Google Professional Cloud Developer Question 121
Select 2Google Cloud PlatformA company is deploying a serverless application on Google Cloud that uses Cloud Functions to process user data and Cloud Storage to store the processed files. The operations team wants to ensure the principle of least privilege is applied. Which IAM roles should be assigned to the Cloud Function's service account to achieve this goal?
- A
roles/storage.objectCreator
- B
roles/storage.admin
- C
roles/storage.objectViewer
- D
roles/cloudfunctions.invoker
- E
roles/storage.legacyBucketOwner
Show answer and explanation
Correct answers: A, C
Explanation
To adhere to the principle of least privilege, you should assign only the permissions necessary for the Cloud Function to perform its tasks. The roles/storage.objectCreator role allows the Cloud Function to write files to Cloud Storage, while the roles/storage.objectViewer role allows it to read files if needed. Avoid using overly permissive roles like roles/storage.admin and roles/storage.legacyBucketOwner.
- A. Correct.
Correct: The
roles/storage.objectCreatorrole allows the Cloud Function to write files to Cloud Storage, which is necessary for the application's functionality. - B. Incorrect.
Incorrect: The
roles/storage.adminrole provides full control over Cloud Storage, which violates the principle of least privilege. - C. Correct.
Correct: The
roles/storage.objectViewerrole is necessary if the Cloud Function needs to read objects in the bucket. - D. Incorrect.
Incorrect: The
roles/cloudfunctions.invokerrole is used to invoke Cloud Functions, which is unrelated to the Cloud Function's access to Cloud Storage. - E. Incorrect.
Incorrect: The
roles/storage.legacyBucketOwnerrole grants broad permissions over the bucket, which is excessive and violates the principle of least privilege.