Documentation / Pentesting as Code (PAC)

GCP Cloud function

Set Up the GCP Cloud Function

To run pentests in GCP, Prancer needs a Cloud Function in your account that creates and manages the GKE clusters used as scanners. Set this up once before you can use the PAC for GCP wizard.

Note: this is a one-time prerequisite. Once the function is deployed and shared with Prancer support, you won't touch it again unless you rotate credentials.

Before you start

  • A GCP project with billing enabled.
  • Permission to create service accounts and Cloud Functions in the project.
  • Access to the prancer-pac-gcp-prereqs repository for the function source.

Step 1 — Create a service account

Create a service account JSON with these roles:

| Role | Why it's needed |

| ------ | ----------------- |

| Cloud Build Service Account | Build the function. |

| Cloud Functions Service Agent | Manage function resources. |

| Kubernetes Engine Admin | Manage GKE clusters and Kubernetes objects. |

| Service Account User | Run operations as the SA. |

| IAM Workload Identity Pool Viewer | Read identity pools. |

| Secret Manager Viewer | Read secret metadata. |

Warning: download the JSON file securely — you'll attach it to the Cloud Function in the next step.

Step 2 — Create the Cloud Function

Open the Cloud Function creation page.

Basics

  • Environment: 2nd gen
  • Function Name: any name you like
  • Region: wherever you want the function deployed

Trigger

  • Trigger Type: HTTPS
  • Authentication: Require authentication *(don't expose this publicly).*

Runtime settings

  • Runtime service account: the SA from Step 1.
  • *(Optional)* DEFAULT_NETWORK env var — set if you don't want to use the default VPC.

Build settings

  • Select Custom service account and choose the same SA.

Click Next.

Step 3 — Configure the code

1. Set Runtime to Go 1.18. 2. Pull the source from prancer-pac-gcp-prereqs. 3. Use the Inline Editor and paste each file from the repo.

Tip: if you upload as a ZIP instead, make sure go.mod and the .go files sit at the root of the archive — not inside a subfolder.

4. Set Entry point to RunPAC. 5. Click Deploy.

Step 4 — Share the URL with Prancer

Copy the deployed function's URL and send it to the Prancer support team — they'll wire it into your tenant.

Next steps

Image gap: add screenshots for each Cloud Function configuration tab (Basics / Trigger / Runtime / Build / Code) — this page is currently text-only.