Hide Cloud Functions execution behind Cloud Endpoints

问题

I was wondering if is possible to restrict/hide the direct access to my cloud function using cloud endpoints.

I followed this tutorial from Google.

On the link it says that:

With this set up, ESP intercepts all requests to your functions and performs any necessary checks (such as authentication) before invoking the function

I managed to complete the tutorial, adding a JWT authentication mecanism on the endpoint. But even though I can access with the URL from the CloudRun/ESP (with the protection enable), I still can access from the direct URL of the function (the protection does not apply at this level, so its insecure). How can I avoid this?.

Thanks in advance!

回答1:

GCF PM here,

You'll need to enable GCF IAM as mentioned in the second half of step 5, "grant ESP the Cloud Identity and Access Management (Cloud IAM) permission to invoke your functions."

This requires step 7 of "Before you begin" which is joining the Alpha whitelist

After that, you can secure the function as mentioned:

gcloud alpha functions add-iam-policy-binding FUNCTION_NAME \
    --member "serviceAccount:ESP_PROJECT_NUMBER-compute@developer.gserviceaccount.com" \
    --role "roles/cloudfunctions.invoker" \
    --project FUNCTIONS_PROJECT_ID

Apologies on the weird overlap of alpha stage products--GCF IAM should be public soon!

来源：https://stackoverflow.com/questions/56006993/hide-cloud-functions-execution-behind-cloud-endpoints