MARTIN OMANDER: Hi Dina.
DINA PORTMAN: Hi Martin.
How are you doing?
MARTIN OMANDER: Just fine.
Thanks.
What are we working on today?
DINA PORTMAN: Well, my friend Holly
works for a large marketing research firm.
She uses a Cloud Function to write to her Cloud SQL
database.
She's concerned that somebody will
find her HTTP Cloud Function and access her database.
MARTIN OMANDER: Aha.
She should use an ingress controlled function.
That way, no one on the public internet
can access the function.
We can set it up with a virtual private Cloud connector.
[MUSIC PLAYING]
DINA PORTMAN: An ingress controlled
function sounds great.
The new product she's working on is collecting flavor research
for a candy company.
She has a Cloud Run front end that
sends the vote data to a Cloud Function which
parses and validates the data.
Then it sends the data to another Cloud Function
called write_to_db which inserts the row into the Cloud SQL
table.
So here is the app.
And we can vote for kale, margarita, or watermelon.
MARTIN OMANDER: Hmm.
Kale lollipops, Dina?
Is this a California company?
DINA PORTMAN: I think so.
MARTIN OMANDER: I think it would be watermelon for me.
DINA PORTMAN: Kale's winning.
MARTIN OMANDER: Oh, no.
DINA PORTMAN: [LAUGHTER]
Holly really wants to ensure that there
are zero fraudulent rights to her database in the future.
How do we achieve this?
MARTIN OMANDER: Well, she should update the settings
on her write_to_db function to only allow internal traffic.
This will exclude any network requests not originating
from the same project.
DINA PORTMAN: OK.
So I have my Cloud Function here.
And I'm clicking edit.
I scroll down.
I see variables, networking, and advanced settings.
Is that where it's going to--
MARTIN OMANDER: Yeah.
Networking.
Yeah.
DINA PORTMAN: OK.
Networking.
And Advanced, Environment Variables, or Connections?
MARTIN OMANDER: Internal.
Set to internal traffic.
DINA PORTMAN: OK.
Allow internal traffic.
OK.
Let's try voting.
MARTIN OMANDER: All right.
DINA PORTMAN: It's not working.
It's a 500 error.
MARTIN OMANDER: That's actually good.
That means that the network settings are working.
We updated the function write_to_db
to only accept private connections.
But the function candy_vote isn't sending its data
through a private connector.
Now we need to ensure that candy_vote is using a VPC
connector to call write_to_db.
But first, you need to create the VPC connector.
DINA PORTMAN: OK.
Let's do it.
So I'm in the VPC network settings.
I'm going to Serverless VPC access.
And I am clicking create connector.
MARTIN OMANDER: Yeah.
DINA PORTMAN: Name, candyvote-connector.
That's pretty good.
MARTIN OMANDER: That sounds great.
DINA PORTMAN: Yeah?
Network, default?
MARTIN OMANDER: Yep.
Defaults are our friends here.
DINA PORTMAN: IP range.
I really don't know.
But they give an example, so I'm just going to use that example.
MARTIN OMANDER: Yeah.
Let's go with the default.
DINA PORTMAN: OK, and create.
I have a VPC connector.
What do I do with it?
MARTIN OMANDER: Excellent.
Now, you go and update the candy_vote function
to use that VPC connector.
This means that any outgoing requests
from the candy_vote function, like calls
to the write_to_db function, they
will go through the VPC connector.
DINA PORTMAN: OK.
So when I go in, and I look at the connections.
Right here, it says Egress settings,
and then I select candy-connector.
Excellent.
And route all traffic through the VPC connector.
MARTIN OMANDER: Yeah, all of it.
DINA PORTMAN: And I've deployed.
Let's try voting again.
MARTIN OMANDER: Yeah.
DINA PORTMAN: What should I vote for?
MARTIN OMANDER: Maybe margarita this time.
DINA PORTMAN: It works.
MARTIN OMANDER: Ah, good.
Well, we need to gang up on those kale people.
If you wanted to make it even a little more secure,
you could update the Cloud SQL database
to be a private IP Cloud SQL.
So currently, the write_to_db function
only accepts internal traffic.
But if we update the outgoing request
to go through a VPC connector, we
could connect to the private IP Cloud SQL.
What this means is that even if somebody
has the SQL database as root password,
they can't connect to it from the public internet.
DINA PORTMAN: That sounds like a really good use of our network
settings.
MARTIN OMANDER: Excellent.
I can't wait for my favorite new flavor of lollipop.
DINA PORTMAN: I hope the kale lollipop
counts towards my daily servings of vegetables.
[MUSIC PLAYING]