanced, count bus publishes, pipeline messages and transformations separately, and avoid chains of buses and pipelines.
• Publish fewer, smaller messages, and batch or sample chatty producers.
• Delete unused triggers, buses and pipelines, and their transport subscriptions.
• Keep Cloud Logging volume in check, since verbose handler logs can cost more than the events themselves.
• Don’t use Advanced when a single Standard trigger does the job.
• Label triggers and buses with the owning team, and put a budget alert on Eventarc and Pub/Sub spend.

• Give each trigger its own service account with the event receiver role and the invoker role on one service.
• Keep receiving services private, and require authentication on every call.
• Grant IAM roles at the narrowest scope, and review who can create or edit triggers, buses and pipelines.
• Use customer-managed encryption keys on buses and pipelines when policy requires them.
• Use VPC Service Controls around Eventarc, Pub/Sub and the destination for sensitive projects.
• Keep personal data and secrets out of event payloads and subjects.
• Use Pub/Sub dead-letter topics with restricted access, since they hold copies of the events that failed.
• Turn on audit logs for Eventarc itself, and alert on changes to triggers and IAM.
• Use an Organization Policy to limit where resources can be created, so triggers stay in approved locations.
• For internal HTTP destinations, use a network attachment and keep the path private.

Cloud Audit Logs record who changed triggers and buses, Cloud Asset Inventory answers questions about configuration, Security Command Center reports on risky settings, and Google’s published compliance reports hold audit material. Google runs the service and keeps messages safe in transit and at rest. Event design, who may publish and consume, retry and dead-letter settings, and the handler’s own security are yours.

• Trim event volume at the source: batch or sample producers that are chatty.
• Use exact filters so handlers aren’t invoked for events they discard.
• Fix failing handlers, since every retry repeats work and traffic.
• Delete unused triggers, buses, pipelines and their subscriptions.
• Where residency rules and latency allow, use a region with a lower grid carbon intensity. Google publishes carbon data for its regions.
• Google’s carbon footprint report works by project and service and may not list Eventarc on its own, so quote no Eventarc figure.

Purchase options

What you actually pay for

• Standard events above the monthly free allowance, for sources other than Google and Pub/Sub
• Pub/Sub message delivery for the transport topic and subscription
• Advanced bus publishes, pipeline messages and transformation operations
• Cloud Run, Workflows or GKE resources that handle the events
• Cloud Logging for handler and audit log volume

File uploads and order events: a private Cloud Run service, a trigger for new files in one bucket and one for new VMs from an audit log, then an Advanced bus, pipeline and enrollment for your own order events. The gcloud tab builds it and publishes a test event; Terraform describes the same resources. The Python tab is the receiving service, with Flask and the CloudEvents library, and the C# tab audits a project’s Standard triggers for default service accounts, unfiltered storage triggers and unhealthy conditions. Replace the project, region and bucket with your own, and try it in a scratch project first.

# Placeholders: replace the project, region and bucket with your own. The hello image is only a stand-in for your service.
PROJECT=my-project
REGION=asia-south1
BUCKET=my-project-uploads
SVC=upload-handler
SA=eventarc-invoker
SA_EMAIL=$SA@$PROJECT.iam.gserviceaccount.com
gcloud config set project $PROJECT

# 1. Turn on the APIs the setup uses.
gcloud services enable eventarc.googleapis.com run.googleapis.com pubsub.googleapis.com eventarcpublishing.googleapis.com

# 2. A service account of its own for the triggers. It may receive events and may call the Cloud Run service.
gcloud iam service-accounts create $SA --display-name "Eventarc trigger identity"
gcloud projects add-iam-policy-binding $PROJECT --member serviceAccount:$SA_EMAIL --role roles/eventarc.eventReceiver

# 3. The receiving service. It stays private: only the trigger's identity may call it.
gcloud run deploy $SVC --region $REGION --image us-docker.pkg.dev/cloudrun/container/hello --no-allow-unauthenticated
gcloud run services add-iam-policy-binding $SVC --region $REGION --member serviceAccount:$SA_EMAIL --role roles/run.invoker

# 4. Eventarc Standard: a trigger for new files in one bucket. The type is required, and so is the bucket for this type.
gcloud eventarc triggers create uploads-trigger --location $REGION \
  --event-filters type=google.cloud.storage.object.v1.finalized --event-filters bucket=$BUCKET \
  --destination-run-service $SVC --destination-run-region $REGION --service-account $SA_EMAIL

# 5. A second trigger from an audit log: tell the service whenever someone creates a VM. Data Access audit logs must be on for this service.
gcloud eventarc triggers create vm-created-trigger --location $REGION \
  --event-filters type=google.cloud.audit.log.v1.written --event-filters serviceName=compute.googleapis.com \
  --event-filters methodName=v1.compute.instances.insert \
  --destination-run-service $SVC --destination-run-region $REGION --service-account $SA_EMAIL

# 6. Check the triggers, then drop a file in the bucket and read the service's log.
gcloud eventarc triggers list --location $REGION
echo hello > hello.txt && gcloud storage cp hello.txt gs://$BUCKET/hello.txt
gcloud run services logs read $SVC --region $REGION --limit 20

# 7. Eventarc Advanced: a message bus for your own events, a pipeline to the service and an enrollment that picks the events.
URL=$(gcloud run services describe $SVC --region $REGION --format 'value(status.url)')
gcloud eventarc message-buses create orders-bus --location $REGION
gcloud eventarc pipelines create orders-to-service --location $REGION \
  --destinations=http_endpoint_uri=$URL,google_oidc_authentication_service_account=$SA_EMAIL
gcloud eventarc enrollments create order-placed --location $REGION --message-bus orders-bus \
  --cel-match "message.type == 'com.example.order.placed'" --destination-pipeline orders-to-service

# 8. Publish one event to the bus.
gcloud eventarc message-buses publish orders-bus --location $REGION --event-id A-1001 --event-type com.example.order.placed \
  --event-source //shop/orders --event-data '{"orderId": "A-1001", "total": 2500}'
gcloud run services logs read $SVC --region $REGION --limit 5

# Placeholders: pass in your own project and bucket name. The hello image stands in for your service.
variable "project_id" {
  type = string
}

variable "region" {
  type    = string
  default = "asia-south1"
}

variable "bucket_name" {
  type = string
}

provider "google" {
  project = var.project_id
  region  = var.region
}

resource "google_project_service" "apis" {
  for_each = toset([
    "eventarc.googleapis.com", "run.googleapis.com", "pubsub.googleapis.com", "eventarcpublishing.googleapis.com",
  ])
  service            = each.value
  disable_on_destroy = false
}

resource "google_service_account" "trigger" {
  account_id   = "eventarc-invoker"
  display_name = "Eventarc trigger identity"
}

resource "google_project_iam_member" "receiver" {
  project = var.project_id
  role    = "roles/eventarc.eventReceiver"
  member  = "serviceAccount:${google_service_account.trigger.email}"
}

resource "google_cloud_run_v2_service" "handler" {
  name     = "upload-handler"
  location = var.region
  ingress  = "INGRESS_TRAFFIC_ALL"

  template {
    containers {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }

  depends_on = [google_project_service.apis]
}

# Only the trigger's identity may call the service.
resource "google_cloud_run_v2_service_iam_member" "invoker" {
  name     = google_cloud_run_v2_service.handler.name
  location = var.region
  role     = "roles/run.invoker"
  member   = "serviceAccount:${google_service_account.trigger.email}"
}

resource "google_storage_bucket" "uploads" {
  name                        = var.bucket_name
  location                    = var.region
  uniform_bucket_level_access = true
}

# Storage events travel through Pub/Sub, so the Cloud Storage service agent must be allowed to publish.
data "google_storage_project_service_account" "gcs" {}

resource "google_project_iam_member" "gcs_publisher" {
  project = var.project_id
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:${data.google_storage_project_service_account.gcs.email_address}"
}

resource "google_eventarc_trigger" "uploads" {
  name     = "uploads-trigger"
  location = var.region

  matching_criteria {
    attribute = "type"
    value     = "google.cloud.storage.object.v1.finalized"
  }

  matching_criteria {
    attribute = "bucket"
    value     = google_storage_bucket.uploads.name
  }

  destination {
    cloud_run_service {
      service = google_cloud_run_v2_service.handler.name
      region  = var.region
    }
  }

  service_account = google_service_account.trigger.email

  depends_on = [google_project_iam_member.receiver, google_project_iam_member.gcs_publisher]
}

# Eventarc Advanced: a bus for your own events, a pipeline to the service, and an enrollment that picks the events.
resource "google_eventarc_message_bus" "orders" {
  location       = var.region
  message_bus_id = "orders-bus"

  depends_on = [google_project_service.apis]
}

resource "google_eventarc_pipeline" "orders" {
  location    = var.region
  pipeline_id = "orders-to-service"

  destinations {
    http_endpoint {
      uri = google_cloud_run_v2_service.handler.uri
    }
    authentication_config {
      google_oidc {
        service_account = google_service_account.trigger.email
      }
    }
  }
}

resource "google_eventarc_enrollment" "placed" {
  enrollment_id = "order-placed"
  location      = var.region
  message_bus   = google_eventarc_message_bus.orders.id
  cel_match     = "message.type == 'com.example.order.placed'"
  destination   = google_eventarc_pipeline.orders.id
}

output "service_url" {
  value = google_cloud_run_v2_service.handler.uri
}

# pip install flask "cloudevents<2" gunicorn
# A Cloud Run service that receives events from Eventarc and reacts to three kinds of them.
# Save as app.py and run it on Cloud Run with:  gunicorn --bind :$PORT app:app
# Eventarc posts a CloudEvent as an HTTP request, with the attributes in ce-* headers and the data in the body.
import os

from cloudevents.http import from_http
from flask import Flask, request

app = Flask(__name__)
handled = set()  # in memory only; use Firestore or Redis if the same event must never run twice across instances


@app.post("/")
def receive():
    event = from_http(request.headers, request.get_data())
    if event["id"] in handled:  # delivery is at least once, so a repeat is normal
        return "", 204

    kind, data = event["type"], event.data
    if kind == "google.cloud.storage.object.v1.finalized":
        print("new object gs://%s/%s (%s bytes)" % (data["bucket"], data["name"], data.get("size", "?")), flush=True)
    elif kind == "google.cloud.audit.log.v1.written":
        proto = data.get("protoPayload", {})
        print("%s called %s on %s" % (proto.get("authenticationInfo", {}).get("principalEmail", "someone"),
                                      proto.get("methodName"), proto.get("resourceName")), flush=True)
    elif kind == "com.example.order.placed":
        print("order %s for %s" % (data["orderId"], data["total"]), flush=True)
    else:
        print("ignoring", kind, flush=True)  # answer 2xx for what you don't handle, or Pub/Sub keeps redelivering it

    handled.add(event["id"])
    return "", 204  # any non-2xx answer makes Eventarc retry, so reserve errors for real, temporary failures


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=int(os.environ.get("PORT", 8080)))

// dotnet add package Google.Cloud.Eventarc.V1
// Audits the Eventarc Standard triggers of a project in one location: triggers that use the default Compute Engine
// service account, triggers that watch every bucket, and triggers whose conditions report a problem.
using Google.Cloud.Eventarc.V1;

string project = args.Length > 0 ? args[0] : "my-project";
string location = args.Length > 1 ? args[1] : "asia-south1";
int problems = 0;

EventarcClient client = EventarcClient.Create();
foreach (Trigger trigger in client.ListTriggers($"projects/{project}/locations/{location}"))
{
    string name = trigger.TriggerName.TriggerId;

    if (string.IsNullOrEmpty(trigger.ServiceAccount) || trigger.ServiceAccount.EndsWith("-compute@developer.gserviceaccount.com"))
    {
        Console.WriteLine($"{name}: uses the default Compute Engine service account, give it its own");
        problems++;
    }

    bool storageEvent = trigger.EventFilters.Any(f => f.Attribute == "type" && f.Value.StartsWith("google.cloud.storage."));
    bool namesBucket = trigger.EventFilters.Any(f => f.Attribute == "bucket");
    if (storageEvent && !namesBucket)
    {
        Console.WriteLine($"{name}: storage trigger without a bucket filter");
        problems++;
    }

    foreach (var condition in trigger.Conditions)
    {
        if (condition.Value.Code != Google.Rpc.Code.Ok)
        {
            Console.WriteLine($"{name}: {condition.Key} reports {condition.Value.Code}: {condition.Value.Message}");
            problems++;
        }
    }
}

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

Typical destinations include Cloud Run and Cloud Run functions, and a common source is Cloud Storage. Dashboards and alerts for the transport subscription are in Cloud Monitoring.