gcp-gcf-invoke-run
2nd-gen invoke: run.routes.invoke / roles/run.invoker on the backing Cloud Run service invokes the function.
match (effective permission)
{
"action": "run.routes.invoke",
"resource_type": "google.cloud.run.Service"
}
where
?function.environment == GEN_2 (2nd-gen function)
the run.Service in scope is the backing service of ?function (serviceConfig.service)
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <function in scope> |
| permissions | run.routes.invoke |
| conditions | service_state iam_permission |
Narrative
{principal.name} can invoke 2nd-gen {function.name} via run.routes.invoke on its backing Cloud Run service.
Raw rule rules/derived/gcp/gcf.yaml
id: gcp-gcf-invoke-run
emits: CanInvoke
description: '2nd-gen invoke: run.routes.invoke / roles/run.invoker on the backing Cloud Run service invokes
the function.'
match_effective_permission:
action: run.routes.invoke
resource_type: google.cloud.run.Service
where:
- ?function.environment == GEN_2 (2nd-gen function)
- the run.Service in scope is the backing service of ?function (serviceConfig.service)
emit:
source_type: Identity
source: <principal>
target: <function in scope>
permissions:
- run.routes.invoke
conditions:
- service_state
- iam_permission
false_positive_note: 2nd-gen ONLY. Invocation of a 2nd-gen Cloud Function is authorized by run.routes.invoke
(roles/run.invoker) on the backing Cloud Run service, NOT by cloudfunctions.functions.invoke. This
is the invoke path that completes CanExecuteAs for 2nd-gen functions.
narrative: '{principal.name} can invoke 2nd-gen {function.name} via run.routes.invoke on its backing
Cloud Run service.'