FaaS handler authentication
Description
Add a generic method for implementing application authentication within an FaaS function and include the method in the FaaS library.
Further details
We can add an authentication check to the CloudRun service managed through Cloud IAM permissions i.e. granting the invoker
role to the relevant service account.
However, we might want to add additional AuthN check within the application to protect against accidental unauthenticated exposure of the function through misconfiguration.
Suggested Solution
Push subscription only:
- Configure the use of a OIDC token.
- Add a decorator or similar for verifying the token provided.
- Optional, check the claim email against the expected service account email.
Backlog
- Should we add an additional layer of AuthN?
- Check Suggested Solution otherwise remove.
Acceptance criteria
- A "function" using this method rejects requests without AuthN information i.e. authN token.
- A "function" using this method rejects requests if the AuthN information is incorrect.
- A "function" using this method executes the function if AuthN information is correct.
- AuthN method is published within the FaaS library.
- Optional: method is python framework agnostic.