gcp-gcf-vpc-network-reach
A function with a VPC connector can reach private resources; code running in it moves laterally into the VPC.
match (record)
{
"field": "serviceConfig.vpcConnector",
"resource_type": "google.cloudfunctions.Function"
}
where
serviceConfig.vpcConnector (1st gen: vpcConnector) is set on ?function
emit
| source type | Compute |
|---|---|
| source | <function> |
| target | <private network / resources reachable via the connector> |
| conditions | network_reachability |
Narrative
{function.name} can reach private resources over its VPC connector; code running in it moves laterally into the VPC.
Raw rule rules/derived/gcp/gcf.yaml
id: gcp-gcf-vpc-network-reach
emits: PrivateReachability
description: A function with a VPC connector can reach private resources; code running in it moves laterally
into the VPC.
match_record:
resource_type: google.cloudfunctions.Function
field: serviceConfig.vpcConnector
where:
- 'serviceConfig.vpcConnector (1st gen: vpcConnector) is set on ?function'
emit:
source_type: Compute
source: <function>
target: <private network / resources reachable via the connector>
permissions: []
conditions:
- network_reachability
false_positive_note: Only meaningful once an attacker has code/exec in the function (CanExecuteAs/CanModifyCode
+ invoke). Egress is further scoped by vpcConnectorEgressSettings (PRIVATE_RANGES_ONLY vs ALL_TRAFFIC)
and by firewall rules on the target network.
narrative: '{function.name} can reach private resources over its VPC connector; code running in it moves
laterally into the VPC.'