63

As far as I understand, my Google Cloud Functions are globally accessible. If I want to control access to them, I need to implement authorization as a part of the function itself. Say, I could use Bearer token based approach. This would protect the resources behind this function from unauthorized access.

However, since the function is available globally, it can still be DDoS-ed by a bad guy. If the attack is not as strong as Google's defence, my function/service may still be responsive. This is good. However, I don't want to pay for those function calls made by the party I didn't authorize to access the function. (Since the billing is per number of function invocations). That's why it's important for me to know whether Google Cloud Functions detect DDoS attacks and enable counter-measures before I'm being responsible for charges.

8 Answers 8

38

I think the question about DDOS protection has been sufficiently answered. Unfortunately the reality is that, DDOS protection or no, it's easy to rack up a lot of charges. I racked up about $30 in charges in 20 minutes and DDOS protection was nowhere in sight. We're still left with "I don't want to pay for those function calls made by the party I didn't authorize to access the function."

So let's talk about realistic mitigation strategies. Google doesn't give you a way to put a hard limit on your spending, but there are various things you can do.

Limit the maximum instances a function can have

When editing your function, you can specify the maximum number of simultaneous instances that it can spawn. Set it to something your users are unlikely to hit, but that won't immediately break the bank if an attacker does. Then...

Set a budget alert

You can create budgets and set alerts in the Billing section of the cloud console. But these alerts come hours late and you might be sleeping or something so don't depend on this too much.

Obfuscate your function names

This is only relevant if your functions are only privately accessed. You can give your functions obfuscated names (maybe hashed) that attackers are unlikely to be able to guess. If your functions are not privately accessed maybe you can...

Set up a Compute Engine instance to act as a relay between users and your cloud functions

Compute instances are fixed-price. Attackers can slow them down but can't make them break your wallet. You can set up rate limiting on the compute instance. Users won't know your obfuscated cloud function names, only the relay will, so no one can attack your cloud functions directly unless they can guess your function names.

Have your cloud functions shut off billing if they get called too much

Every time your function gets called, you can have it increment a counter in Firebase or in a Cloud Storage object. If this counter gets too high, your functions can automatically disable billing to your project.

Google provides an example for how a cloud function can disable billing to a project: https://cloud.google.com/billing/docs/how-to/notify#cap_disable_billing_to_stop_usage

In the example, it disables billing in response to a pub/sub from billing. However the price in these pub/subs is hours behind, so this seems like a poor strategy. Having a counter somewhere would be more effective.

0
34

I have sent an email to google-cloud support, regarding cloud functions and whether they were protected against DDoS attacks. I have received this answer from the engineering team (as of 4th of April 2018):

Cloud Functions sits behind the Google Front End which mitigates and absorbs many Layer 4 and below attacks, such as SYN floods, IP fragment floods, port exhaustion, etc.

9
  • 10
    It'd be good to know what is behind etc? For google cloud functions it'll be just millions of valid http calls for example. Even if you filter them in your app with your own logic, you will be charged for the function call anyway. You can base then the rate limits on app usage on peak hours, but if the attacker will find the limit (easily) and attack in a slightly lower number of calls needed to google functions to become paused you'll just pay maximum all the time, and regular users will not be able to use the app based on this functions baceuse of the pauses. Looks like Epic Fail. Commented Jul 9, 2018 at 18:33
  • But at the same time if to use regular compute instances with autoscaler or kubernetes we will get the same problem. So what is the solution? Commented Jul 9, 2018 at 18:35
  • 1
    From the doc, cloud function only can prevent DDoS attacks underlayer 4 in TCP/IP. Hacker can still send huge amounts of traffic in HTTP to attack your API. The proper solution is you need to set up an API gateway with HA to do rate limit and load balancer. This flow would be visitors send requests --> load balancer --> API Gateway --> Cloud Function
    – Eric Wei
    Commented Sep 19, 2018 at 11:25
  • 1
    @Edd could you please send a link to where you found this information?
    – Dave
    Commented Feb 14, 2019 at 21:16
  • 1
    @Edd thank you for reply. I am sorry, I should be more specific. My questions was about your comment regarding Google "charge you for the 90% (or something like that) of the "usual traffic".
    – Dave
    Commented Feb 16, 2019 at 7:40
14

I have been asking myself the same question recently and stumbled upon this information. To shortly answer your question: Google does still not auto-protect your GCF from massive DDOS-attacks, hence: unless the Google infrastructure crashes from the attack attempts, you will have to pay for all traffic and computing time caused by the attack.

There is certain mechanisms, that you should take a closer look at as I am not sure, whether each of them also applies to GCF:

UPDATE JULY 2020: There seems to be a dedicated Google service addressing this issue, which is called Google Cloud Armor (Link to Google) as pointed out by morozko.

1
  • 1
    Thank you Igor. I'll take a look at the docs attached. IMO, Google should do what Amazon does -- simple integration of cloud functions with API Gateway and configuring the call rate based behavior per API route. In case of a DDoS we're still paying for API Gateway consumption of course, but that's not the same. Commented Mar 14, 2018 at 16:19
13

This is from my own, real-life, experience: THEY DON'T. You have to employ your own combo of rules, origin-detection, etc to protect against this. I've recently been a victim of DDoS and had to take the services down for a while to implement my own security wall.

1
  • 2
    Could you please describe which were the steps that you took to implement your own security wall? Commented Jul 6, 2021 at 21:23
2

from reading the docs at https://cloud.google.com/functions/quotas and https://cloud.google.com/functions/pricing it doesn't seem that there's any abuse protection for HTTP functions. you should distinguish between a DDoS attack that will make Google's servers unresponsive and an abuse that some attacker knows the URL of your HTTP function and invokes it millions of times, which in the latter case is only about how much you pay.

5
  • 3
    Yes, I'm talking about the latter one. My answer is probably not formed quite right. Well, this is then a big no-no service to use. We should always assume that the URL is well-known or easily discoverable. It is especially the case with Cloud Functions, because they are meant to be used as a drop-in replacement for "regular" web services, where we don't normally pay anything per invocation, other than may be traffic related costs. Commented Dec 23, 2017 at 20:55
  • I'm not sure that this is what they are meant to be used, everyone has a different use case. please accept my answer if it helped... Commented Dec 23, 2017 at 20:57
  • 1
    From docs: Google Cloud Functions is a serverless execution environment for building and connecting cloud services. It's not about use case really... Commented Dec 23, 2017 at 21:00
  • I upvoted your answer for pointing me to the docs with information I've already known. I'm not ready to accept this as an answer though because it's not deep enough, and does not solve the problem I have. As a head of architecture you understand very well what I mean. (BTW, I myself have not even gotten an up vote on this answer, as if there was something fundamentally wrong with it) Commented Dec 23, 2017 at 21:03
  • did it not answer your question or not the answer you were expecting? in any case, it is about use case, for some people the response time of such serverless execution is unacceptable for a web service. you should take all this data into consideration and decide if its the right solution for your your case. and if you're willing to accept the potential cost in case of such abuse and if overall it saves you time and $$$ to use serverless instead of other solutions, Commented Dec 23, 2017 at 21:41
2

DDoS attacks can be mitigated by the Google Cloud Armour which is in the beta stage at the moment

See also related Google insider's short example with GC Security Rules and the corresponding reference docs

1
  • 11
    It seemed like a good idea, but the price seems to be even higher than the cloud functions themselves: $0.75 per million HTTP(S) requests on Google Cloud Armor VS $0.40 per million invocations on Cloud Functions... Commented Aug 22, 2019 at 23:31
1

I am relatively new to this world, but from my little experience and after some research, it's possible to benefit from Cloudflare's DDOS protection on a function's http endpoint by using rewrites in your firebase.json config file.

In a typical Firebase project, here's how I do this :

  1. Add cloud functions and hosting to the project
  2. Add a custom domain (with Cloudflare DNSs) to the hosting
  3. Add the proper rewrites to your firebase.json
"hosting": {
  // ...

  // Directs all requests from the page `/bigben` to execute the `bigben` function
  "rewrites": [ {
    "source": "/bigben",
    "function": "bigben",
    "region": "us-central1"
  } ]
}

Now, the job is on Cloudflare's side

-1

One possible solution could be the API Gateway, where you can use firebase authentication. After successful authentication to the api gw it can call your function that deployed with --no-allow-unauthenticated flag. However I'm confused if you are charged for unauthenticated requests to api gw too..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.