security(iac/gcp): all environments set cloud_run_allow_unauthenticated=true + INGRESS_TRAFFIC_ALL — no IAM gate on Cloud Run #384

Summary

All deployed GCP environments (github-dev.tfvars, github-staging.tfvars, github-prod.tfvars) configure Cloud Run with:

• cloud_run_allow_unauthenticated = true — grants roles/run.invoker to allUsers
• cloud_run_ingress = "INGRESS_TRAFFIC_ALL" — direct internet access to the *.run.app URL

The combined effect is that the Cloud Run service is publicly reachable by anyone on the internet with no IAM-level gate. Authentication is handled entirely by the application layer (JWT/session in Go handlers). If there is a handler-level auth bug, there is no cloud infrastructure layer to catch it.

Issue #78 tracks enabling the LB + Cloud Armor stack so ingress can be restricted; issue #51 (closed) previously set cloud_run_allow_unauthenticated = false in the variable default. This issue tracks the remaining gap: allow_unauthenticated = true in all tfvars files.

Location

• terraform/environments/gcp/github-dev.tfvars — cloud_run_allow_unauthenticated = true
• terraform/environments/gcp/github-staging.tfvars — cloud_run_allow_unauthenticated = true
• terraform/environments/gcp/github-prod.tfvars — cloud_run_allow_unauthenticated = true

Suggested fix

For staging/dev: set cloud_run_allow_unauthenticated = false and issue tokens from the CI pipeline (or use IAP for human access). This adds an IAM layer even without a full LB stack.

For prod: plan the LB + Cloud Armor rollout (tracked in #78) and flip cloud_run_ingress to INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER once the LB is in place. In the interim, consider setting cloud_run_allow_unauthenticated = false for defence-in-depth.

Severity rationale

MEDIUM — the application-level auth (JWT Bearer + session checks in Go handlers) is the primary gate. Cloud Run with allUsers invoker and open ingress is the intended deployment model for a public SaaS API. However, allow_unauthenticated = true is a defence-in-depth regression vs. the secure default set in #51, and removing the IAM gate means any handler auth bypass is fully exploitable from the internet with no secondary control.

Note: this is closely related to open issue #78; this issue focuses specifically on the allow_unauthenticated flag being force-true in all environments.