| name | cis-gcp-foundations-1.17 |
| description | Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","iam","secret-manager"] |
| cis_id | 1.17 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
1.17 Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager (Manual)
Profile Applicability
Description
Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.
Rationale
It is recommended to use the Secret Manager, because environment variables are stored unencrypted, and accessible for all users who have access to the code.
Impact
There should be no impact on the Cloud Function. There are minor costs after 10,000 requests a month to the Secret Manager API as well for a high use of other functions. Modifying the Cloud Function to use the Secret Manager may prevent it running to completion.
Audit Procedure
Determine if Confidential Information is Stored in Your Functions in Cleartext
From Google Cloud Console
- Within the project you wish to audit, select the Navigation hamburger menu in the top left. Scroll down to under the heading 'Serverless', then select 'Cloud Functions'.
- Click on a function name from the list.
- Open the Variables tab and you will see both buildEnvironmentVariables and environmentVariables.
- Review the variables whether they are secrets.
- Repeat step 3-5 until all functions are reviewed.
From Google Cloud CLI
- To view a list of your cloud functions run:
gcloud functions list
- For each cloud function in the list run the following command:
gcloud functions describe <function_name>
- Review the settings of the buildEnvironmentVariables and environmentVariables. Determine if this is data that should not be publicly accessible.
Determine if Secret Manager API is 'Enabled' for your Project
From Google Cloud Console
- Within the project you wish to audit, select the Navigation hamburger menu in the top left. Hover over 'APIs & Services' to under the heading 'Serverless', then select 'Enabled APIs & Services' in the menu that opens up.
- Click the button '+ Enable APIS and Services'.
- In the Search bar, search for 'Secret Manager API' and select it.
- If it is enabled, the blue box that normally says 'Enable' will instead say 'Manage'.
