Info icon
End of Life Notice: For Trend Cloud One™ - Conformity Customers, Conformity will reach its End of Sale on “July 31st, 2025” and End of Life “July 31st, 2026”. The same capabilities and much more is available in TrendAI Vision One™ Cloud Risk Management. For details, please refer to Upgrade to TrendAI Vision One™

GCP Function Runtime Version

TrendAI Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1400 automated best practice checks.

Risk Level: High (not acceptable risk)
Rule ID: CloudFunction-001

Ensure that you always use the latest version of the language runtime for your Google Cloud functions in order to adhere to Google Cloud best practices and receive the newest software features and capabilities.

Security
Reliability
Operational
excellence
Cost
optimisation
Sustainability

Using the latest version of the language runtime for Google Cloud functions is crucial for security, performance, and access to the latest features and libraries. It ensures that your functions benefit from bug fixes, optimizations, and improved compatibility with other services. Staying up-to-date minimizes vulnerabilities and keeps your serverless applications running smoothly and efficiently. The latest available runtime depends on the function's generation (environment): 1st-gen and 2nd-gen functions support different runtime sets, so each function should be assessed against the latest runtime available for its generation.


Audit

To determine if your Google Cloud functions are configured to use the latest version of the language runtime, perform the following operations:

Using GCP Console

  1. Sign in to the Google Cloud Management Console.

  2. Select the GCP project that you want to examine from the console top navigation bar.

  3. Locate the function based on its generation:

  4. Click on the name (link) of the function/service that you want to examine, then open the SOURCE tab to access the language runtime details.

  5. Check the Runtime attribute value to determine the language runtime version configured for the selected function. Compare it with the latest runtime available for that generation. A 1st-gen function cannot use 2nd-gen-only runtimes, so it should use the newest runtime available for 1st gen. If the Runtime attribute is not configured to use the latest language runtime version available for its generation, the selected function is using an outdated and/or decommissioned runtime.

  6. Repeat steps no. 3 – 5 for each Google Cloud function created for the selected GCP project.

  7. Repeat steps no. 2 – 6 for each project deployed within your Google Cloud account.

Using GCP CLI

  1. Run projects list command (Windows/macOS/Linux) with custom query filters to list the ID of each project available in your Google Cloud Platform (GCP) account:

    gcloud projects list
      --format="table(projectId)"
    
  2. The command output should return the requested GCP project ID(s):

    PROJECT_ID
    cc-bigdata-project-123123
    cc-iot-app-project-112233
    
  3. Run functions list command (Windows/macOS/Linux) using the ID of the GCP project that you want to examine as the identifier parameter and custom query filters to describe the name and the region of each Google Cloud function deployed within the selected project:

    gcloud functions list
      --project cc-bigdata-project-123123
      --format="(NAME,REGION)"
    
  4. The command output should return the requested function names and their regions:

    NAME                  REGION
    cc-web-app-function   us-central1
    cc-stream-function    us-central1
    
  5. Run functions describe command (Windows/macOS/Linux) using the name of the Google Cloud function that you want to examine as the identifier parameter, to describe the generation (environment) and the language runtime ID configured for the selected function. GCP only sets the environment field for 2nd-gen functions and reports the runtime under a different field depending on generation, so default the generation to GEN_1 and request both possible runtime fields:

    gcloud functions describe cc-web-app-function
      --region=us-central1
      --format="value(environment.yesno(no='GEN_1'), runtime, buildConfig.runtime)"
    
  6. The command output should return the function generation (GEN_1 or GEN_2) and the requested runtime ID, in that order:

    GEN_1   python311
    

    Compare the runtime ID returned by the functions describe command output with the latest runtime available for that generation. A 1st-gen function cannot use 2nd-gen-only runtimes, so it should use the newest runtime available for 1st gen. If the runtime ID is not the latest language runtime version available for the function's generation, the selected function is using an outdated and/or decommissioned runtime.

  7. Repeat steps no. 5 and 6 for each Google Cloud function created for the selected GCP project.

  8. Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

To upgrade the language runtime version for your Google Cloud functions, perform the following operations:

Using GCP Console

  1. Sign in to the Google Cloud Management Console.

  2. Select the GCP project that you want to access from the console top navigation bar.

  3. Locate the function based on its generation:

  4. Click on the name (link) of the function/service that you want to configure, listed in the Name column.

  5. Open the SOURCE tab to access the language runtime details for the selected function.

  6. Choose EDIT and select the latest runtime available for the function's generation from the Runtime dropdown list. If a 1st-gen function is already using the newest runtime available for 1st gen, migrate it to 2nd gen to access newer runtimes (for example Go, Ruby 4.0, and newer Node.js, Python, and Java versions).

  7. Choose SAVE AND REDEPLOY to save the changes and redeploy your function.

  8. Repeat steps no. 4 – 7 for each Google Cloud function that you want to configure, available for the selected GCP project.

  9. Repeat steps no. 2 – 8 for each project deployed within your Google Cloud account.

Using GCP CLI

  1. Run functions runtimes list command (Windows/macOS/Linux) to list the language runtimes supported by Google Cloud Functions. The ENVIRONMENTS column shows which generation (1st gen and/or 2nd gen) supports each runtime:

    gcloud functions runtimes list
      --region=us-central1
      --format="table(name,environments)"
    
  2. The command output should return the list of supported language runtimes:

    NAME        ENVIRONMENTS
    nodejs22    ['GEN_1', 'GEN_2']
    nodejs24    ['GEN_2']
    python312   ['GEN_1', 'GEN_2']
    python314   ['GEN_2']
    java17      ['GEN_1', 'GEN_2']
    java25      ['GEN_2']
    php82       ['GEN_1', 'GEN_2']
    php85       ['GEN_2']
    go126       ['GEN_2']
    ruby40      ['GEN_2']
    dotnet10    ['GEN_2']
    
  3. Run functions deploy command (Windows/macOS/Linux) using the name of the Google Cloud function that you want to configure as the identifier parameter, to upgrade to the latest runtime available for the function's generation. Use the --runtime parameter to specify a runtime valid for that generation. To adopt a 2nd-gen-only runtime, redeploy the function as 2nd gen using the --gen2 flag (e.g. --runtime=python314):

    gcloud functions deploy cc-web-app-function
      --region=us-central1
      --entry-point hello_http
      --trigger-http
      --runtime=python312
      --format="value(environment.yesno(no='GEN_1'), runtime, buildConfig.runtime)"
    
  4. The command output should return the function generation (GEN_1 or GEN_2) and the new runtime ID, in that order:

    GEN_1   python312
    
  5. Repeat steps no. 1 – 4 for each Google Cloud function that you want to configure, created for the selected GCP project.

  6. Repeat steps no. 1 – 5 for each project deployed within your Google Cloud account.

References

Publication date Oct 24, 2023