gcp-gcf-invoke-run

2nd-gen invoke: run.routes.invoke / roles/run.invoker on the backing Cloud Run service invokes the function.

derived gcp emits CanInvoke

match (effective permission)

{ "action": "run.routes.invoke", "resource_type": "google.cloud.run.Service" }

where

?function.environment == GEN_2 (2nd-gen function) the run.Service in scope is the backing service of ?function (serviceConfig.service)

emit

source typeIdentity
source<principal>
target<function in scope>
permissionsrun.routes.invoke
conditionsservice_state iam_permission

Narrative

{principal.name} can invoke 2nd-gen {function.name} via run.routes.invoke on its backing Cloud Run service.

Raw rule rules/derived/gcp/gcf.yaml

id: gcp-gcf-invoke-run
emits: CanInvoke
description: '2nd-gen invoke: run.routes.invoke / roles/run.invoker on the backing Cloud Run service invokes
  the function.'
match_effective_permission:
  action: run.routes.invoke
  resource_type: google.cloud.run.Service
where:
- ?function.environment == GEN_2 (2nd-gen function)
- the run.Service in scope is the backing service of ?function (serviceConfig.service)
emit:
  source_type: Identity
  source: <principal>
  target: <function in scope>
  permissions:
  - run.routes.invoke
  conditions:
  - service_state
  - iam_permission
  false_positive_note: 2nd-gen ONLY. Invocation of a 2nd-gen Cloud Function is authorized by run.routes.invoke
    (roles/run.invoker) on the backing Cloud Run service, NOT by cloudfunctions.functions.invoke. This
    is the invoke path that completes CanExecuteAs for 2nd-gen functions.
  narrative: '{principal.name} can invoke 2nd-gen {function.name} via run.routes.invoke on its backing
    Cloud Run service.'
move · open · esc close