← all checklists

Google Cloud (Cloud Run, Cloud Build, IAM)

23 items · source

Copy as markdown

Filter items

Common Web Attack Classes

• Verify workload identity permissions if outbound cloud APIs are used.
• Search Cloud Run logs.
• Search Cloud Build logs.

Runtime, Containers & Hosting

• Inventory every Cloud Run service.
• Inventory every default run.app URL.
• Review Cloud Run ingress configuration.
• Verify direct access to run.app cannot bypass Cloudflare/WAF/load balancer controls.

DNS, CDN, Edge & WAF

• Verify Cloud Run run.app endpoint is controlled.

CI/CD & Supply Chain

• Prefer workload identity federation/OIDC over long-lived cloud credentials.
• Review Cloud Build service account permissions.
• Verify artifact registry permissions.

Monitoring, Detection & Incident Response

• Monitor Cloud Run deployments.
• Document emergency Cloud Run rollback.

Pre-Release Gates

• Any Cloud Run service exposing a privileged internal endpoint directly to the internet unintentionally.
• Verify production Cloud Run configuration.
• Production Cloud Run service accounts cannot be used in development workflows.
• Cloud Run audit complete.
• Cloud Build audit complete.

Tool Calling & Excessive Agency

• Cloud Run administration

AI Integrations (email, browser, repos, cloud)

• Agent cannot expose Cloud Run publicly without approval.

AI-Generated Crypto, Dependency & Config Bugs

• Cloud Run configuration
• Cloud Build configuration
• expose a Cloud Run service