Cloud Functions Should Have Dead Letter Queue Configured

More Info:

The DLQ should be configured for cloud function topics subscriptions

Risk Level

Low

Address

Performance Efficiency, Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• HIPAA
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step by step instructions to remediate the cloud misconfiguration "Cloud Functions Should Have Dead Letter Queue Configured For Pub/Sub Subscriptions" for GCP using GCP console:

1. Open the Google Cloud Console and navigate to the Cloud Functions section.

2. Select the function that needs to be remediated and click on its name to open its details.

3. In the details page, click on the "Triggers" tab and select the Pub/Sub trigger that needs to be remediated.

4. Scroll down to the "Advanced" section and click on the "Edit" button.

5. In the "Edit trigger" dialog box, scroll down to the "Retry settings" section.

6. Enable the "Dead-letter topic" option and select the Pub/Sub topic that will receive the failed messages.

7. Optionally, you can also set the maximum number of retries and the minimum backoff duration before the message is sent to the dead-letter topic.

8. Click on the "Save" button to save the changes.

9. Repeat the above steps for all the Pub/Sub triggers that need to be remediated.

By following these steps, you will be able to remediate the cloud misconfiguration "Cloud Functions Should Have Dead Letter Queue Configured For Pub/Sub Subscriptions" for GCP using GCP console.

Using CLI

To remediate the misconfiguration "Cloud Functions Should Have Dead Letter Queue Configured For Pub/Sub Subscriptions" for GCP using GCP CLI, follow the below steps:

1. Open the Cloud Shell in the GCP Console.

2. Set the environment variables for the project ID and region where the Cloud Function is deployed. Replace [PROJECT_ID] and [REGION] with the appropriate values.

export PROJECT_ID=[PROJECT_ID]
export REGION=[REGION]

3. List all the Pub/Sub subscriptions in the project by running the following command:

gcloud pubsub subscriptions list --project $PROJECT_ID

4. Identify the subscription that is associated with the Cloud Function that needs to be remediated.

5. Enable the dead-letter topic for the subscription by running the following command:

gcloud pubsub subscriptions update [SUBSCRIPTION_NAME] --project $PROJECT_ID --dead-letter-topic=[DEAD_LETTER_TOPIC] --dead-letter-topic-project=[DEAD_LETTER_TOPIC_PROJECT]

Replace [SUBSCRIPTION_NAME] with the name of the subscription identified in Step 4. Replace [DEAD_LETTER_TOPIC] and [DEAD_LETTER_TOPIC_PROJECT] with the name of the dead-letter topic and the project ID where the dead-letter topic is located, respectively.

6. Verify that the dead-letter topic is enabled for the subscription by running the following command:

gcloud pubsub subscriptions describe [SUBSCRIPTION_NAME] --project $PROJECT_ID --format="value(deadLetterPolicy.deadLetterTopic)"

Replace [SUBSCRIPTION_NAME] with the name of the subscription identified in Step 4.

7. Repeat the above steps for all the Pub/Sub subscriptions that are associated with the Cloud Function.

By following the above steps, you can remediate the misconfiguration "Cloud Functions Should Have Dead Letter Queue Configured For Pub/Sub Subscriptions" for GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Cloud Functions Should Have Dead Letter Queue Configured For Pub/Sub Subscriptions" for GCP using Python, you can follow the below steps:

1. Identify the Cloud Functions that are using Pub/Sub subscriptions. You can use the GCP Console or the Cloud SDK command gcloud functions list to list all the Cloud Functions in your project.

2. For each Cloud Function that is using Pub/Sub subscription, check if it has a Dead Letter Queue configured. You can use the Cloud SDK command gcloud functions event-types list to list all the event types for a Cloud Function. If the event type is google.pubsub.topic.publish, then the Cloud Function is using Pub/Sub subscription.

3. If the Cloud Function is using Pub/Sub subscription, check if it has a Dead Letter Queue configured. You can use the Cloud SDK command gcloud functions describe <function-name> to get the details of a Cloud Function. Look for the deadLetterPolicy field in the output. If it is not present or is empty, then the Cloud Function does not have a Dead Letter Queue configured.

4. To configure a Dead Letter Queue for the Cloud Function, you can use the Cloud SDK command gcloud functions deploy <function-name> --update-labels dead-letter-topic=<dead-letter-topic>. Replace <function-name> with the name of the Cloud Function and <dead-letter-topic> with the name of the Pub/Sub topic where you want to send the dead-letter messages.

5. After deploying the Cloud Function with the Dead Letter Queue configuration, you can use the Cloud SDK command gcloud functions describe <function-name> to verify that the deadLetterPolicy field is set correctly.

By following these steps, you can remediate the misconfiguration "Cloud Functions Should Have Dead Letter Queue Configured For Pub/Sub Subscriptions" for GCP using Python.

Using Terraform

# HTTP-triggered Cloud Function that will process Pub/Sub messages
resource "google_cloudfunctions_function" "FUNCTION_NAME" {
  name        = "FUNCTION_NAME"                          # replace with your function name
  description = "Cloud Function with Pub/Sub DLQ"
  runtime     = "python311"                              # replace with your runtime
  region      = "FUNCTION_REGION"                        # replace with your region

  entry_point = "ENTRY_POINT"                            # replace with your function entry point
  source_archive_bucket = "SOURCE_BUCKET_NAME"           # replace with your source bucket
  source_archive_object = "SOURCE_ARCHIVE_OBJECT"        # replace with your source object

  trigger_http = true

  available_memory_mb   = 256
  service_account_email = "FUNCTION_SA_EMAIL"            # replace with your function SA email

  environment_variables = {
    # optional: pass topic / DLQ info to the function
    "PUBSUB_TOPIC"      = "projects/PROJECT_ID/topics/MAIN_TOPIC_NAME"
    "PUBSUB_DLQ_TOPIC"  = "projects/PROJECT_ID/topics/DLQ_TOPIC_NAME"
  }
}

# Main Pub/Sub topic that should trigger the Cloud Function
resource "google_pubsub_topic" "main" {
  name    = "MAIN_TOPIC_NAME"        # replace with your main topic name
  project = "PROJECT_ID"             # replace with your project ID
}

# Dead-letter Pub/Sub topic
resource "google_pubsub_topic" "dlq" {
  name    = "DLQ_TOPIC_NAME"         # replace with your DLQ topic name
  project = "PROJECT_ID"             # replace with your project ID
}

# Subscription with Dead Letter Queue configured, pushing to the Cloud Function
resource "google_pubsub_subscription" "main_with_dlq" {
  name    = "MAIN_SUBSCRIPTION_NAME"                    # replace with your subscription name
  project = "PROJECT_ID"                                # replace with your project ID
  topic   = google_pubsub_topic.main.name

  # Configure Push to the Cloud Function's HTTPS trigger URL
  push_config {
    push_endpoint = google_cloudfunctions_function.FUNCTION_NAME.https_trigger_url
    oidc_token {
      service_account_email = "FUNCTION_SA_EMAIL"       # must have "Cloud Functions Invoker" on the function
    }
  }

  # Dead Letter Queue configuration
  dead_letter_policy {
    dead_letter_topic     = google_pubsub_topic.dlq.id  # full topic name
    max_delivery_attempts = 5                           # replace with the threshold your policy requires
  }

  ack_deadline_seconds       = 10
  message_retention_duration = "1200s"
}

# IAM so Pub/Sub can publish to DLQ topic
resource "google_pubsub_topic_iam_member" "dlq_publisher" {
  project = google_pubsub_topic.dlq.project
  topic   = google_pubsub_topic.dlq.name
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-pubsub.iam.gserviceaccount.com"
}

data "google_project" "project" {}

This moves the dead-letter configuration onto the Pub/Sub subscription that feeds the Cloud Function, which is where GCP exposes DLQ settings; the Cloud Function resource itself does not have a dead-letter argument. No resource here is forced to be replaced except on first creation or if you change name values.

To verify, terraform plan should show creation (or in-place update) of google_pubsub_subscription.MAIN_SUBSCRIPTION_NAME with a dead_letter_policy block referencing DLQ_TOPIC_NAME and the desired max_delivery_attempts.

Additional Reading:

• https://cloud.google.com/pubsub/docs/samples/pubsub-dead-letter-create-subscription