Description

Ensure that Cloud Run functions (Cloud Functions) do not grant the allUsers or allAuthenticatedUsers principal the Cloud Functions Invoker (or Cloud Run Invoker) IAM role, which would allow the function to be triggered by anyone on the internet without authentication.

Rationale

A publicly invocable function can be triggered by any unauthenticated party, which may allow attackers to abuse compute resources, trigger unintended business logic, exfiltrate data returned by the function, or drive up billing through repeated invocations. Unless a function is explicitly intended to serve as a public HTTP endpoint (for example, a public webhook), invocation should be restricted to specific authenticated identities or internal callers only.

Impact

  • Prevents unauthenticated, anonymous invocation of sensitive or internal functions

  • Reduces the risk of resource exhaustion, denial-of-service style abuse, and unexpected billing

  • Ensures only authorized identities or services can trigger function execution

  • Supports least-privilege access control for serverless workloads

Default Value

By default, HTTP-triggered Cloud Functions deployed via the console with default settings may allow unauthenticated invocations, depending on the deployment options and organization policy selected at creation time; this must be explicitly reviewed and restricted for each function.

Pre-Requisites

  • IAM permissions to view and edit IAM policies on Cloud Functions (e.g., Cloud Functions Admin, IAM Admin)

  • A documented list of functions that are intentionally public versus internal-only

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Run functions (Cloud Functions).

  4. Select the function to review, then open the Permissions tab.

  5. Review the list of principals granted the Cloud Functions Invoker (or Cloud Run Invoker) role.

  6. Verify that allUsers and allAuthenticatedUsers are not present unless the function is intentionally designed and approved to be a public endpoint.

  7. If either principal is present on a function that should not be public, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Run functions (Cloud Functions) and select the function to update.

  4. Open the Permissions tab.

  5. Locate the allUsers or allAuthenticatedUsers entry with the Invoker role and select Remove access.

  6. Confirm the removal.

  7. Grant the Invoker role only to the specific service accounts, users, or groups that legitimately need to call the function.

  8. Verify authorized callers can still invoke the function successfully and unauthenticated calls are now rejected.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Run functions (Cloud Functions) and select the affected function.

  4. Open the Permissions tab and select Add principal.

  5. Add allUsers (or allAuthenticatedUsers) back with the Cloud Functions Invoker / Cloud Run Invoker role.

  6. Save the change.

Reference