Google Professional Cloud Developer Question 124
Single answerGoogle Cloud PlatformA company is building a serverless application on Google Cloud using Cloud Functions. They want to ensure that only a specific service account can invoke one of their functions. Which Identity and Access Management (IAM) role should be assigned to the service account to meet this requirement?
- A
Cloud Functions Admin
- B
Cloud Functions Invoker
- C
Service Account User
- D
IAM Policy Admin
Show answer and explanation
Correct answer: B
Explanation
To restrict invocation of a Cloud Function to a specific service account, the 'Cloud Functions Invoker' role is the most suitable. This role provides the minimum necessary permissions for the task, adhering to the principle of least privilege.
- A. Incorrect.
The 'Cloud Functions Admin' role provides full administrative access to manage Cloud Functions, including creating, deleting, and updating functions. However, it is not necessary for the purpose of invoking a function.
- B. Correct.
The 'Cloud Functions Invoker' role allows users or service accounts to invoke a specific function. This is the appropriate role for granting invocation permissions without providing unnecessary administrative access.
- C. Incorrect.
The 'Service Account User' role allows a user or service account to act as a service account, but it does not grant permission to invoke Cloud Functions.
- D. Incorrect.
The 'IAM Policy Admin' role allows management of IAM policies, such as granting or revoking roles, but it is not relevant to invoking a Cloud Function.