Google Cloud Compliance ControlsGoogle Cloud Run functions
Cloud Functions should have public access restrictions configured
This control ensures that Cloudfunction function is not publicly accessible. Cloud Functions deny invocation to `allUsers` and `allAuthenticatedUsers`, so only explicitly authorized identities or services can trigger them.
What this control checks
Function IAM bindings must not include allUsers or allAuthenticatedUsers.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudfunction_function_restrict_public_access - Powerpipe Control:
gcp_compliance.control.cloudfunction_function_restrict_public_access - Prowler Check:
cloudfunction_function_not_publicly_accessible
Last reviewed: 2026-10-09