Google Professional Cloud Developer Question 471
Select 3Google Cloud PlatformYou are developing a serverless application on Google Cloud that needs to interact with several Google APIs, including Cloud Storage and Cloud Pub/Sub. To secure the application, you decide to use a service account to make API calls. Which steps must you ensure are correctly implemented for the service account to authenticate and make API calls successfully?
- A
Grant the service account the appropriate IAM roles for the required APIs.
- B
Download the service account key file and include it in your application's source code for authentication.
- C
Configure your application to use the service account by setting the GOOGLE_APPLICATION_CREDENTIALS environment variable.
- D
Ensure that the service account is enabled for the APIs it needs to access.
- E
Assign the service account to the Compute Engine default service account role.
Show answer and explanation
Correct answers: A, C, D
Explanation
For a service account to make API calls, it must have the necessary IAM roles to access the required APIs, and these APIs must be enabled in the project. Additionally, the application must be configured to authenticate as the service account, typically using the GOOGLE_APPLICATION_CREDENTIALS environment variable or another secure mechanism. Avoid embedding service account keys in source code as it poses a significant security risk.
- A. Correct.
Granting the appropriate IAM roles is necessary to ensure the service account has permissions to access the required APIs.
- B. Incorrect.
Including the service account key file in your application's source code is a security risk and violates best practices. Instead, use environment variables or workload identity to authenticate securely.
- C. Correct.
Setting the GOOGLE_APPLICATION_CREDENTIALS environment variable enables your application to use the service account credentials for authentication.
- D. Correct.
The APIs that the service account needs to access must be enabled for the Google Cloud project, as disabled APIs will prevent access.
- E. Incorrect.
There is no role called 'Compute Engine default service account role'. Assigning the service account to this nonexistent role is invalid.