Cloud Run services should have public access restrictions configured
This control ensures that a Cloud Run service is not publicly accessible. It returns alarm when a binding for the `roles/run.invoker` role includes either the `allUsers` value or the `allAuthenticatedUsers` value; otherwise the service is not flagged.
What this control checks
Cloud Run services should have public access restrictions configured
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.cloudrun_service_restrict_public_access.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudrun_service_restrict_public_access - Powerpipe Control:
gcp_compliance.control.cloudrun_service_restrict_public_access
Last reviewed: 2026-10-09