Google Professional Cloud Developer Question 138
Select 2Google Cloud PlatformYou are deploying a serverless application on Google Cloud using Cloud Run. The application needs to access a Cloud Storage bucket in another project. To comply with security best practices, you want to ensure the application uses keyless and least privileged access. Which of the following steps should you take to set up this configuration?
- A
Enable Workload Identity on the Cloud Run service.
- B
Grant the Cloud Run service account the 'Storage Admin' role on the Cloud Storage bucket.
- C
Create a Workload Identity Federation pool and configure it to trust an external identity provider.
- D
Assign the 'Storage Object Viewer' role to the Google-managed service account of your Cloud Run service.
- E
Grant the Cloud Run service account the 'Storage Object Viewer' role on the Cloud Storage bucket.
Show answer and explanation
Correct answers: A, E
Explanation
To implement keyless and least privileged access, you need to enable Workload Identity on the Cloud Run service to ensure it can authenticate without using service account keys. Additionally, you should grant the Cloud Run service account the 'Storage Object Viewer' role, which adheres to the principle of least privilege by only providing read access to the Cloud Storage bucket objects, which is the specific need in this scenario.
- A. Correct.
Correct. Enabling Workload Identity ensures the Cloud Run service uses keyless authentication by leveraging Google Cloud's built-in identity mechanism.
- B. Incorrect.
Incorrect. Granting the 'Storage Admin' role violates the principle of least privilege as it provides excessive permissions to the Cloud Run service.
- C. Incorrect.
Incorrect. Workload Identity Federation is not required unless you are integrating with an external identity provider, which is not mentioned in this scenario.
- D. Incorrect.
Incorrect. Assigning the 'Storage Object Viewer' role to the Google-managed service account is not recommended because it does not align with best practices for least privilege and keyless access.
- E. Correct.
Correct. Granting the 'Storage Object Viewer' role to the Cloud Run service account provides the minimum necessary permissions to access objects in the Cloud Storage bucket.