Deploy a Cloud Run service that reads secrets from Secret Manager, uses a dedicated service account, and sends outbound traffic through a controlled VPC path with explicit egress settings.
#serverless#security#networking
LabSnackFax, a fax-to-snack API that moved to Cloud Run, shoved credentials in environment variables, and then discovered the service could talk to the whole internet like a caffeinated exfiltration intern.all labs
02 - Actions
score -- - -- votes
-- completed
Sign in with a real account to save ratings, completions, and share snapshots.
Stateloading
03 - Scenario
SnackFax, a fax-to-snack API that moved to Cloud Run, shoved credentials in environment variables, and then discovered the service could talk to the whole internet like a caffeinated exfiltration intern.
Deploy a Cloud Run service that reads secrets from Secret Manager, uses a dedicated service account, and sends outbound traffic through a controlled VPC path with explicit egress settings.
Constraints
Cloud Run reads secrets from Secret Manager at runtime, not plain environment variables
Cloud Run runs as a dedicated service account with minimal IAM grants
Outbound traffic uses a VPC connector with explicit egress behavior
Ingress is locked to the intended audience, not public by accident
ScenarioGCP - intermediate
05 - Steps
STEP_01
Create the runtime identity
Create a service account for the Cloud Run service and use it as the only runtime identity. This account is the blast radius boundary for anything the container does after startup.
Create a Secret Manager secret and seed a harmless lab token, then grant the runtime service account access to that one secret only. Document that real secret values should be injected through your delivery system, not committed into Terraform.
Create a Serverless VPC Access connector in a subnet reserved for Cloud Run egress. Wire the service to it and choose whether all traffic or only private ranges use the connector.
Hint: The egress setting is the point of the lab. Write down why you chose private-ranges-only or all-traffic for this workload.
Deploy the Cloud Run v2 service with the runtime service account, secret reference, VPC connector, and ingress setting. Avoid "all" ingress unless the scenario truly needs a public endpoint.