Cloud Functions should have public access restrictions configured
This control ensures that Cloudfunction function is not publicly accessible. Cloud Functions deny invocation to `allUsers` and `allAuthenticatedUsers`, so only explicitly authorized identities or services can trigger them.
Publicly invocable Cloud Functions expose business logic to the internet and let any caller trigger execution. This enables unauthorized data access when the function returns sensitive output, code execution in shared environments, and denial-of-wallet attacks driven by uncontrolled invocation costs.
What this control checks
Function IAM bindings must not include allUsers or allAuthenticatedUsers.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudfunction_function_not_publicly_accessible (prowler gcp --checks cloudfunction_function_not_publicly_accessible); PowerPipe control gcp_compliance.control.cloudfunction_function_restrict_public_access.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudfunction_function_restrict_public_access - Powerpipe Control:
gcp_compliance.control.cloudfunction_function_restrict_public_access - Prowler Check:
cloudfunction_function_not_publicly_accessible
Last reviewed: 2026-10-09