Google Professional Cloud Developer Question 114
Single answerGoogle Cloud PlatformYou are developing a serverless application on Google Cloud that needs to access multiple Google Cloud services, including Cloud Storage and Pub/Sub. The application runs on Cloud Run, and you want to implement authentication following the principle of least privilege. Which of the following approaches should you use to authenticate to these services?
- A
Use Application Default Credentials (ADC) provided by the Cloud Run runtime and assign a custom IAM service account with only the necessary roles.
- B
Embed a service account JSON key file in the application code and use it to authenticate with Cloud Storage and Pub/Sub.
- C
Use a hardcoded OAuth 2.0 access token in the application to authenticate to the services.
- D
Generate a JSON Web Token (JWT) in the application code and use it to authenticate with Google Cloud services.
Show answer and explanation
Correct answer: A
Explanation
The best way to authenticate Google Cloud services from a Cloud Run environment is by using Application Default Credentials (ADC). ADC automatically identifies the correct credentials based on the environment it's running in, and in Cloud Run, it uses the attached IAM service account. By assigning a custom IAM service account with the necessary roles, you can adhere to the principle of least privilege and ensure secure authentication without embedding sensitive credentials or hardcoding access tokens.
- A. Correct.
This is the correct answer. When running on Cloud Run, it is best practice to use Application Default Credentials (ADC) provided by the runtime. You can configure a custom IAM service account with only the necessary permissions to implement the principle of least privilege.
- B. Incorrect.
This is not recommended. Embedding service account JSON key files in application code is a security risk because it exposes sensitive credentials, and it does not follow best practices for managing authentication in Google Cloud environments.
- C. Incorrect.
This is insecure and not a recommended approach. Hardcoding access tokens is a poor practice because access tokens are short-lived and can easily expire, leading to authentication failures. Additionally, hardcoding sensitive data violates security best practices.
- D. Incorrect.
While generating a JWT is a valid authentication mechanism in some cases, it is not the recommended approach for applications running on Google Cloud services like Cloud Run. ADC is preferred as it simplifies authentication and leverages the runtime environment's built-in identity.