Cloud Functions Endpoint Should Not Be Publicly Accessible

Using Console

Sure, here are the step-by-step instructions to remediate the “Cloud Functions Endpoint Should Not Be Publicly Accessible” misconfiguration for GCP using the GCP console:

Open the Google Cloud Console and select the project that contains the Cloud Function you want to remediate.
In the navigation menu, go to “Cloud Functions” under the “Compute” section.
Select the Cloud Function that you want to remediate.
Click on the “Permissions” tab in the Cloud Function details page.
Under the “Ingress settings” section, click on the “Allow internal traffic only” radio button.
Click on the “Save” button to apply the changes.
Verify that the Cloud Function is no longer publicly accessible by attempting to access the function’s endpoint URL from a browser or using a tool like curl. You should receive an error message stating that access is denied.

By following these steps, you have successfully remediated the “Cloud Functions Endpoint Should Not Be Publicly Accessible” misconfiguration for GCP using the GCP console.

Using CLI

To remediate the issue of Cloud Functions Endpoint being publicly accessible in GCP, you can follow the below steps using GCP CLI:

Open the Cloud Functions page in the GCP console.
Find the function that you want to remediate and click on it.
In the function details page, click on the “Permissions” tab.
Under the “Invokers” section, click on “Add Member”.
In the “Add members” dialog box, enter the email address of the service account or user that needs to access the function.
Select the appropriate role for the user/service account.
Click on “Save” to add the user/service account to the function’s invokers list.
Repeat steps 4-7 for all the users/service accounts that need access to the function.

By following the above steps, you can restrict the access to your Cloud Functions Endpoint and ensure that it is not publicly accessible.

Using Python

To remediate the issue of Cloud Functions Endpoint being publicly accessible on GCP using Python, you can follow the below steps:

Open the Cloud Functions Console in your GCP project.
Select the function that you want to remediate and click on the “Edit” button.
In the “Edit Function” screen, scroll down to the “Networking” section and click on “Add VPC connector”.
In the “Add VPC connector” screen, select the VPC network that you want to use and click on “Save”.
Once the VPC connector is added, scroll down to the “Ingress Settings” section and select “Allow internal traffic only”.
Click on “Save” to save the changes.

Now, your Cloud Functions Endpoint will not be publicly accessible and can only be accessed internally within the VPC network that you have specified.To automate this process using Python, you can use the GCP Python client library. Here’s an example code snippet:

from google.cloud import functions_v1

# Replace with your project ID
project_id = "your-project-id"

# Replace with the name of the Cloud Function that you want to remediate
function_name = "your-function-name"

# Initialize the Cloud Functions API client
client = functions_v1.CloudFunctionsServiceClient()

# Get the current configuration of the Cloud Function
function = client.get_function(name=f"projects/{project_id}/locations/us-central1/functions/{function_name}")

# Add the VPC connector to the Cloud Function
function.vpc_connector = "projects/{project_id}/locations/us-central1/connectors/{vpc-connector-name}"

# Set the ingress settings to "Allow internal traffic only"
function.ingress_settings = functions_v1.CloudFunction.IngressSettings.ALLOW_INTERNAL_ONLY

# Update the configuration of the Cloud Function
client.update_function(function=function, update_mask={"paths": ["vpc_connector", "ingress_settings"]})

Make sure to replace the project_id, function_name, and vpc-connector-name variables with the appropriate values for your environment.

Using Terraform

# Cloud Function (Gen 1) definition – replace placeholders with your values
resource "google_cloudfunctions_function" "my_function" {
  name        = "FUNCTION_NAME"
  description = "FUNCTION_DESCRIPTION"
  runtime     = "RUNTIME" # e.g. "python39"
  region      = "FUNCTION_REGION"

  entry_point = "ENTRY_POINT"
  source_archive_bucket = "SOURCE_BUCKET_NAME"
  source_archive_object = "SOURCE_OBJECT_NAME"
  trigger_http          = true

  # ...other required arguments (e.g. available_memory_mb, timeout, etc.)
}

# IAM: REMOVE any bindings that grant roles/cloudfunctions.invoker to allUsers/allAuthenticatedUsers.
# Do NOT define these in Terraform if you want the function to be private.
# Example of what you MUST NOT have:
#
# resource "google_cloudfunctions_function_iam_member" "public_invoker_all_users" {
#   project        = google_cloudfunctions_function.my_function.project
#   region         = google_cloudfunctions_function.my_function.region
#   cloud_function = google_cloudfunctions_function.my_function.name
#
#   role   = "roles/cloudfunctions.invoker"
#   member = "allUsers"  # or "allAuthenticatedUsers" – both make it publicly accessible
# }

# Instead, grant invoker only to specific identities, such as a service account
resource "google_cloudfunctions_function_iam_member" "sa_invoker" {
  project        = google_cloudfunctions_function.my_function.project
  region         = google_cloudfunctions_function.my_function.region
  cloud_function = google_cloudfunctions_function.my_function.name

  role   = "roles/cloudfunctions.invoker"
  member = "serviceAccount:SERVICE_ACCOUNT_EMAIL" # e.g. "my-sa@PROJECT_ID.iam.gserviceaccount.com"
}

This change does not force replacement of the Cloud Function itself; it only updates IAM bindings. After applying, terraform plan should show removal (or absence) of any google_cloudfunctions_function_iam_* bindings with member = "allUsers" or "allAuthenticatedUsers" for roles/cloudfunctions.invoker, and creation/update of bindings that reference only specific principals.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Cloud Functions Endpoint Should Not Be Publicly Accessible

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: