Why do we need to setup the deployment of Cloud Functions?

The deployment of GCP's cloud function is strongly recommended for Application team to setup to avoid the following problems:

  1. Over granting unnecessary permissions to account
    1. If you simply grant "Owner" or "Editor" permission to the project IAM, this will allow the account to have permission to do more than the account is allowed to.
    2. Security Practice: Always grant the least priviledge permission required.

  2. Complicated process to allow new developers to deploy Cloud Functions
    1. Due to the number of resources required to deploy Cloud Function, it becomes complex to onboard new resources to perform deployment.
      1. This can be simplified by setting up pipeline deployment.
      2. With a dedicated service account used to perform the deployment.



How can I setup the correct permission to deploy Cloud Functions?

To configure the GCP project, the following actions will be required to be taken:

  1. Enable the required Google API for the GCP project:
    1. Cloud Deployment Manager V2 API
    2. Cloud Functions API
    3. Compute Engine API
    4. Artifact Registry API
    5. Cloudbuild API

  2. Service Account to perform the deployment requires the following permission:
    1. App Engine Deployer
    2. Cloud Functions Developer
    3. Pipeline Deployer (Solvay)
    4. On the App Engine default service account (Gen1) / Compute Engine default service account (Gen2) permission:
      1. Grant "Service Account User" to the Service Account performing the deployment.

  3. Compute Engine default service account (used by the cloud build)
    1. Artifact Registry Writer
    2. Storage Object Viewer
    3. Logs Writer


If your deployment of cloud functions required changes to the settings, you will not be able to do it.

Please contact the GCP CloudOps to delete the existing cloud function first.