Cloud Functions should have a VPC connector enabled
It is recommended that Cloudfunction functions VPC connector is enabled. Prowler checks that Cloud Functions are attached to a Serverless VPC Access connector so egress traffic is routed through a private VPC network.
Without a VPC connector, Cloud Functions cannot privately reach internal resources such as Cloud SQL, Memorystore, or GKE, forcing those services to be exposed over public IPs. This expands the attack surface, weakens confidentiality of internal traffic, and breaks network segmentation controls required by most security frameworks.
What this control checks
Fails when a function's vpc_connector is null or empty; passes when a VPC connector is set.
Common pitfalls
Scope each connector to least privilege subnets
Scope each connector to least privilege subnets so functions cannot reach unintended endpoints.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudfunction_function_inside_vpc (prowler gcp --checks cloudfunction_function_inside_vpc); PowerPipe control gcp_compliance.control.cloudfunction_function_vpc_connector_enabled.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudfunction_function_vpc_connector_enabled - Powerpipe Control:
gcp_compliance.control.cloudfunction_function_vpc_connector_enabled - Prowler Check:
cloudfunction_function_inside_vpc
Last reviewed: 2026-10-09