Google Associate Cloud Engineer Question 350
Select 2Google Cloud PlatformYou are tasked with setting up a Google Cloud Function that processes images uploaded to a Cloud Storage bucket. The Cloud Function should have access to read from the bucket and write logs to Cloud Logging. You want to follow the principle of least privilege when assigning permissions. Which IAM roles should you assign to the Cloud Function's service account?
- A
roles/storage.objectViewer
- B
roles/storage.admin
- C
roles/logging.logWriter
- D
roles/owner
- E
roles/cloudfunctions.invoker
Show answer and explanation
Correct answers: A, C
Explanation
To adhere to the principle of least privilege, the service account for the Cloud Function should only have roles that allow it to perform the necessary tasks: read from the Cloud Storage bucket and write logs. The 'roles/storage.objectViewer' role provides read access to the bucket, and the 'roles/logging.logWriter' role allows writing to Cloud Logging. More permissive roles like 'roles/storage.admin' or 'roles/owner' are not necessary and should be avoided to minimize security risks.
- A. Correct.
This role allows the Cloud Function to read objects in the Cloud Storage bucket, which is needed to process the uploaded images.
- B. Incorrect.
This role provides full access to manage all storage buckets, which is more than necessary for reading objects.
- C. Correct.
This role allows the Cloud Function to write log entries, which is needed for logging purposes.
- D. Incorrect.
This role provides full administrative access to all resources in the project, which is excessive for the task at hand.
- E. Incorrect.
This role allows invoking Cloud Functions, which is not required for the Cloud Function to access Cloud Storage or write logs.