Customizing CloudCustodian GCP CloudFunctions parameters

[alextodicescu]

I'm trying to deploy a test CloudCustodian policy in a GCP environment that has several GCP Organization policy constraints

• constraints/cloudfunctions.requireVPCConnector
• constraints/cloudfunctions.allowedVpcConnectorEgressSettings
• constraints/cloudfunctions.allowedIngressSettings
• constraints/cloudbuild.allowedWorkerPools

Deploying the below test c7n policy results in policy constraint violations for the above

policies:
  - name: test
    resource: gcp.instance
    mode:
      service-account: test@<project-id>.iam.gserviceaccount.com
      type: gcp-audit
      methods:
        - v1.compute.instances.insert
    filters:
      - type: value
        key: name
        value: test
    actions:
      - type: notify
        to:
          - test@example.com
        template: policy-template
        transport:
          type: pubsub
          topic: projects/<project-id>/topics/test

The docs don't seem to provide info how any of the below CloudFunction parameters can be set:

• worker_pool
• vpc_connector
• vpc_connector_egress_settings
• ingress_settings
  https://cloud.google.com/python/docs/reference/cloudfunctions/latest/google.cloud.functions_v2.types.BuildConfig
  https://cloud.google.com/python/docs/reference/cloudfunctions/latest/google.cloud.functions_v2.types.ServiceConfig

Is there any way currently to use CloudFunctions 2nd gen and setting these parameters?

Below is an example of working gcloud command for creating CloudFunctions in our environment. I'm looking to configure CloudCustodian to deploy CloudFunctions with a similar set of parameters

gcloud functions deploy test --runtime <configurable> \
--trigger-http \
--gen2 \
--no-allow-unauthenticated \
--set-build-env-vars GOOGLE_VENDOR_PIP_DEPENDENCIES=vendor \
--project=<configurable> \
--region=<configurable> \
--build-worker-pool=<configurable> \
--vpc-connector=<configurable> \
--ingress-settings=internal-and-gclb \
--egress-settings=all \
--service-account=<configurable>