Cloud Functions should have Deployment Manager permissions restricted
This control ensures that Cloudfunction function does not allow deployments manager permissions. The powerpipe check cloudfunction_function_no_deployments_manager_permission reads the `gcp_cloudfunctions_function` and `gcp_iam_role` tables.
What this control checks
Cloudfunction function must not allow deployments manager permissions.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.cloudfunction_function_no_deployments_manager_permission.
Related controls
- Compute Engine instances should have service account impersonation permissions restricted
- Service accounts should use only GCP-managed service account keys
- Projects should have log metric filters and alerts configured for Custom Role changes
- Service accounts should be used within the configured maximum unused period
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudfunction_function_no_deployments_manager_permission - Powerpipe Control:
gcp_compliance.control.cloudfunction_function_no_deployments_manager_permission
Last reviewed: 2026-10-09