Google Professional Cloud Developer Question 137
Single answerGoogle Cloud PlatformYou are developing a serverless application that runs on Google Cloud Run and needs to access a private Cloud Storage bucket. The organization requires that the application uses keyless authentication and adheres to the principle of least privilege. How should you configure access for the application?
- A
Assign the Storage Admin role to the Cloud Run service account
- B
Use Workload Identity to allow the Cloud Run service to impersonate a custom service account with the Storage Object Viewer role
- C
Use Workload Identity Federation to allow the Cloud Run service to authenticate using an external identity provider
- D
Generate a key for a service account with the Storage Admin role and store it as a secret in Secret Manager
Show answer and explanation
Correct answer: B
Explanation
Workload Identity enables keyless authentication by allowing Cloud Run to use a custom service account for accessing other Google Cloud services. Assigning the Storage Object Viewer role to the custom service account ensures the application has only the permissions it needs to read objects in the Cloud Storage bucket, adhering to the principle of least privilege.
- A. Incorrect.
Assigning the Storage Admin role grants excessive permissions, violating the principle of least privilege.
- B. Correct.
Using Workload Identity and assigning a custom service account with the Storage Object Viewer role ensures keyless authentication and adheres to the principle of least privilege by granting only read access to the bucket.
- C. Incorrect.
Workload Identity Federation is not required in this case since the application is running within Google Cloud and does not need to authenticate using an external identity provider.
- D. Incorrect.
Storing a generated key in Secret Manager does not adhere to keyless authentication, and generating keys can introduce security risks.