Attack

Phase I - Ways to Deploy a Cloud Function in GCP

There are three ways to deploy a Cloud Function in GCP:

  1. Cloud Console
  2. gCloud Command
  3. Cloud Function API (REST & gRPC)

Reason to not use Cloud Console:

While Cloud Console may seem user-friendly for creating resources in GCP, we won't be using it. The reason being, creating resources in GCP often involves navigating through different pages, each with its own set of permissions. Depending on the user's level of access, they may not be able to view or access certain pages necessary to create a particular resource. It's important to have a number of permissions in place to ensure that a user can perform the actions they need to within the GCP environment.

While in case of gCloud or Cloud Function API a user for example, can create a Cloud Function with a narrow set of permissions, which is not possible in case of Cloud Console. Cloud Function API narrows down the permissions even more, and that is a great thing. (See APIs and Permissions Required for Deploying a Cloud Function via Cloud Function API (gRPC & REST) for more details.)

Attackers mainly gain access to a GCP environment using stolen or compromised authentication tokens (auth_tokens) or Service Account Keys. Cloud Console doesn't support authentication via auth_tokens neither Service Account Key. As a result, attackers may prefer to use the gCloud command or directly call the Cloud Function API via gRPC or REST API to create resources because they offer more flexibility in terms of authentication and control, and require narrow set of permissions.

Ways to upload code in Cloud Function in GCP

If you're creating a Cloud Function in GCP, you can use Cloud Console, gCloud Command, or Cloud Function API to do so. Regardless of the method you choose, you will need to upload the code into the Cloud Function.

The code uploaded to a cloud function helps define the behavior and functionality of the function. Code can include the logic for processing incoming requests, performing specific tasks, accessing external resources, and returning responses etc. The code is responsible for executing the main function that is triggered when the function is invoked, and it can interact with various services and APIs based on the needs of the function. The Code allows the function to perform a specific action or set of actions in response to an event or request. In short the code is what makes a Cloud Function - "Function".