Google Professional Cloud Developer Question 474
Single answerGoogle Cloud PlatformYou are developing a serverless application hosted on Google Cloud Functions. The function needs to access a private Cloud Storage bucket to read and write files. How should you configure the function to securely access the bucket?
- A
Assign the Cloud Functions service account the 'Storage Admin' role and use its credentials to access the bucket.
- B
Create a new service account, assign it the 'Storage Object Admin' role, and configure your Cloud Function to use this service account.
- C
Generate an API key for the Cloud Storage bucket and pass it to the Cloud Function using an environment variable.
- D
Use the default App Engine service account to access the bucket without additional configuration.
Show answer and explanation
Correct answer: B
Explanation
The best practice for securely accessing Google Cloud resources like Cloud Storage is to use a dedicated service account with only the necessary permissions. In this case, creating a service account with the 'Storage Object Admin' role for the Cloud Function ensures secure and minimal access. Using API keys or over-permissioned roles goes against security best practices.
- A. Incorrect.
This option is not recommended because assigning the 'Storage Admin' role gives excessive permissions. Following the principle of least privilege, you should only assign the permissions necessary for the task.
- B. Correct.
This is the correct answer because creating a dedicated service account with the 'Storage Object Admin' role ensures the function has only the necessary permissions to read and write to the bucket. Associating the service account with the Cloud Function securely scopes the permissions to the function's execution.
- C. Incorrect.
Using an API key is not a secure method for accessing resources in Cloud Storage, as it lacks proper role-based access control and can easily be exposed.
- D. Incorrect.
The default App Engine service account is not associated with Cloud Functions and may not have the required permissions to access the Cloud Storage bucket without additional configuration.