Google Professional Cloud Developer Question 469
Select 3Google Cloud PlatformYou are developing a serverless application on Google Cloud that uses a Cloud Function to process data and store results in Cloud Storage. The Cloud Function must authenticate to the Cloud Storage API using a service account. What steps should you take to ensure secure and proper authentication?
- A
Attach a service account to the Cloud Function with the necessary IAM permissions for Cloud Storage.
- B
Generate a key for the service account, download it, and embed it in your Cloud Function's source code.
- C
Grant the Cloud Function's service account the 'Storage Object Admin' role if it needs to write to Cloud Storage.
- D
Use Application Default Credentials (ADC) to allow the Cloud Function to automatically use the attached service account for authentication.
- E
Manually authenticate to Cloud Storage by calling the gcloud auth login command within the Cloud Function code.
Show answer and explanation
Correct answers: A, C, D
Explanation
The secure and recommended approach for enabling a Cloud Function to access Cloud APIs is to attach a service account with the required IAM permissions (e.g., 'Storage Object Admin' for Cloud Storage) and use Application Default Credentials. Avoid embedding service account keys in the source code or performing manual authentication steps like running gcloud auth login, as these methods are insecure and not practical in serverless environments.
- A. Correct.
This is correct. Attaching a service account with the necessary IAM permissions to the Cloud Function is the recommended way to securely enable API access.
- B. Incorrect.
This is incorrect. Embedding a service account key in source code is a security risk and violates best practices for handling credentials.
- C. Correct.
This is correct. Assigning the 'Storage Object Admin' role ensures the service account has sufficient permissions to write to Cloud Storage.
- D. Correct.
This is correct. Application Default Credentials (ADC) automatically use the attached service account for authentication, simplifying the process.
- E. Incorrect.
This is incorrect. Manually running gcloud auth login inside a Cloud Function is not a viable or secure way to authenticate.