1

This doc notes that an alternative method for storage change notification (other than creating a topic and a subscription) is to use a cloud function, and in this doc defines a function with exports.helloGCSGeneric = (event, callback) => {. . . and gcloud beta functions deploy helloGCSGeneric --trigger-resource [YOUR_TRIGGER_BUCKET_NAME]

What are the security concerns around this? I could see that to set up the notification one would have to be authorized. But can anyone who isn't authorized reach this cloud function?

The usual problem is that if pub/sub can call an https: endpoint, then anyone can. Google blushes and says yeah, make a secret key and pack it in the message, if you care. (See this SO question for a proposed method--Secure Google Cloud Functions http trigger with auth.) But even so, this notification message comes originally from cloud storage so that technique can't be used.

Can anyone hit the endpoint leading to the helloGCSGeneric function above? How would one secure this endpoint?

mohawkTrail
  • 606
  • 1
  • 7
  • 19

1 Answers1

1

If you look at the trigger for a Cloud Function, you can see these don't have an endpoint. Trigger tab

These types of Cloud Functions don't actually have an external endpoint that you can trigger.

Edo Akse
  • 4,051
  • 2
  • 10
  • 21