Google Professional Cloud Developer Question 122
Single answerGoogle Cloud PlatformYou are developing a serverless application on Google Cloud that uses Cloud Functions to process images and store metadata in Firestore. You need to ensure that the Cloud Function has the appropriate permissions to write to Firestore, but you also want to follow the principle of least privilege. Which IAM role should you assign to the Cloud Function's service account?
- A
Firestore Viewer
- B
Firestore Editor
- C
Cloud Functions Admin
- D
Cloud Datastore User
Show answer and explanation
Correct answer: D
Explanation
The principle of least privilege dictates that you should only grant the minimal permissions required for a task. In this case, the Cloud Function needs to write metadata to Firestore, and the Cloud Datastore User role provides the necessary permissions without granting unnecessary access. Other roles either provide excessive permissions or lack the required permissions to write to Firestore.
- A. Incorrect.
The Firestore Viewer role only provides read access to Firestore, which is insufficient for writing metadata.
- B. Incorrect.
The Firestore Editor role provides both read and write access, but it grants broader permissions than required for this use case, violating the principle of least privilege.
- C. Incorrect.
The Cloud Functions Admin role allows managing Cloud Functions, but it does not provide access to Firestore.
- D. Correct.
The Cloud Datastore User role grants the necessary permissions to read and write Firestore documents, adhering to the principle of least privilege. (Firestore and Cloud Datastore share the same underlying technology.)