Google Professional Cloud Developer Question 136
Single answerGoogle Cloud PlatformYou are deploying a serverless application on Google Cloud using Cloud Run. The application needs to access a Cloud Storage bucket in another project. To ensure secure and least-privileged access, how should you configure authentication for the Cloud Run service?
- A
Use a Service Account Key file stored as an environment variable in the Cloud Run service.
- B
Enable Workload Identity Federation and configure the Cloud Run service to assume a role granting access to the Cloud Storage bucket.
- C
Assign the Cloud Run service a dedicated Google-managed Service Account and grant it Storage Object Admin IAM role on the bucket.
- D
Assign the Cloud Run service a custom Service Account with only the Storage Object Viewer role on the bucket.
Show answer and explanation
Correct answer: D
Explanation
To secure the Cloud Run service and follow the principle of least privilege, you should assign a custom Service Account to the service with only the specific permissions it requires. In this case, the Storage Object Viewer role on the bucket is sufficient for read-only access. This approach avoids the risks associated with over-granting permissions or using static credentials like Service Account keys.
- A. Incorrect.
Using a Service Account Key file is not recommended as it increases the risk of credential leakage and does not align with the principle of keyless and least-privileged access.
- B. Incorrect.
Workload Identity Federation is primarily used for granting access to Google Cloud resources from external, non-Google Cloud workloads, and is unnecessary for this scenario where the workload already exists within Google Cloud.
- C. Incorrect.
Granting the Storage Object Admin IAM role provides excessive privileges beyond what is needed, which violates the principle of least privilege.
- D. Correct.
Assigning a custom Service Account with only the Storage Object Viewer role on the bucket ensures that the Cloud Run service has the minimum required permissions to perform its task while adhering to least-privileged access principles.