Google CloudOverview
Cloud Run services that allow unauthenticated invocation are reachable without caller identity checks. Public access is sometimes intentional for websites or public APIs, but it should be explicitly approved and protected with compensating controls.
For internal services, APIs, webhooks, admin tools, and service-to-service workloads, require authenticated invocation and grant roles/run.invoker only to the users, groups, or service accounts that should call the service.
Remediation guidance
Remediation
Require authentication for the Cloud Run service and remove public allUsers / allAuthenticatedUsers invoker bindings unless the service is intentionally public and risk-accepted.
Google Cloud CLI
Remove public invoker access from the service:
gcloud run services remove-iam-policy-binding {{asset.name}} \
--project {{asset.cloudAccountID}} \
--region {{asset.region}} \
--member allUsers \
--role roles/run.invoker
If the service uses the newer Cloud Run invoker IAM check setting, ensure the invoker IAM check is enabled:
gcloud run services update {{asset.name}} \
--project {{asset.cloudAccountID}} \
--region {{asset.region}} \
--invoker-iam-check
Grant invocation only to approved callers. Replace {{manual.invokerMember}} with a specific user, group, or service account principal.
gcloud run services add-iam-policy-binding {{asset.name}} \
--project {{asset.cloudAccountID}} \
--region {{asset.region}} \
--member {{manual.invokerMember}} \
--role roles/run.invoker
Validation
gcloud run services get-iam-policy {{asset.name}} \
--project {{asset.cloudAccountID}} \
--region {{asset.region}}
Rollout guidance
- Confirm whether the service is intended to be public. If yes, document the owner, business reason, and compensating controls.
- For private services, update clients to authenticate with IAM, service-to-service identity, or an approved API gateway.
- Monitor 401/403 responses after enforcing authentication to catch missed callers.
- Use organization policy and CI/CD checks to prevent accidental public services.
References
- https://cloud.google.com/run/docs/authenticating/public
- https://cloud.google.com/run/docs/securing/managing-access
- https://cloud.google.com/sdk/gcloud/reference/run/services/update
Query logic
These are the stored checks tied to this control.
Publicly Accessible Cloud Run Services
Connectors
Covered asset types
Expected check: eq []
{
cloudRunServices(where: { allowsUnauthenticatedInvocation: { eq: true } }) {
...AssetFragment
}
}
