security(iac/gcp): set allow_unauthenticated=false; document ingress override#586
security(iac/gcp): set allow_unauthenticated=false; document ingress override#586cristim wants to merge 1 commit into
Conversation
…override (closes #384, #78) #384: cloud_run_allow_unauthenticated was incorrectly set to true in all three environment tfvars, overriding the variable default of false. Cloud Run's built-in IAM auth is a defence-in-depth layer independent of our application-level JWT auth; it was unintentionally disabled. Set it to false in dev, staging, and prod. #78: cloud_run_ingress is temporarily set to INGRESS_TRAFFIC_ALL in all environments because the external HTTPS LB + Cloud Armor stack (enabled by enable_cdn=true) has not yet been provisioned. The variable default is INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER, which would block *.run.app traffic until DNS + cert + LB are in place. Update the inline comments to cross-reference both issues and explain the removal condition.
cristim
added
triaged
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
1 participant
Summary
Two related Cloud Run security/ops fixes to all three environment tfvars (dev, staging, prod):
#384 - allow_unauthenticated=false:
cloud_run_allow_unauthenticatedwas set totruein all three tfvars, overriding the variable default offalse. Cloud Run's built-in IAM auth is a defence-in-depth layer independent of our application-level JWT auth; it was unintentionally disabled. Setting it tofalsere-enables it.#78 - Document ingress override:
cloud_run_ingress = "INGRESS_TRAFFIC_ALL"is a temporary override because the external HTTPS LB + Cloud Armor stack (enable_cdn=true) has not yet been provisioned. The variable default (INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER) would block*.run.apptraffic until DNS + cert + LB are in place. Updated inline comments to cross-reference both issues and state the removal condition.Closes #384
Closes #78
Test plan
terraform fmt -checkpasses on all three tfvars files