By default, all functions are private, which means that only authenticated users who have been granted the proper permissions can create, update, delete, and invoke functions. Access control is granted on a per-function basis via Cloud IAM.
This allows for access control over two sets of actions:
Developer operations: creating, updating, and deleting functions, as well as managing access to functions.
Function invocation: administrators granting developers, other services, and end-users permission to invoke a function.
Functions also have their own identity, which is used when calling Google Cloud services or other functions. The permissions associated with this identity can be restricted in order to give functions least privilege access.
Securing Google Cloud Functions
-
Authenticating to functions
Learn how to authenticate developers, functions, and end-users to your functions.
-
Managing access to functions
Learn how to manage developer, function, and end-user access to your functions.
-
Understanding function identity
Learn about what identity your function runs as and how to configure it.
