Control: Cloudfunction functions should restrict public access

powerpipe control run gcp_compliance.control.cloudfunction_function_restrict_public_access

powerpipe login
powerpipe control run gcp_compliance.control.cloudfunction_function_restrict_public_access --share

with publicly_accessible_functions as (
  select
    self_link
  from
    gcp_cloudfunctions_function,
    jsonb_array_elements(iam_policy -> 'bindings') as p,
    jsonb_array_elements_text(p -> 'members') as entity
  where
    entity in ('allAuthenticatedUsers', 'allUsers')
)
select
  f.project as resource,
  case
    when b.self_link is not null then 'alarm'
    else 'ok'
  end as status,
  case
    when b.self_link is not null then f.title || ' publicly accessible.'
    else f.title || ' not publicly accessible.'
  end as reason
  
  , location as location, project as project
from
  gcp_cloudfunctions_function as f
  left join publicly_accessible_functions as b on f.self_link = b.self_link;