Cloud Functions Egress Is not Restricted to Private IP Ranges Affecting Cloud Functions service in Google


    Severity Framework
    Snyk CCSS
    Rule category
    Network / Network

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-CC-00809
  • credit Snyk Research Team


Enforcing egress settings to 'PRIVATE_RANGES_ONLY' mitigates the risk of data exfiltration and unauthorized external service interactions by ensuring that Google Cloud Functions can only communicate with resources in private IP address ranges. This setting prevents functions from sending traffic to public addresses, which could expose sensitive data or allow for potential exploitation of the function's network connections.

How to fix?

Set the vpc_connector_egress_settings attribute to PRIVATE_RANGES_ONLY in google_cloudfunctions_function resource.

Set the service_config[_].vpc_connector_egress_settings attribute to PRIVATE_RANGES_ONLY in google_cloudfunctions2_function resource.

Example Configuration

resource "google_cloudfunctions_function" "allow" {
  name        = "function-test1"
  description = "My function"
  runtime     = "nodejs20"
  available_memory_mb   = 128
  source_archive_bucket =
  source_archive_object =
  trigger_http          = true
  entry_point           = "helloWorld"
  depends_on            = [ google_vpc_access_connector.vpc_connector ]
  vpc_connector         = "projects/zelarsoft-snyk/locations/us-central1/connectors/vpc-con"
  vpc_connector_egress_settings = "PRIVATE_RANGES_ONLY"
resource "google_cloudfunctions2_function" "allow2" {
  name = "gen2function-test"
  location = "us-central1"
  description = "a new function"
  depends_on            = [ google_vpc_access_connector.vpc_connector ]

  build_config {
    runtime = "nodejs20"
    entry_point = "helloHttp"
    source {
      storage_source {
        bucket =
        object =

  service_config {
    max_instance_count  = 1
    available_memory    = "256M"
    vpc_connector         = "projects/zelarsoft-snyk/locations/us-central1/connectors/vpc-con"
    vpc_connector_egress_settings = "PRIVATE_RANGES_ONLY"