Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add warning about private-by-default cloud functions #2321

Merged
merged 3 commits into from
Sep 17, 2019
Merged

Add warning about private-by-default cloud functions #2321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
863cc90
add warning about private-by-default for cloud functions
emilymye Sep 16, 2019
7c1ca3e
doc changes
emilymye Sep 17, 2019
fb22858
Update tracked submodules -> HEAD on Tue Sep 17 23:17:27 UTC 2019
modular-magician Sep 17, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build/terraform
Open in desktop
Submodule terraform updated from ecda9f to e03659
2 changes: 1 addition & 1 deletion build/terraform-beta
Open in desktop
Submodule terraform-beta updated from a1d05c to c10b86
55 changes: 54 additions & 1 deletion third_party/terraform/website/docs/r/cloudfunctions_function.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,15 @@ Creates a new Cloud Function. For more information see
and
[API](https://cloud.google.com/functions/docs/apis).

~> **Warning:** As of November 1, 2019, newly created Functions are
private-by-default and will require [appropriate IAM permissions](https://cloud.google.com/functions/docs/reference/iam/roles)
to be invoked. See below examples for how to set up the appropriate permissions,
or view the [Cloud Functions IAM resources](/docs/r/cloudfunctions_cloud_function_iam.html)
for Cloud Functions.

## Example Usage

Secured function with a user allowed to invoke:
```hcl
resource "google_storage_bucket" "bucket" {
name = "test-bucket"
Expand All @@ -40,13 +47,59 @@ resource "google_cloudfunctions_function" "function" {
labels = {
my-label = "my-label-value"
}

environment_variables = {
MY_ENV_VAR = "my-env-var-value"
}
}

# Add IAM member for a user who can invoke the function (no admin actions)
resource "google_cloudfunctions_function_iam_member" "invoker" {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like secure cloud functions to be our default example, but what do you think of adding a second example that shows how to add a publicly invokable fn? That example will simulate the current behaviour for existing users, and I've seen users struggle setting allUsers permissions in the past.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done!

project = "${google_cloudfunctions_function.function.project}"
region = "${google_cloudfunctions_function.function.region}"
cloud_function = "${google_cloudfunctions_function.function.name}"

role = "roles/cloudfunctions.invoker"
member = "user:[email protected]"
}
```

A publically invocable function (similar behavior to functions created before
private-by-default):

```hcl
resource "google_storage_bucket" "bucket" {
name = "test-bucket"
}

resource "google_storage_bucket_object" "archive" {
name = "index.zip"
bucket = "${google_storage_bucket.bucket.name}"
source = "./path/to/zip/file/which/contains/code"
}

resource "google_cloudfunctions_function" "function" {
name = "function-test"
description = "My function"
runtime = "nodejs10"

available_memory_mb = 128
source_archive_bucket = "${google_storage_bucket.bucket.name}"
source_archive_object = "${google_storage_bucket_object.archive.name}"
trigger_http = true
entry_point = "helloGET"
}

# Add IAM member for a user who can invoke the function (no admin actions)
resource "google_cloudfunctions_function_iam_member" "invoker" {
project = "${google_cloudfunctions_function.function.project}"
region = "${google_cloudfunctions_function.function.region}"
cloud_function = "${google_cloudfunctions_function.function.name}"

role = "roles/cloudfunctions.invoker"
member = "allUsers"
}
```
## Argument Reference

The following arguments are supported:
Expand Down