IAM conditions for serverless product (Cloud Functions, Cloud Run, Cloud Scheduler) [159050213]

Assigned

Feature Request

Status Update

No update yet.

Description

md...@google.com

created issue #1

Jun 15, 2020 08:17PM

Customer Pain: Customer would like to restrict the access on some resources(Cloud Functions, Cloud Run, Cloud Scheduler) based on their name or better on their labels.

Issue summary: Customer has deployed a function to make some queries on our Cloud SQL instances databases. Note, the Cloud SQL instances use the private IP address connectivity only. They have setup a Serverless VPC Access connector to be able to connect from the Cloud Functions to our Cloud SQL instances privately and it works well.

They would like to let the developers being able to create new Cloud Functions which leverage the private connectivity into their host project. But, they would like to restrict their IAM roles on some others existing function based on their names or labels.

Comments

[Deleted User] <[Deleted User]> #2Nov 18, 2020 08:42AM

Hello,

Thanks for reaching out to us!

The Product Engineering Team has been made aware of your feature request, and will address it in due course. Though we can't provide an ETA on feature requests nor guarantee their implementation, rest assured that your feedback is always taken very seriously, as it allows us to improve our products. Thank you for your trust and continued support to improve Google Cloud Platform products.

In case you want to report a new issue, please do not hesitate to create a new [Issue Tracker] 1 thread describing your issue. Once again, thank you for the suggestions.

Thanks and Regards,
Onkar Mhetre
Google Cloud Support

al...@shopify.com <al...@shopify.com> #3Apr 13, 2023 03:48PM

Comment has been deleted.

Message last modified on Apr 13, 2023 03:51PM

ba...@google.com <ba...@google.com> Apr 14, 2023 02:35AM

Assigned to ba...@google.com.

ba...@google.com <ba...@google.com> Apr 14, 2023 07:14AM

Reassigned to gc...@google.com.

er...@pactum.com <er...@pactum.com> #4Aug 1, 2024 12:54PM

Note: for Cloud Functions and Cloud run there is at least possibility to define some permissions at resource level, but it seems impossible to grant any IAM principal ability to execute only single Cloud Scheduler Job in given project, violating principle of least privileges.

st...@google.com <st...@google.com> #5Aug 1, 2024 03:42PM

I believe IAM Conditions are supported by the Cloud Run API (I'll see to confirm that soon)

Issue 159050213