Google Professional Cloud Developer Question 112
Single answerGoogle Cloud PlatformYou are developing a serverless application on Google Cloud that uses Cloud Storage to store user-uploaded files. The application is deployed on Cloud Run, and you want to ensure secure and seamless authentication to access the Cloud Storage bucket. Which authentication approach should you use?
- A
Use Application Default Credentials (ADC) with a service account having appropriate IAM roles.
- B
Manually generate a JSON Web Token (JWT) signed with a private key and include it in API requests to Cloud Storage.
- C
Embed user credentials in the application code and use them to authenticate with Cloud Storage.
- D
Use OAuth 2.0 user credentials flow to request access to the Cloud Storage bucket.
Show answer and explanation
Correct answer: A
Explanation
The best practice for authenticating Google Cloud services in serverless applications like Cloud Run is to use Application Default Credentials (ADC). ADC leverages a service account attached to the Cloud Run service, allowing secure and automated authentication without requiring manual token generation or exposing sensitive credentials. This approach ensures seamless integration with other Google Cloud resources like Cloud Storage while maintaining security and scalability.
- A. Correct.
Correct: Application Default Credentials (ADC) automatically manage authentication for applications running on Google Cloud services like Cloud Run. By attaching a service account with appropriate IAM roles to your Cloud Run service, the application can securely and seamlessly authenticate to Cloud Storage without requiring manual intervention.
- B. Incorrect.
Incorrect: Manually generating a JWT and signing it with a private key is a valid approach for some authentication scenarios, but it is more complex and unnecessary in this case. ADC simplifies the authentication process and is the recommended approach for applications running on Google Cloud.
- C. Incorrect.
Incorrect: Embedding user credentials in the application code is insecure and violates best practices. This approach exposes sensitive information and poses significant security risks.
- D. Incorrect.
Incorrect: OAuth 2.0 user credentials flow is designed for end-user authentication rather than service-to-service authentication. For a serverless application accessing Google Cloud services, ADC with a service account is more appropriate.