​
Event Information

  • The google.cloud.functions.v1.CloudFunctionsService.CallFunction event in GCP for CloudFunctions refers to the event generated when a function is called or invoked.
  • This event indicates that a specific Cloud Function has been triggered and is about to be executed.
  • It provides information about the function name, the event payload, and any associated metadata, allowing you to track and monitor the execution of your Cloud Functions.

​
Examples

  1. Unauthorized access: If security is impacted with google.cloud.functions.v1.CloudFunctionsService.CallFunction in GCP for CloudFunctions, it could indicate that unauthorized users or entities are able to invoke or execute functions. This could potentially lead to unauthorized access to sensitive data or resources within the cloud environment.

  2. Function code injection: Another security impact could be the ability for malicious actors to inject arbitrary code into the function being called. This could result in the execution of unauthorized or malicious code, potentially leading to data breaches, system compromise, or unauthorized actions within the cloud environment.

  3. Denial of Service (DoS) attacks: The CallFunction API could be exploited to launch DoS attacks by repeatedly invoking functions with excessive or malicious input. This could overload the function execution environment, causing service disruptions and impacting the availability of other functions or resources within the cloud environment.

​
Remediation

​
Using Console

  1. Enable VPC Service Controls for Cloud Functions:

    • Go to the GCP Console and navigate to the VPC Service Controls page.
    • Create a new service perimeter or edit an existing one.
    • Add the Cloud Functions API to the allowed APIs list.
    • Configure the access levels and resources as per your requirements.
    • Save the changes and apply the service perimeter.

  2. Implement IAM Roles and Permissions:

    • Go to the IAM & Admin section in the GCP Console.
    • Identify the Cloud Functions service account that needs to be updated.
    • Assign the appropriate IAM roles to the service account based on the principle of least privilege.
    • For example, you can assign the Cloud Functions Developer role for basic development tasks or the Cloud Functions Admin role for more advanced management tasks.
    • Save the changes to update the IAM roles and permissions.

  3. Enable Cloud Audit Logging:

    • Go to the GCP Console and navigate to the Cloud Functions page.
    • Select the specific Cloud Function that needs to have audit logging enabled.
    • Click on the “Edit” button to modify the function’s settings.
    • Scroll down to the “Advanced options” section and enable the “Enable audit logging” option.
    • Choose the desired log sink destination, such as Cloud Storage or BigQuery.
    • Save the changes to enable audit logging for the Cloud Function.

Note: These steps provide a high-level overview of the remediation process. It is recommended to refer to the official GCP documentation for detailed instructions and best practices.

​
Using CLI

  1. Enable VPC Service Controls for Cloud Functions:
  • Use the following command to enable VPC Service Controls for Cloud Functions: 
    gcloud beta services vpc-peerings connect \
--service=servicenetworking.googleapis.com \
--network=projects/[PROJECT_ID]/global/networks/[NETWORK_NAME] \
--ranges=[IP_RANGE]
  1. Implement IAM Roles and Permissions:
  • Use the following command to grant the necessary IAM roles and permissions to the Cloud Functions service account: 
    gcloud projects add-iam-policy-binding [PROJECT_ID] \
--member=serviceAccount:[SERVICE_ACCOUNT_EMAIL] \
--role=[IAM_ROLE]
  1. Enable Cloud Audit Logging for Cloud Functions:
  • Use the following command to enable Cloud Audit Logging for Cloud Functions: 
    gcloud logging sinks create [SINK_NAME] \
storage.googleapis.com/projects/[PROJECT_ID]/buckets/[BUCKET_NAME] \
--log-filter='resource.type="cloud_function"'

​
Using Python

To remediate the issues mentioned in the previous response for GCP Cloud Functions using Python, you can follow these steps:

  1. Enable VPC Service Controls:

    • Use the google-cloud-vpc-access library to create a connector between your VPC network and the Cloud Function.
    • Modify your Cloud Function code to use the connector to access resources within the VPC network.

  2. Implement Identity and Access Management (IAM) Roles:

    • Use the google-cloud-iam library to programmatically manage IAM roles for your Cloud Functions.
    • Create a service account with the necessary permissions and assign it to the Cloud Function.

  3. Implement Cloud Audit Logging:

    • Use the google-cloud-logging library to enable Cloud Audit Logging for your Cloud Functions.
    • Modify your Cloud Function code to log relevant events using the library.

Please note that the provided steps are high-level guidelines, and you may need to adapt them based on your specific requirements and the structure of your code.