Google Professional Cloud Developer Question 109
Select 2Google Cloud PlatformYou are developing a web application hosted on Google Cloud and need to authenticate it to access a Google Cloud Storage bucket. You want to ensure authentication follows best practices and enables secure access to the bucket. Which authentication method(s) should you implement?
- A
Use Application Default Credentials (ADC) with a service account that has the necessary permissions.
- B
Manually parse and validate a JSON Web Token (JWT) issued by Google Cloud.
- C
Use OAuth 2.0 to obtain an access token for the service account and include it in requests.
- D
Hardcode the service account's private key in your application's source code to allow authentication.
Show answer and explanation
Correct answers: A, C
Explanation
When authenticating to Google Cloud services, it is essential to follow best practices to ensure security and simplicity. Application Default Credentials (ADC) and OAuth 2.0 are both recommended methods for authenticating applications. ADC allows the application to securely and automatically identify credentials in the running environment, while OAuth 2.0 provides a standardized way to obtain and use access tokens. Hardcoding sensitive information like private keys is strongly discouraged, as it can lead to security breaches.
- A. Correct.
Using Application Default Credentials (ADC) is the recommended best practice for authenticating applications running on Google Cloud. ADC automatically identifies the credentials based on the environment and securely uses a service account to access resources.
- B. Incorrect.
Manually parsing and validating a JWT issued by Google Cloud is not a recommended approach for authenticating to Google Cloud services. JWT validation is usually handled by libraries or SDKs, and directly handling it may lead to implementation errors and security vulnerabilities.
- C. Correct.
Using OAuth 2.0 to obtain an access token for the service account is a valid approach for authentication. The token should then be included in requests to the Google Cloud Storage API.
- D. Incorrect.
Hardcoding the service account's private key in the application's source code is a security risk and a violation of best practices. If the key is exposed, it can lead to unauthorized access to Google Cloud resources.