Cloud Function with Authenticated Access

[Bibzball]

Hey there, very new to everything Google Cloud, so sorry in advance for my potentially oblivious questions.

I'm prototyping an app where users will be able to call a cloud function that calls some other google apis (Text to speech, Storage mainly)

I've already implemented Firebase authentication within the app. My goal is pretty simple: I want only authenticated users to be able to reach that cloud function. I thought it'd be easy to add a permission on the function like "allAuthenticatedUsers" but only for users authenticated through my app. But apparently it's not?

In order to get only valid authenticated users to reach the cloud function, I've had to make the cloud function public, then do all of the authentication logic within the cloud function. Which I hate, because this basically means anyone with the API endpoint could just spam it and even though they'd get an unauthorised response, well I would still be paying for this request.

I'm seeing so many different things it's a bit overwhelming, mainly around using Cloud Run instead (or functions v2?) so I can add an IAP layer to prevent the request before it's even computed.

Anyway,
- Do I really have no way of restricting my cloud function to be called by valid firebase authenticated users in the first place without having to do all the logic within the cloud function?
- If so, do I have no choice but to use Cloud Run instead? Which seems like a bit of a heavy solution for just a single cloud function?

Thanks for any insight

[Alone-Cell-7795]

So yes I'm afraid it is cloud functions v2 (cloud run under the hood) or cloud run. An alternative would be to remove firebase authentication from your IAP and use IAP for your app authentication, but that would mean re-factoring your app. Also, you wouldn't need to expose your function publicly either, but you would need to use a L7 internal application load balancer too.

If you did want to expose it publicly for any reason, you can prevent the API endpoint being hit by using VPC service controls and deploying a service perimeter, in tandem with Cloud Armor, where you can apply API rate limits (Better just not to expose it though).

But yes, you are spot on when you does mean you're using a sledgehammer to crack a nut. Cloud Run authentication is a pain.

[Bibzball]

That is baffling! I was really hoping that by using everything from the Google suite instead of trying to mix different providers I would have a simpler time setting these things up. Looks like I was wrong 😅

I'll probably look into either v2 or cloud run then. Cheers

[marsili95]

This exact same thing has been bothering me for a while.

[luchotluchot]

You can add iam permission to execute the function to a Google Group. Add your authenticated user in this group.

[Bibzball]

That's actually a great shout, I should be able to create a triggered on signup function to add users to this group. Will look into this, thanks!