Back to Checks
gcp

Cloud Function is connected to a VPC network

cloudfunction_function_inside_vpc
Service: cloudfunctionSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:cloudfunctions.googleapis.com/Function

Cloud Functions are attached to a Serverless VPC Access connector so egress traffic is routed through a private VPC network instead of the public internet.

The evaluation reviews each function's network configuration to confirm that a connector is configured.

Prowler logoProwlerprowler-provider-gcp

Risk

Without a VPC connector, Cloud Functions cannot privately reach internal resources such as Cloud SQL, Memorystore, or GKE, forcing those services to be exposed over public IPs. This expands the attack surface, weakens confidentiality of internal traffic, and breaks network segmentation controls required by most security frameworks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudfunction_function_inside_vpc

Recommendation

Apply defense in depth by routing Cloud Function egress through a Serverless VPC Access connector when the function must reach internal resources.

Scope each connector to least privilege subnets so functions cannot reach unintended endpoints.

Remediation

CLI

gcloud functions deploy <FUNCTION_NAME> --region=<REGION> --vpc-connector=projects/<PROJECT_ID>/locations/<REGION>/connectors/<CONNECTOR_NAME> --egress-settings=all-traffic

Terraform

resource "google_cloudfunctions2_function" "<example_resource_name>" {
  name     = "<example_resource_name>"
  location = "us-central1"

  service_config {
    vpc_connector                 = "<example_resource_id>" # Critical: routes egress through the VPC
    vpc_connector_egress_settings = "ALL_TRAFFIC"
  }
}

Other

1In Google Cloud Console, go to Cloud Functions
2Select the function and click Edit
3Under Connections, select the VPC connector for your network
4Set Egress settings to route all traffic through the VPC connector
5Save and redeploy the function

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudfunction.cloudfunction_client import (
    cloudfunction_client,
)


class cloudfunction_function_inside_vpc(Check):
    """Check that Cloud Functions are attached to a Serverless VPC Access connector.

    Verifies that each active Cloud Function has a `vpcConnector` configured so
    egress traffic flows through a private VPC network instead of the public
    internet. Functions in non-`ACTIVE` states are skipped because their network
    configuration is transient.
    """

    def execute(self) -> list[Check_Report_GCP]:
        """Execute the VPC-connector check across all Cloud Functions.

        Returns:
            A list of `Check_Report_GCP` findings, one per active Cloud
            Function. Status is `PASS` when a `vpc_connector` is set and `FAIL`
            otherwise.
        """
        findings = []
        for function in cloudfunction_client.functions:
            if function.state != "ACTIVE":
                continue
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=function,
                resource_id=function.name,
            )
            if function.vpc_connector:
                report.status = "PASS"
                report.status_extended = (
                    f"Cloud Function {function.name} is connected to a VPC via "
                    f"connector: {function.vpc_connector}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Cloud Function {function.name} is not connected to any VPC network."
            findings.append(report)
        return findings

References