Deny direct access to Google Cloud Run/Functions and allow via Loadbalancer

Question

I would like to deny direct access to Cloudfunctions with their default URL as:

https://europe-west1-helloworld.cloudfunctions.net/function-name

And only allow access via GCP Load balancer

I would expect creating some kind of service-account which would be used by Loadbalancer when accessing the Functions/Run containers, but it is not possible to assign any.

My current state is:

When I assign allUsers in Cloud Functions's permissions, I can access it both directly and via LB.
When I remove the allUsers, I cannot access them neither directly, neither via LB.

guillaume blaquiere · Accepted Answer · 2024-10-07 15:22:00Z

1

You can achieve this by deploying, or editing your cloud functions and configure the "connection" section. Here, set the ingress option to accept only connection coming from internal VPC network (and shared VPC and VPC SC) and Load Balancer.

See picture here.

answered Oct 7, 2024 at 15:22

guillaume blaquiere

76.6k3 gold badges65 silver badges102 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Vojtěch Over a year ago

In fact, this is not so easy 😇 As described in cloud.google.com/run/docs/securing/… - there are three types of solutions, which are mentioned only very briefly and I will probably make a new SO question for that: stackoverflow.com/questions/79069934/…

guillaume blaquiere Over a year ago

But not so difficult with the network flow in mind. I dropped a comment

Collectives™ on Stack Overflow

Deny direct access to Google Cloud Run/Functions and allow via Loadbalancer

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related