Cloud Functions should not have roles/editor or roles/owner permissions
Cloudfunction functions should not have roles/editor or roles/owner permission. The powerpipe check cloudfunction_function_restricted_permission compares each function's service account email against IAM policy bindings for those two roles.
What this control checks
Checks Cloud Functions against a restricted permission rule
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.cloudfunction_function_restricted_permission.
Related controls
- Compute Engine instances should have IAM write permissions restricted
- Compute Engine instances should have Deployment Manager permissions restricted
- Compute Engine instances should not use the default service account
- IAM users should not have Service Account User or Service Account Token Creator roles at project level
- Projects should have log metric filters and alerts configured for project ownership assignments and changes
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudfunction_function_restricted_permission - Powerpipe Control:
gcp_compliance.control.cloudfunction_function_restricted_permission
Last reviewed: 2026-10-09