0

I have a Cloud Function which i want to secure by allowing only access from my domain to all users. I am exploring this for days.

Google seems to limit many options and instead you are forced to buy and use more products, for example for this you need a Network Balancer, which is a great product but a monster to smaller businesses, and not everyone needs it (or wants to pay for it).

So, how do you secure a Function on the Console, without IAM (no signin needed), to only allow a certain domain calls before you expand to a Balancer ?

  1. I do see that Google has something called Organization policies for project which supposed to restrict a domain, but the docs are not clear and outdated (indicate UI that doesn't exist)

  2. I know that Firebase has the Anonymous User, which allow a Function to check a Google ID of an anonymous user, but everything online is a Firebase thing, and no explanation anywhere how to do this using normal Function with Python.

EDIT I do use Firebase Hosting, but my Function is Python and it's handled from the GCP, not a Firebase Function.

gotiredofcoding
  • 135
  • 10

1 Answers1

0

Solved, you can use API Gateway, with API key, restrict the key to your domain only, and upload a config with your Function url, so you access it with a API url+key, and nobody else can just run it.

See here Cloud API Gateway doesn't allow with CORS

I wish i could connect it to a domain as well, but we can't, google seems to want everyone to use the expensive Balancer, or Firebase (charged in this case on a Function use for every website visit)

gotiredofcoding
  • 135
  • 10