1. Open the Google Cloud Console and select the project that contains the Cloud Function you want to remediate.
2. In the navigation menu, go to “Cloud Functions” under the “Compute” section.
3. Select the Cloud Function that you want to remediate.
4. Click on the “Permissions” tab in the Cloud Function details page.
5. Under the “Ingress settings” section, click on the “Allow internal traffic only” radio button.
6. Click on the “Save” button to apply the changes.
7. Verify that the Cloud Function is no longer publicly accessible by attempting to access the function’s endpoint URL from a browser or using a tool like curl. You should receive an error message stating that access is denied.

​

1. Open the Cloud Functions page in the GCP console.
2. Find the function that you want to remediate and click on it.
3. In the function details page, click on the “Permissions” tab.
4. Under the “Invokers” section, click on “Add Member”.
5. In the “Add members” dialog box, enter the email address of the service account or user that needs to access the function.
6. Select the appropriate role for the user/service account.
7. Click on “Save” to add the user/service account to the function’s invokers list.
8. Repeat steps 4-7 for all the users/service accounts that need access to the function.

1. Open the Cloud Functions Console in your GCP project.
2. Select the function that you want to remediate and click on the “Edit” button.
3. In the “Edit Function” screen, scroll down to the “Networking” section and click on “Add VPC connector”.
4. In the “Add VPC connector” screen, select the VPC network that you want to use and click on “Save”.
5. Once the VPC connector is added, scroll down to the “Ingress Settings” section and select “Allow internal traffic only”.
6. Click on “Save” to save the changes.

from google.cloud import functions_v1

# Replace with your project ID
project_id = "your-project-id"

# Replace with the name of the Cloud Function that you want to remediate
function_name = "your-function-name"

# Initialize the Cloud Functions API client
client = functions_v1.CloudFunctionsServiceClient()

# Get the current configuration of the Cloud Function
function = client.get_function(name=f"projects/{project_id}/locations/us-central1/functions/{function_name}")

# Add the VPC connector to the Cloud Function
function.vpc_connector = "projects/{project_id}/locations/us-central1/connectors/{vpc-connector-name}"

# Set the ingress settings to "Allow internal traffic only"
function.ingress_settings = functions_v1.CloudFunction.IngressSettings.ALLOW_INTERNAL_ONLY

# Update the configuration of the Cloud Function
client.update_function(function=function, update_mask={"paths": ["vpc_connector", "ingress_settings"]})