Securing Google Cloud Functions

You can secure Cloud Functions with identity-based or network-based access control.

With identity-based access control, access is granted on a per-function basis via Cloud IAM. This allows for control over two sets of actions:

  • Developer operations: creating, updating, and deleting functions, as well as managing access to functions.

  • Function invocation: causing a function to be executed.

Functions also have their own identity, which is used when calling Google Cloud services or other functions. The permissions associated with this identity can be restricted in order to give functions least privilege access.

With network-based access control, access is controlled by specifying network settings for individual functions. This allows for more control over the network ingress and egress to and from your functions.