Google Professional Cloud Developer Question 110
Single answerGoogle Cloud PlatformYou are developing a serverless application running on Cloud Run. The application needs to access a Google Cloud Storage bucket to read and write files. Which authentication method should you use to securely authenticate your application to the Google Cloud Storage bucket, while minimizing the need to manage service account keys?
- A
Use Application Default Credentials (ADC) with the default service account assigned to the Cloud Run instance.
- B
Generate a JSON key file for a service account and include it in your application's codebase.
- C
Use a user-managed OAuth 2.0 access token and refresh it periodically.
- D
Manually authenticate using a JSON Web Token (JWT) signed with the service account's private key.
Show answer and explanation
Correct answer: A
Explanation
The best practice for authenticating to Google Cloud services from within a managed environment like Cloud Run is to use Application Default Credentials (ADC). ADC automatically retrieves credentials from the environment, such as the default service account assigned to the Cloud Run instance, ensuring secure and seamless authentication without requiring manual key management or custom token handling.
- A. Correct.
This is the correct answer. Application Default Credentials (ADC) automatically use the identity of the Cloud Run's default service account, which eliminates the need to manage service account keys while securely authenticating to Google Cloud services.
- B. Incorrect.
This is not recommended because including JSON key files in your application's codebase introduces security risks. Keys can be accidentally exposed if the codebase is shared or leaked.
- C. Incorrect.
This is incorrect because using a user-managed OAuth 2.0 access token requires additional maintenance and is not a scalable or secure solution for server-to-server communication.
- D. Incorrect.
This is incorrect because manually creating and signing a JWT is unnecessary when using Google Cloud services like Cloud Run, which handle the authentication process automatically through ADC.