Google Professional Cloud Developer Question 473
Single answerGoogle Cloud PlatformYou are developing a serverless application on Google Cloud that needs to read data from a private Cloud Storage bucket. To follow best practices for security and minimize manual credential management, how should you configure the application to authenticate and access the bucket?
- A
Create a service account, assign it the appropriate IAM role, and provide its private key to the application.
- B
Use the default App Engine or Cloud Function service account, ensuring it has the required IAM permissions for the bucket.
- C
Embed hardcoded credentials into your application code for accessing the bucket securely.
- D
Set up the application to use user credentials for authentication by prompting users to log in.
Show answer and explanation
Correct answer: B
Explanation
The best practice for using service accounts to make Cloud API calls is to leverage the default service account of Google Cloud services like App Engine or Cloud Functions. By assigning the necessary IAM permissions to the service account, the application can securely access resources without requiring manual credential management, such as distributing private keys or hardcoding credentials.
- A. Incorrect.
This approach is not recommended because it requires distributing and managing sensitive private key files, which increases security risks.
- B. Correct.
This is the correct approach. Using the default service account provided by App Engine or Cloud Functions, along with appropriate IAM permissions, ensures secure and automated authentication without manual credential management.
- C. Incorrect.
Hardcoding credentials into your application code is a security anti-pattern and should be avoided as it exposes sensitive information to potential compromise.
- D. Incorrect.
Using user credentials adds unnecessary complexity, is less secure, and does not align with service account usage for server-to-server communication.