Description

Ensure that Cloud Run functions (Cloud Functions) are configured with a Serverless VPC Access connector so that outbound traffic to internal resources is routed through a Virtual Private Cloud (VPC) network rather than over the public internet. This allows functions to reach private resources such as Cloud SQL instances, Memorystore, or internal services, and allows egress traffic to be controlled with VPC firewall rules and routing.

Rationale

By default, a Cloud Function's outbound traffic goes over the public internet and cannot reach resources that only have internal (private) IP addresses, nor can it be filtered by the organization's VPC firewall rules. Attaching a function to a VPC network via a Serverless VPC Access connector brings its egress traffic under the same network controls, logging, and segmentation as other workloads in the VPC, and allows the traffic to optionally be routed through Cloud NAT for controlled, auditable internet egress. Without this connectivity, sensitive backend systems may be exposed on public IPs solely so that Cloud Functions can reach them, increasing the attack surface.

Impact

  • Allows Cloud Functions to reach private (internal IP) resources without exposing them publicly

  • Brings function egress traffic under existing VPC firewall rules and routing policies

  • Enables consistent network segmentation between serverless and other workloads

  • Supports controlled, auditable egress via Cloud NAT when combined with appropriate routing settings

Default Value

By default, a newly created Cloud Function is not connected to any VPC network and communicates over the public internet path only.

Pre-Requisites

  • An existing VPC network and subnet in the same region as the function

  • Serverless VPC Access API (vpcaccess.googleapis.com) enabled

  • IAM permissions to create VPC Access connectors and edit Cloud Functions (e.g., Cloud Functions Admin, Compute Network Admin)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Run functions (Cloud Functions).

  4. Select the function to review.

  5. Open the Networking tab in the function's details.

  6. Verify that a VPC connector (or Direct VPC egress) is configured under Egress settings.

  7. Verify the egress setting (Route only requests to private IPs, or Route all traffic) matches the intended network policy.

  8. If no VPC connector or Direct VPC egress is configured, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to VPC network > Serverless VPC Access and create a connector in the desired region and subnet (or plan to use Direct VPC egress).

  4. Navigate to Cloud Run functions (Cloud Functions) and select the function to update.

  5. Select Edit, then open the Networking / Runtime, build, connections and security settings section.

  6. Under Egress settings, select the VPC connector created above, or configure Direct VPC egress with the target network and subnet.

  7. Choose the appropriate egress control (route only private IP traffic, or route all traffic through the VPC).

  8. Click Deploy to apply the change.

  9. Verify the function can reach the intended internal resources and that connectivity behaves as expected.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Run functions (Cloud Functions) and select the affected function.

  4. Select Edit, then open the Networking section.

  5. Remove the VPC connector or Direct VPC egress configuration, or set Egress settings back to its previous value.

  6. Click Deploy to apply the change.

Reference