Lab 03 — Google Cloud Functions Security Assessment

Mission Information

Property	Value
Lab Name	Google Cloud Functions Security Assessment
Module	Module 07 — Serverless Security
Lab Number	Lab 03
Difficulty	Intermediate
Estimated Time	90–120 Minutes
Cloud Provider	Google Cloud Platform (GCP)
Environment	Google Cloud Functions
Prerequisites	Complete Lessons 01–09
Tools Used	Google Cloud Console, gcloud CLI, Cloud Logging, Cloud Audit Logs, Eventarc, Pub/Sub, Secret Manager, Cloud Monitoring

Mission Brief

CloudNova Technologies has been contracted by MedSecure Global to perform an enterprise security assessment of its Google Cloud Functions environment.

The organization uses Google Cloud Functions to automate healthcare workflows, process patient information, integrate cloud-native applications, trigger AI workloads, and expose internal APIs.

Executive leadership requires an independent assessment to verify that Cloud Functions follow enterprise security standards, implement least privilege, securely manage secrets, and provide adequate monitoring for the Security Operations Centre (SOC).

You have been assigned as the Lead Cloud Penetration Tester responsible for evaluating Google Cloud Functions and producing a professional consulting report.

Learning Objectives

By completing this lab you will learn how to:

Assess Google Cloud Functions security.
Review Service Accounts.
Evaluate Google Cloud IAM.
Assess Eventarc and Pub/Sub security.
Review networking and authentication.
Validate Secret Manager integration.
Evaluate monitoring and logging.
Produce an enterprise security assessment.

Enterprise Scenario

During this engagement you will assess:

Google Cloud Functions
Service Accounts
Google Cloud IAM
Eventarc
Pub/Sub
Cloud Storage
Secret Manager
Cloud Logging
Cloud Monitoring
Cloud Audit Logs

Lab Architecture

Users

↓

API Gateway

↓

Google Cloud Functions

↓

Service Account

↓

Google Cloud IAM

↓

Google Cloud Services

├── Cloud Storage
├── Firestore
├── Cloud SQL
├── Secret Manager
├── Pub/Sub
├── Eventarc

↓

Cloud Logging

↓

Cloud Monitoring

↓

Security Operations Centre (SOC)

Lab Tasks

Task 01 — Inventory Google Cloud Functions

Review:

Function names
Runtime versions
Deployment regions
Trigger types
Business owners
Function generation (Gen1 / Gen2)

Expected Outcome

Create a complete inventory of Google Cloud Functions deployed across the enterprise.

Task 02 — Assess Service Accounts

Review:

Assigned Service Accounts
IAM Roles
Custom Roles
Resource permissions
Cross-project access

Identify:

Excessive permissions
Owner or Editor roles
Shared Service Accounts
Unused identities

Expected Outcome

Validate that Service Accounts follow the Principle of Least Privilege.

Task 03 — Review Google Cloud IAM

Assess:

IAM Policies
Role Bindings
Organization Policies
Project-level permissions
Folder-level permissions

Verify:

Least Privilege
Resource restrictions
Administrative access
Identity governance

Expected Outcome

Identify IAM misconfigurations that could increase enterprise risk.

Task 04 — Assess Event Sources

Review:

Eventarc
Pub/Sub
Cloud Storage Events
HTTP Triggers
Cloud Scheduler
Firestore Triggers

Validate:

Authentication
Authorization
Event permissions
Payload validation
Replay protection

Expected Outcome

Ensure that only trusted event sources can invoke production functions.

Task 05 — Review Networking

Assess:

Serverless VPC Connector
Firewall Rules
Private Service Connect
Outbound connectivity
API exposure
Internal-only functions

Expected Outcome

Determine whether Cloud Functions comply with enterprise networking standards.

Task 06 — Assess Secret Manager

Review:

Secret storage
IAM permissions
Secret versions
Secret rotation
KMS integration
Function access

Verify:

Least Privilege access
Secure secret retrieval
Encryption
Audit logging

Expected Outcome

Confirm that application secrets are securely managed.

Task 07 — Review Runtime Security

Assess:

Runtime versions
Dependency management
Third-party packages
Function timeout
Memory allocation
Environment variables

Validate:

Supported runtimes
Secure dependencies
Runtime hardening

Expected Outcome

Identify operational and security risks associated with runtime configuration.

Task 08 — Assess Monitoring & Logging

Review:

Cloud Logging
Cloud Monitoring
Cloud Audit Logs
Error Reporting
Security Command Center
SIEM Integration

Validate:

Log collection
Alert generation
Monitoring coverage
Log retention
Security telemetry

Expected Outcome

Determine whether the SOC has sufficient visibility into Cloud Functions activity.

Task 09 — Prioritize Security Findings

Classify findings as:

Critical
High
Medium
Low
Informational

Prioritize remediation according to business impact, exploitability, and operational risk.

Task 10 — Produce Executive Assessment Report

Prepare:

Executive Summary
Cloud Functions Architecture Review
Service Account Assessment
IAM Assessment
Event Security Review
Secret Manager Assessment
Monitoring Assessment
Risk Register
Security Scorecard
Remediation Roadmap

Expected Deliverables

At the conclusion of this lab you should produce:

Google Cloud Functions Security Assessment Report
Cloud Functions Inventory
Service Account Review
Google Cloud IAM Assessment
Event Security Review
Secret Manager Assessment
Monitoring Assessment
Risk Register
Executive Summary
Evidence Screenshots

Success Criteria

You have successfully completed this lab when you can:

Assess Google Cloud Functions using an enterprise methodology.
Review Service Accounts and Google Cloud IAM.
Evaluate Eventarc, Pub/Sub, and Cloud Storage triggers.
Assess Secret Manager, networking, runtime security, and monitoring.
Prioritize findings according to business impact.
Produce professional consulting documentation.

Real-World Skills Gained

After completing this lab you will be able to perform responsibilities commonly expected of:

Cloud Penetration Tester
Google Cloud Security Consultant
Serverless Security Engineer
Cloud Security Engineer
DevSecOps Security Engineer
Enterprise Security Consultant

Lab Summary

In this lab, you performed a comprehensive enterprise security assessment of Google Cloud Functions using the GoHackersCloud Enterprise Serverless Security Assessment Framework.

You reviewed Service Accounts, Google Cloud IAM, Eventarc, Pub/Sub, Cloud Storage, Secret Manager, runtime security, networking, monitoring, and logging before documenting technical findings and business risks in a professional consulting report.

Next Lab

➡️ Lab 04 — Serverless Identity & Event Injection Assessment

In the next lab, you will assess identity security and event-driven attack paths across AWS Lambda, Azure Functions, and Google Cloud Functions by reviewing IAM roles, Managed Identities, Service Accounts, API Gateway security, EventBridge, Event Grid, Eventarc, Pub/Sub, replay attacks, privilege escalation opportunities, and enterprise monitoring using the GoHackersCloud Enterprise Serverless Security Assessment Framework.