Google Professional Cloud Developer Question 113
Single answerGoogle Cloud PlatformYou are developing a serverless application on Google Cloud that needs to access multiple Google Cloud APIs, such as the Cloud Storage API and the Cloud Pub/Sub API. The application runs on Cloud Run. What is the recommended way to authenticate this application to access these APIs securely?
- A
Use a service account with the necessary roles and allow Cloud Run to use it as the identity.
- B
Generate a JSON key file for a service account, embed it in the application code, and use it for authentication.
- C
Use OAuth 2.0 and manually obtain access tokens from the user during application runtime.
- D
Hardcode the credentials for a service account directly into the application code.
Show answer and explanation
Correct answer: A
Explanation
The best practice for authenticating a serverless application like Cloud Run to Google Cloud services is to use a service account with the appropriate roles and let the platform securely manage its identity. This approach avoids the risks associated with embedding or hardcoding credentials while adhering to the principle of least privilege.
- A. Correct.
Correct. Using a service account with the necessary roles and letting Cloud Run manage it as the application's identity is the recommended way to securely authenticate. This avoids managing credentials manually and ensures the principle of least privilege.
- B. Incorrect.
Incorrect. Embedding a JSON key file in the application code is not secure, as it can be extracted if the application is compromised. Google Cloud discourages this approach.
- C. Incorrect.
Incorrect. Manually obtaining OAuth 2.0 access tokens during runtime is not practical for serverless applications, as there is no user interaction in this scenario.
- D. Incorrect.
Incorrect. Hardcoding credentials into the application is a poor security practice and should never be done, as it exposes sensitive credentials to potential attackers.