gpt4 book ai didi

google-cloud-platform - 将 Cloud Armor 与 Cloud Run 结合使用并避免绕过

转载 作者:行者123 更新时间:2023-12-04 01:08:18 27 4
gpt4 key购买 nike

报价https://cloud.google.com/load-balancing/docs/https/setting-up-https-serverless#enabling

While Google Cloud Armor can be configured for backend services with Cloud Run (fully managed), Cloud Functions, and App Engine backends, there are certain limitations associated with this capability, especially with Cloud Run (fully managed) and App Engine. Users who have access to the default URLs assigned to these services by Google Cloud can bypass the load balancer and go directly to the service URLs, circumventing any configured Google Cloud Armor security policies.


避免针对 Cloud Run URL ( *.run.app ) 的攻击者绕过 Cloud Armor 的最佳方法是什么?
通常我会让 Cloud Run 只能由服务帐户调用,但 Cloud Load Balancer 不能使用服务帐户调用 Cloud Run。另一种方法是将 Cloud Load Balancer 配置为在 header 中使用 token ,并将在 Cloud Run 中运行的应用程序配置为仅接受具有正确 header / token 的调用,但我不想在应用程序中这样做。

最佳答案

您应该将服务的入口限制为“内部和负载平衡”,以禁用来自默认域的访问,并且只允许来自 Cloud Armor 的流量:

gcloud beta run services update SERVICE --ingress internal-and-cloud-load-balancing

关于google-cloud-platform - 将 Cloud Armor 与 Cloud Run 结合使用并避免绕过,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/65616106/

27 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com