Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Cloud Run Service Runtime Version

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)

To adhere to Google Cloud Platform (GCP) best practices and benefit from the latest software features and capabilities, ensure that you always use the most recent version of the language runtime for your Cloud Run services.

Security
Reliability
Cost
optimisation
Operational
excellence
Sustainability

Using the latest language runtime version for Cloud Run services is crucial for security, performance, and access to the latest features and libraries. It ensures your services benefit from bug fixes, optimizations, and improved compatibility. By staying up-to-date, you minimize vulnerabilities and keep your serverless applications running smoothly and efficiently.


Audit

To determine if your Cloud Run services are configured to use the latest version of the language runtime, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Cloud Run console available at https://console.cloud.google.com/run/.

05 Select the SERVICES tab to view the Cloud Run services deployed for the selected GCP project.

06 Click on the name (link) of the service that you want to examine, listed in the Name column.

07 Select the SOURCE tab, choose EDIT SOURCE, and click on the Edit runtime and security updates button (pencil icon). The panel with the service runtime settings opens.

08 Check the Runtime configuration value to determine the language runtime version configured for the selected service. Compare the language runtime version available for your service with the updated list of language runtimes supported by Google Cloud Platform (GCP). If Runtime is not configured to use the latest language runtime version supported by GCP, the selected Cloud Run service is using an outdated and/or decommissioned runtime.

09 Repeat steps no. 5 - 7 for each Cloud Run service created for the selected GCP project.

10 Repeat steps no. 2 - 8 for each project deployed within your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each project available in your Google Cloud Platform (GCP) account:

gcloud projects list
  --format="value(projectId)"

02 The command output should return the requested GCP project ID(s):

cc-bigdata-project-123123
cc-iot-app-project-112233

03 Run services list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the name and the region of each Cloud Run service deployed within the selected project:

gcloud run services list
	--project cc-bigdata-project-123123
	--format="(NAME,REGION)"

04 The command output should return the requested service names and the associated regions:

NAME: cc-project5-service
REGION: us-central1

NAME: tm-stream-service
REGION: us-central1

NAME: tm-vertex-service
REGION: us-central1

05 Run services describe command (Windows/macOS/Linux) with the name of the Cloud Run service that you want to examine as the identifier parameter, to describe the language runtime configured for the selected service:

gcloud run services describe cc-project5-service
	--region=us-central1
	--format="value(metadata.annotations.'run.googleapis.com/build-base-image')"

06 The command output should return the full ID of the language runtime used, i.e., gcr.io/serverless-runtimes/\/runtimes/\, where \ is the ID of the language runtime configured for the selected service:

gcr.io/serverless-runtimes/google-18-full/runtimes/nodejs16

Compare the runtime ID returned in the command output with the updated list of language runtimes supported by Google Cloud Platform (GCP). If the runtime ID returned by the services describe command output is not associated with the latest language runtime version supported by GCP, the selected Cloud Run service is using an outdated and/or decommissioned runtime.

07 Repeat steps no. 5 and 6 for each Cloud Run service created for the selected GCP project.

08 Repeat steps no. 3 – 8 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

To update the language runtime version for your Google Cloud Run services in order to prevent security and compatibility risks, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Cloud Run console available at https://console.cloud.google.com/run/.

04 Select the SERVICES tab to access the Cloud Run services deployed for the selected GCP project.

05 Click on the name (link) of the service that you want to configure, listed in the Name column.

06 Select the SOURCE tab, choose EDIT SOURCE, and click on the Edit runtime and security updates button (pencil icon). The panel with the service runtime settings opens.

07 On the Edit runtime and security updates panel, perform the following actions:

  1. For Runtime, select the latest version of the language runtime configured for the selected Cloud Run service, supported by Google Cloud Platform (GCP).
  2. For Environment, choose the OS environment supported by the selected language runtime.
  3. Choose SAVE to apply the configuration changes.

08 Back to the SOURCE page, choose SAVE AND REDEPLOY to enable the feature and deploy a new revision of the service.

09 Repeat steps no. 5 - 8 for each Cloud Run service that you want to configure, available within the selected project.

10 Repeat steps no. 2 – 9 for each project deployed in your Google Cloud account.

Using GCP CLI

01 Run beta run deploy command (Windows/macOS/Linux) with the name of the Cloud Run service that you want to configure as the identifier parameter, to update the language runtime for the selected service to the latest supported version by setting the base image used for the application image:

gcloud beta run deploy cc-project5-service
	--region=us-central1
	--source "gs://run-sources-cc-bigdata-project-123123-us-central1/services/cc-project5-service/1234567890.123123.zip"
	--base-image nodejs20

02 The command output should return the build information available for the redeployed service:

Building using Buildpacks and deploying container to Cloud Run service [cc-project5-service] in project [cc-bigdata-project-123123] region [us-central1]
OK Building and deploying... Done.
	OK Uploading sources...
	OK Building Container...
	Logs are available at [https://console.cloud.google.com/cloud-build/builds...].
	OK Creating Revision...
Done.
Service [cc-project5-service] revision [cc-project5-service-00003-abc] has been deployed and is serving 100 percent of traffic.

03 Repeat steps no. 1 and 2 for each Cloud Run service that you want to configure, available in the selected project.

04 Repeat steps no. 1 – 3 for each GCP project deployed in your Google Cloud account.

References

Publication date Nov 19, 2024