Logo of Trend Micro
Use the Knowledge Base AI to help improve your Cloud Posture

Configure Maximum Instances for Cloud Functions

Trend Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1100 automated best practice checks.

Risk Level: Medium (should be achieved)

To prevent uncontrolled scaling, resource exhaustion, and unexpected costs, ensure that your Google Cloud Functions are configured with an optimal maximum number of allocated instances. Before running this conformity rule, you must define the maximum number of function instances in the rule settings, in your Trend Micro Cloud One™ – Conformity account.

Cost
optimisation
Operational
excellence

You can control your function's scaling behavior by setting a maximum number of function instances. This limits costs and prevents overwhelming downstream resources with traffic. Google Cloud functions scale by creating new instances to handle requests. Each instance can process only one request at a time, so large traffic spikes can lead to many new instances. Setting an optimal maximum number of instances ensures efficient resource utilization and timely response to incoming requests, balancing cost and performance.

Audit

To determine if your Google Cloud functions are configured with a maximum number of instances, perform the following operations:

Using GCP Console

01 Sign in to your Trend Micro Cloud One™ – Conformity account, open the Configure Maximum Instances for Cloud Functions conformity rule settings, and identify the maximum number of instances that your Google Cloud functions can deploy.

02 Sign in to the Google Cloud Management Console.

03 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

04 Navigate to Functions console available at https://console.cloud.google.com/functions/ to list the Google Cloud functions deployed for the selected GCP project.

05 Click on the name (link) of the function that you want to examine, listed in the Name column.

06 Select the DETAILS tab, and compare the Maximum instances attribute value, listed under General Information, with the maximum number of instances allowed by your organization (identified in step 1). If the configured maximum instances for the selected Google Cloud function exceed the authorized limit in the conformity rule settings, the function's autoscaling configuration is non-compliant. This could lead to unrestricted scaling, potentially causing resource exhaustion and increased costs.

07 Repeat steps no. 5 and 6 for each Google Cloud function created for the selected GCP project.

08 Repeat steps no. 2 - 7 for each project deployed within your Google Cloud account.

Using GCP CLI

01 Sign in to your Trend Micro Cloud One™ – Conformity account, open the Configure Maximum Instances for Cloud Functions conformity rule settings, and identify the maximum number of instances that your Google Cloud functions can deploy.

02 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each project available in your Google Cloud Platform (GCP) account: 

gcloud projects list
	--format="value(projectId)"

03 The command output should return the requested GCP project ID(s): 

cc-bigdata-project-123123
cc-iot-app-project-112233

04 Run functions list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the name and the region of each Google Cloud function deployed within the selected project: 

gcloud functions list
	--project cc-bigdata-project-123123
	--format="(NAME,REGION)"

05 The command output should return the requested function names and the associated regions: 

NAME: cc-project5-function
REGION: us-central1

NAME: tm-stream-function
REGION: us-central1

NAME: tm-vertex-function
REGION: us-central1

06 Run functions describe command (Windows/macOS/Linux) with the name of the Google Cloud function that you want to examine as the identifier parameter, to describe the maximum number of instances configured for the selected function: 

gcloud functions describe cc-project5-function
	--region=us-central1
	--format="value(serviceConfig.maxInstanceCount)"

07 The command output should return the maximum number of function instances configured: 

50

Compare the value returned by the functions describe command output with the maximum number of instances allowed by your organization (identified in step 1). If the configured maximum instances for the selected Google Cloud function exceed the authorized limit in the conformity rule settings, the function's autoscaling configuration is non-compliant. This may allow it to scale without restriction, potentially causing resource exhaustion and increased costs.

08 Repeat steps no. 6 and 7 for each Google Cloud function created for the selected GCP project.

09 Repeat steps no. 4 – 8 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

To ensure that your Google Cloud Functions have an optimal number of instances configured, set the maximum number of function instances by following these steps:

Using GCP Console

01 Sign in to your Trend Micro Cloud One™ – Conformity account, open the Configure Maximum Instances for Cloud Functions conformity rule settings, and identify the maximum number of instances that your Google Cloud functions can deploy.

02 Sign in to the Google Cloud Management Console.

03 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

04 Navigate to Functions console available at https://console.cloud.google.com/functions/ to list the Google Cloud functions deployed for the selected GCP project.

05 Click on the name (link) of the function that you want to configure, listed in the Name column.

06 Choose EDIT, expand the Runtime, build, connections and security settings configuration panel, select the RUNTIME tab, and enter the maximum number of function instances authorized by your organization (identified in step 1), in the Maximum number of instances box, under Autoscaling. The maximum number of function instances should be determined according to your workload's performance needs while staying within your organization's budget guidelines. Choose NEXT and DEPLOY to apply the changes and deploy a new revision for the selected function.

07 Repeat steps no. 5 and 6 for each Google Cloud function that you want to configure, available within the selected project.

08 Repeat steps no. 2 – 7 for each project deployed in your Google Cloud account.

Using GCP CLI

01 Sign in to your Trend Micro Cloud One™ – Conformity account, open the Configure Maximum Instances for Cloud Functions conformity rule settings, and identify the maximum number of instances that your Google Cloud functions can deploy.

02 Run functions deploy command (Windows/macOS/Linux) with the name of the Google Cloud function that you want to configure as the identifier parameter, to set the maximum number of function instances authorized by your organization, identified in step 1. The maximum number of function instances should be determined according to your workload's performance needs while staying within your organization's budget guidelines: 

gcloud functions deploy cc-project5-function
	--source=gs://gcf-v2-sources-123456789012-us-central1/cc-project5-function/function-source.zip
	--region=us-central1
	--runtime=nodejs20
	--trigger-http
	--max-instances=10

03 The command output should return the build information available for the redeployed function: 

buildConfig:
	automaticUpdatePolicy: {}
	build: projects/123456789012/locations/us-central1/builds/abcd1234-abcd-1234-abcd-1234abcd1234abcd
	dockerRegistry: ARTIFACT_REGISTRY
	dockerRepository: projects/cc-bigdata-project-123123/locations/us-central1/repositories/gcf-artifacts
	entryPoint: run-app
	runtime: nodejs20
	source:
		storageSource:
		bucket: gcf-v2-sources-123456789012-us-central1
		generation: '1730285369954566'
		object: cc-project5-function/function-source.zip
	sourceProvenance:
		resolvedStorageSource:
		bucket: gcf-v2-sources-123456789012-us-central1
		generation: '1730285369954566'
		object: cc-project5-function/function-source.zip
createTime: '2024-10-28T09:49:12.051881848Z'
environment: GEN_2
labels:
	deployment-tool: console-cloud
name: projects/cc-bigdata-project-123123/locations/us-central1/functions/cc-project5-function
serviceConfig:
	allTrafficOnLatestRevision: true
	availableCpu: 167m
	availableMemory: 256Mi
	environmentVariables:
		LOG_EXECUTION_ID: 'true'
	ingressSettings: ALLOW_ALL
	maxInstanceCount: 10
	maxInstanceRequestConcurrency: 1
	revision: cc-project5-function-00003-abc
	service: projects/cc-bigdata-project-123123/locations/us-central1/services/cc-project5-function
	serviceAccountEmail: 123456789012-compute@developer.gserviceaccount.com
	timeoutSeconds: 60
	uri: https://cc-project5-function-abcd1234abcd-uc.a.run.app
state: ACTIVE
updateTime: '2024-10-28T10:50:15.176254527Z'
url: https://us-central1-cc-bigdata-project-123123.cloudfunctions.net/cc-project5-function

04 Repeat steps no. 2 and 3 for each Google Cloud function that you want to configure, available in the selected project.

05 Repeat steps no. 1 – 4 for each GCP project deployed in your Google Cloud account.

References

Publication date Nov 20, 2024

Related CloudFunction rules