1

Google Cloud Scheduler can be used to hit the http endpoint associated with a Google Cloud Function, so that you can run your function off a timer/scheduler. Cloud Functions have two options for their exposure: (1) Allow all traffic or (2) Allow internal traffic only (Only traffic from within the same project or VPC SC perimiter allowed). I'd like to do the latter, but the scheduler fails to access it with an HTTP 403.

With being open to all traffic, then it just remains for someone to guess my URL and they can trigger it as much as they wish. Now, of course, I can put authentication into my function and have Scheduler pass an appropriate header, but my function is not dangerous for someone else to trigger. However, if someone else can trigger it, they can call it as much as they want, and even with authentication, it will still incur charges for all those invocations. I want to ensure no one else besides Scheduler (ideally) can even reach the URL, so it is not triggered except on my schedule. Is there some way to make this possible?

Improve this question
5
  • I just ran into the exact same issue, despite the two entities being in the same project. I think this is a bug in GCP currently.
    – soroushjp
    Commented Jan 30, 2020 at 3:59
  • Thanks, @soroushjp for confirming.
    – Kevin Buchs
    Commented Jan 30, 2020 at 16:43
  • 1
    "But my function is not dangerous for someone else to trigger". I would highly recommend you to use some kind of authentication within your Cloud Functions even if "there are not dangerous", just to avoid what actually you mentioned: the fact that someone can trigger your functions increasing your costs. As for authenticating in Cloud Functions, here you will find more information on how to do it. I really highly recommend you to use authentication. I hope it helps.
    – Christopher Rodriguez Conde
    Commented Feb 7, 2020 at 9:06
  • @ChristopherRodriguezConde thanks for the suggestion. If I could find a reasonably easy way to do this, I would. However, I have not been able to navigate the tangled web of what can be put in the authentication from Cloud Scheduler vs what is available for Cloud Function off-the-shelf authentication. If I have the function out there with authentication internal to the function, a malicious actor can still call it repeatedly and incur the expense of the execution, though time may be shorter.
    – Kevin Buchs
    Commented Mar 5, 2020 at 23:14
  • However, the function actually unloads all messages from a PubSub, so if it is run repeatedly, it will execute a short amount of time due to there being no messages accumulated. I just realized that small scale PubSub queues are free. So, I should probably switch to that to trigger the function from Cloud Scheduler. That would allow the Cloud Function to operate with only internal network access.
    – Kevin Buchs
    Commented Mar 5, 2020 at 23:15

1 Answer 1

Reset to default
1

According to the official documentation:

To use Cloud Scheduler your Cloud project must contain an App Engine app that is located in one of the supported regions. If your project does not have an App Engine app, you must create one.

Cloud Scheduler overview

Therefore find the location of your app engine application by running:

gcloud app describe
#check for the locationId: europe-west2

Then make sure that you deploy your cloud function with Ingress Settings to "Allow internal traffic only" to the same location as your app engine application.

I deployed a cloud function on the same region as my app engine application and everything worked as expected.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .