Google Cloud Compliance ControlsGoogle Cloud Run functions
Cloud Functions should have Deployment Manager permissions restricted
This control ensures that Cloudfunction function does not allow deployments manager permissions. The powerpipe check cloudfunction_function_no_deployments_manager_permission reads the `gcp_cloudfunctions_function` and `gcp_iam_role` tables.
What this control checks
Cloudfunction function must not allow deployments manager permissions.
Related controls
- Compute Engine instances should have service account impersonation permissions restricted
- Service accounts should use only GCP-managed service account keys
- Projects should have log metric filters and alerts configured for Custom Role changes
- Service accounts should be used within the configured maximum unused period
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudfunction_function_no_deployments_manager_permission - Powerpipe Control:
gcp_compliance.control.cloudfunction_function_no_deployments_manager_permission
Last reviewed: 2026-10-09