gcp-gcf-public-invoke-run
2nd-gen public invoke is governed by roles/run.invoker on the BACKING Cloud Run service's IAM policy, not the function resource.
match (record)
{
"field": "iamPolicy.bindings",
"resource_type": "google.cloud.run.Service"
}
where
?function.environment == GEN_2 (2nd-gen function)
the run.Service in scope is the backing service of ?function (serviceConfig.service)
a binding on the BACKING Cloud Run service's iamPolicy grants roles/run.invoker to allUsers or allAuthenticatedUsers
ingressSettings is not ALLOW_INTERNAL_ONLY
emit
| target type | AnonymousIdentity |
|---|---|
| source | <function> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
Narrative
{function.name} (2nd gen) is invocable from the internet (allUsers/allAuthenticatedUsers has roles/run.invoker on its backing Cloud Run service, ingress not internal-only).
Raw rule rules/derived/gcp/gcf.yaml
id: gcp-gcf-public-invoke-run
emits: ExposedToInternet
description: 2nd-gen public invoke is governed by roles/run.invoker on the BACKING Cloud Run service's
IAM policy, not the function resource.
match_record:
resource_type: google.cloud.run.Service
field: iamPolicy.bindings
where:
- ?function.environment == GEN_2 (2nd-gen function)
- the run.Service in scope is the backing service of ?function (serviceConfig.service)
- a binding on the BACKING Cloud Run service's iamPolicy grants roles/run.invoker to allUsers or allAuthenticatedUsers
- ingressSettings is not ALLOW_INTERNAL_ONLY
emit:
target_type: AnonymousIdentity
source: <function>
target: <AnonymousIdentity>
permissions: []
conditions:
- network_reachability
false_positive_note: 2nd-gen ONLY. The invoker allow-policy that governs public HTTP access lives on
the backing Cloud Run SERVICE, not the cloudfunctions Function resource. Checking roles/run.invoker
in the function's own iamPolicy misses the real binding (false negative). allAuthenticatedUsers =
any Google account, still broadly abusable.
narrative: '{function.name} (2nd gen) is invocable from the internet (allUsers/allAuthenticatedUsers
has roles/run.invoker on its backing Cloud Run service, ingress not internal-only).'