Homepage
About Snyk

Cloud Functions Egress Is not Restricted to Private IP Ranges Affecting Cloud Functions service in Google

0.0
high
0
10
    Severity Framework Snyk CCSS
    Rule category Network / Network

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
  • Snyk ID SNYK-CC-00809
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Enforcing egress settings to 'PRIVATE_RANGES_ONLY' mitigates the risk of data exfiltration and unauthorized external service interactions by ensuring that Google Cloud Functions can only communicate with resources in private IP address ranges. This setting prevents functions from sending traffic to public addresses, which could expose sensitive data or allow for potential exploitation of the function's network connections.

How to fix?

Set the vpc_connector_egress_settings attribute to PRIVATE_RANGES_ONLY in google_cloudfunctions_function resource.

Set the service_config[_].vpc_connector_egress_settings attribute to PRIVATE_RANGES_ONLY in google_cloudfunctions2_function resource.

Example Configuration


resource "google_cloudfunctions_function" "allow" {
  name        = "function-test1"
  description = "My function"
  runtime     = "nodejs20"
  available_memory_mb   = 128
  source_archive_bucket = google_storage_bucket.bucket.name
  source_archive_object = google_storage_bucket_object.object.name
  trigger_http          = true
  entry_point           = "helloWorld"
  depends_on            = [ google_vpc_access_connector.vpc_connector ]
  vpc_connector         = "projects/zelarsoft-snyk/locations/us-central1/connectors/vpc-con"
  vpc_connector_egress_settings = "PRIVATE_RANGES_ONLY"
  }
  
resource "google_cloudfunctions2_function" "allow2" {
  name = "gen2function-test"
  location = "us-central1"
  description = "a new function"
  depends_on            = [ google_vpc_access_connector.vpc_connector ]

  build_config {
    runtime = "nodejs20"
    entry_point = "helloHttp"
    source {
      storage_source {
        bucket = google_storage_bucket.bucket2.name
        object = google_storage_bucket_object.object2.name
      }
    }
  }

  service_config {
    max_instance_count  = 1
    available_memory    = "256M"
    vpc_connector         = "projects/zelarsoft-snyk/locations/us-central1/connectors/vpc-con"
    vpc_connector_egress_settings = "PRIVATE_RANGES_ONLY"
  }
}