docs(cloud-security): GCP serverless scopes — Cloud Run + Cloud Functions

[maximelb]

What was asked

Cloud Run and Cloud Functions inventory is now collected for Google Cloud connections, together
with a verdict on whether each workload can be invoked from the internet with no authentication.
Document the scopes that verdict needs — before a customer discovers them as a silent denial.

What was done

All in docs/cloud-security/provider-setup/gcp.md.

• The required baseline already covers it. roles/viewer + roles/iam.securityReviewer
  grant both the list and the getIamPolicy reads, so nothing changes for a customer following
  the standard setup. Said explicitly, so the two new rows are not misread as new requirements.
• Two optional rows — roles/run.viewer and roles/cloudfunctions.viewer — for the
  least-privilege alternative (roles/browser plus per-service viewers), where they are what
  turns serverless coverage on. Added to the setup script too.
• Both halves of each grant are called out. Without getIamPolicy we can list a service but
  cannot tell whether anyone on the internet can invoke it, and we report no verdict rather
  than guess — so serverless exposure findings are absent, not empty, which is a different
  thing from "you have none".
• The 2nd-gen trap. A 2nd-gen Cloud Function runs on Cloud Run and its invoker permission
  lives on the underlying Cloud Run service (roles/run.invoker), not on the function
  (roles/cloudfunctions.invoker is the 1st-gen role). So a grant with
  roles/cloudfunctions.viewer but not roles/run.viewer lists 2nd-gen functions while
  leaving every one of them without a public-access verdict.
• New serverless row in the preflight-check table, and two troubleshooting rows — including
  the symptom that looks like good news: services listed, none ever flagged public, because
  getIamPolicy is denied.
• run.googleapis.com + cloudfunctions.googleapis.com added to the enable list; the page intro
  now mentions serverless alongside compute.

Testing

• Verified against the public Google Cloud IAM and Cloud Functions documentation: the permission
  names (run.services.list, run.services.getIamPolicy, cloudfunctions.functions.list,
  cloudfunctions.functions.getIamPolicy), the role names, and the 2nd-gen invoker behaviour
  (the Cloud Functions access-control page documents granting roles/run.invoker to allUsers
  via gcloud run services add-iam-policy-binding).
• Markdown-only change: table rows plus three admonitions and two script lines. No numbered lists
  touched, so the list-numbering check is unaffected. mkdocs is not installed locally, so the
  rendered-site checks run in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L7CkEf1fEa9Y8dBn5Utrx1

[maximelb]

Open finding (details inline):

• gcp.md L102 + L266 — both describe "listed but no public-access verdict" when getIamPolicy is denied; the collector actually returns partial coverage on its only type, which suppresses the serverless inventory entirely (bulk.go skips uncovered sub-scopes for upserts too). Raised on the host PR; the copy needs to match whichever behaviour lands.

No public-repo hygiene issues found (no customer names, internal repo names, internal URLs, or org ids); the role/permission table and the gen2-run.invoker note match the collector.