Google Professional Cloud Developer Question 472
Select 3Google Cloud PlatformYou are developing a serverless application using Cloud Functions on Google Cloud. The function needs to write logs to Cloud Logging and read data from a Cloud Storage bucket. Which steps should you take to ensure the function can make the necessary Cloud API calls using service accounts?
- A
Assign the 'Cloud Logging Writer' role to the Cloud Function's service account.
- B
Assign the 'Storage Object Viewer' role to the Cloud Function's service account.
- C
Manually generate and download a key for the service account, then include it in the Cloud Function's code.
- D
Enable the Cloud Logging and Cloud Storage APIs in your project.
- E
Create a custom IAM role combining the necessary permissions and assign it to the Cloud Function's service account.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure the Cloud Function can use the necessary Cloud APIs, you need to assign appropriate predefined IAM roles ('Cloud Logging Writer' and 'Storage Object Viewer') to the Cloud Function's service account. Additionally, enabling the required APIs (Cloud Logging and Cloud Storage) ensures that the function can communicate with these services. Avoid manually managing service account keys as it introduces security risks, and predefined roles simplify role management compared to creating custom IAM roles.
- A. Correct.
Correct. The 'Cloud Logging Writer' role is required to allow the Cloud Function's service account to write logs to Cloud Logging.
- B. Correct.
Correct. The 'Storage Object Viewer' role is needed to allow the Cloud Function's service account to read data from a Cloud Storage bucket.
- C. Incorrect.
Incorrect. Manually managing service account keys is not recommended due to security risks; Google Cloud services automatically authenticate using the service account associated with the function.
- D. Correct.
Correct. The relevant APIs (Cloud Logging and Cloud Storage) must be enabled in the Google Cloud project for the function to access the necessary services.
- E. Incorrect.
Incorrect. While creating a custom IAM role is an option, it is unnecessary in this scenario because predefined roles already satisfy the requirements.