Cloud functions and Cloud endpoints are two powerful components available in Google Cloud Platform (GCP) that can work together to deliver scalable and secure applications. Cloud Functions allows you to run backend code in response to HTTPS requests or events without provisioning or managing servers. Cloud Endpoints, on the other hand, is a system that provides tools for generating APIs, controlling access, and monitoring usage. By combining these two, you can ensure that your HTTP cloud functions are accessible only via Cloud Endpoints, enhancing both functionality and security.

Background: What are HTTP Cloud Functions and Cloud Endpoints?

HTTP Cloud Functions are stateless functions that are triggered by HTTP requests. These functions can be written in Node.js, Python, Go, or Java, and are a way to execute code in response to web-based events without a complex infrastructure.

Cloud Endpoints provide API management features such as authentication, monitoring, and API keys. They act as a gateway through which requests are processed and forwarded to the appropriate back-end service, like Cloud Functions.

Configuring Cloud Endpoints to Secure HTTP Cloud Functions

Step 1: Deploy Your HTTP Cloud Function

First, deploy your HTTP Cloud Function on GCP. Below is a simple example in Node.js.

exports.helloWorld = (req, res) => {
  res.send('Hello, World!');
};

Deploy this function with the gcloud command:

gcloud functions deploy helloWorld --runtime nodejs10 --trigger-http --allow-unauthenticated

Note the URL provided upon successful deployment as it will be needed for the Cloud Endpoint configuration.

Step 2: Enable Cloud Endpoints

Ensure you've enabled the Cloud Endpoints API in your GCP project. Configure an OpenAPI specification document for your endpoint. This specification will detail the configuration of the API's paths, operations, and security rules.

Here's a basic OpenAPI example:

1swagger: '2.0'
2info:
3  title: Cloud Functions API Gateway
4  description: Secure access to Cloud Functions
5  version: '1.0.0'
6host: "YOUR-CLOUD-FUNCTIONS-REGION-YOUR-PROJECT-ID.cloudfunctions.net"
7schemes:
8  - https
9paths:
10  /helloWorld:
11    get:
12      summary: "Invoke helloWorld Function"
13      operationId: "helloWorld"
14      x-google-backend:
15        address: "https://YOUR-CLOUD-FUNCTIONS-REGION-YOUR-PROJECT-ID.cloudfunctions.net/helloWorld"
16      responses:
17        '200':
18          description: "Function response"
19      security:
20        - api_key: []
21securityDefinitions:
22  api_key:
23    type: "apiKey"
24    name: "key"
25    in: "query"

Replace YOUR-CLOUD-FUNCTIONS-REGION and YOUR-PROJECT-ID with the appropriate values.

Step 3: Deploy the Cloud Endpoints Configuration

Deploy the Cloud Endpoints configuration using the following command:

gcloud endpoints services deploy path-to-your-openapi.yaml

Step 4: Secure the Function

Now, update the Cloud Function to reject requests not routed through Cloud Endpoints:

1exports.helloWorld = (req, res) => {
2  if (req.header('x-forwarded-for') !== undefined) {
3    res.send('Hello, World!');
4  } else {
5    res.status(403).send('Access not allowed');
6  }
7};

Step 5: Test the Configuration

Test the secured setup by invoking the Cloud Function via the Cloud Endpoint with an API key.

Summary and Key Considerations

Additional Points

• Monitoring and Logging: Utilize GCP's monitoring and logging capabilities to track usage and detect abnormal access patterns.
• Updates and Maintenance: Regularly update both the endpoints definition and cloud functions to accommodate changes in APIs and security patches.

Using Cloud Endpoints in conjunction with Cloud Functions is a robust method to create secure, scalable, and highly manageable serverless applications that capitalize on the strengths of GCP.