Your app scales beautifully in the cloud, until you need one part to run in a fully managed environment and another to live next to some sensitive data in a private VPC. That’s when teams start asking how Cloud Run EC2 Instances can work together without losing their minds to identity wiring or network plumbing.
Cloud Run is Google Cloud’s serverless container platform. It spins up workloads on request, charges by the millisecond, and terminates when idle. EC2 Instances, on the other hand, are AWS’s bread-and-butter virtual machines: customizable, persistent, and deeply integrated into everything from EBS to IAM roles. Each does its job well, but real-world systems don’t fit tidy vendor lines. A modern architecture often wants the elasticity of Cloud Run with the proximity, control, or data gravity of EC2.
The trick is understanding the flow of identity and access between them. Cloud Run needs scoped IAM credentials to call AWS APIs, while EC2 might need to reach back into Cloud Run endpoints with verified tokens. The goal is to create a bridge where each side trusts the other through short-lived, auditable credentials. Nothing long-term, nothing leaked in environment variables.
In practice, you link an identity provider like Okta or AWS IAM’s OIDC federation. Cloud Run uses a workload identity that exchanges tokens with AWS via IAM Roles for Web Identity. EC2 then accesses Cloud Run through signed requests verified by Google’s IAP or service identity. The entire pipe works on standard OIDC, which keeps auditors calm and engineers moving fast.
When something breaks, look first at assumptions about trust domains. Misaligned audience claims or stale tokens cause most errors here. Keep your token lifetimes short, rotate keys automatically, and map each service to the least privilege it requires. The less humans touch, the fewer credentials you’ll be chasing later.