CODEWITHSUNDEEP
securitygoogle-cloud-platformgoogle-cloud-functionsgoogle-cloud-iam
crevulus
crevulus

Reputation: 2458

Limit access to GCP Cloud Function based on domain rather than IAM

I have a function that I want to run via HTTP call in a simple script tag, i.e. <script src="https://server-location.cloudfunctions.net/function-name />. I want to make sure that the calls only come from a whitelisted domain, like you can do with cloud storage access requests, for example.

I've seen a couple of suggestions on SO (1 2 3), but they all suggest either a) IAM credentials in the request headers or b) including some security checks in the function itself. These won't work because a) you can't send headers with a script tag and, even if you could, I'd have to store the credentials in the html which is not secure, and b) security checks in the function will not limit the number of calls made to the function, and that's what I want to do (to prevent a horrendous bill).

Is there a way to do this?

Upvotes: 0

Views: 1137

Answers (1)

guillaume blaquiere
guillaume blaquiere

Reputation: 75890

You can use a HTTPS Load Balancer with your Cloud Functions in a serverless NEG.

Then you can activate Cloud Armor on your Load balancer and set a custom rule. You can use the request.headers map and filter on the "HOST" key to only accept the requester domain that you want.

Upvotes: 1

Related Questions