Cloud Functions should not have ingress settings set to allow all
Cloudfunction functions ingress settings should not be set to allow all. The control reports an alarm when `ingress_settings` is `ALLOW_ALL`. Checkov CKV_GCP_124 flags overly permissive Ingress settings on Cloud Functions.
It is recommended that Cloudfunction functions ingress settings should not be set to allow all as it allow all inbound requests to the function.
What this control checks
Fails when Cloud Function ingress_settings is ALLOW_ALL; passes otherwise.
Common pitfalls
Only two ingress values pass the check
The expected values are ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY.
Second generation functions use a nested argument
For google_cloudfunctions2_function, the inspected key is service_config/[0]/ingress_settings/[0].
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.cloudfunction_function_no_ingress_settings_allow_all.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_124.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudfunction_function_no_ingress_settings_allow_all - Checkov Check:
CKV_GCP_124 - Powerpipe Control:
gcp_compliance.control.cloudfunction_function_no_ingress_settings_allow_all
Last reviewed: 2026-10-09