Google Professional Cloud Developer Question 470
Select 3Google Cloud PlatformYou are developing a serverless application on Google Cloud that needs to call the Cloud Storage API to upload files. To ensure secure and seamless authentication, you decide to use a service account. Which of the following steps are necessary to enable your application to authenticate and call the Cloud Storage API using the service account?
- A
Assign the 'Storage Object Admin' role to the service account.
- B
Generate a JSON key for the service account and store it in your application code.
- C
Use the Application Default Credentials (ADC) library to authenticate with the service account.
- D
Ensure that the service account has been enabled for your Google Cloud project.
- E
Set the environment variable GOOGLE_APPLICATION_CREDENTIALS to point to the service account key file.
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely use a service account for calling the Cloud Storage API, the service account must have the appropriate permissions (e.g., 'Storage Object Admin' role). The recommended practice is to use Application Default Credentials (ADC) for authentication, which may require setting the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to the service account key file. Avoid embedding service account keys directly in code to prevent security vulnerabilities.
- A. Correct.
Correct. The service account needs the 'Storage Object Admin' role to have sufficient permissions to perform actions on Cloud Storage, such as uploading files.
- B. Incorrect.
Incorrect. While generating JSON keys is an option for service accounts, embedding credentials in application code is not recommended due to security risks. Instead, Application Default Credentials (ADC) should be used.
- C. Correct.
Correct. The Application Default Credentials (ADC) library simplifies authentication by using the appropriate service account credentials automatically, which is the recommended approach.
- D. Incorrect.
Incorrect. Service accounts are automatically enabled when created for your Google Cloud project, so no additional enabling step is required.
- E. Correct.
Correct. Setting the GOOGLE_APPLICATION_CREDENTIALS environment variable ensures the ADC library can locate the service account key file to authenticate.