Google Associate Cloud Engineer Question 352
Select 2Google Cloud PlatformYou are deploying a serverless application on Google Cloud Platform using Cloud Functions. The function needs to access a Cloud Storage bucket to read data. As a Google Cloud Associate Cloud Engineer, which steps should you take to ensure that the function has the necessary permissions with minimal privilege?
- A
Assign the Storage Admin role to the Cloud Function's service account.
- B
Assign the Storage Object Viewer role to the Cloud Function's service account.
- C
Assign the Project Viewer role to the Cloud Function's service account.
- D
Create a custom role with only the permissions necessary to read objects from the bucket and assign it to the Cloud Function's service account.
- E
Enable the Cloud Functions API and set the default service account permissions to 'Editor'.
Show answer and explanation
Correct answers: B, D
Explanation
To adhere to the principle of least privilege, it's crucial to assign only the permissions necessary for the task at hand. For a Cloud Function that needs to read data from a Cloud Storage bucket, the Storage Object Viewer role provides the necessary permissions without over-provisioning. Alternatively, creating a custom role tailored to the specific needs of the function ensures minimal permissions are granted, enhancing security.
- A. Incorrect.
The Storage Admin role provides more permissions than needed for simply reading objects, violating the principle of least privilege.
- B. Correct.
The Storage Object Viewer role provides the necessary permissions to read objects in the bucket, aligning with the principle of least privilege.
- C. Incorrect.
The Project Viewer role grants broad read-only access across the project, which includes more privileges than necessary for this specific task.
- D. Correct.
Creating a custom role with only the necessary permissions to read from the bucket ensures minimal privilege and adherence to security best practices.
- E. Incorrect.
Setting the default service account permissions to 'Editor' grants excessive permissions that are not required for this task.