1Z0-997-25 Question 21
Select 2Your organization has developed a new microservice using Oracle Functions to process user data. You want to expose this microservice externally through an API Gateway for secure and efficient API management. Additionally, the function must access Oracle Object Storage to fetch and store files without embedding any credentials in code. Which TWO actions should you take to achieve these requirements?
- A
A. Create a route in the API Gateway with the 'Function' backend type referencing the function's OCID, and configure an IAM policy allowing the API Gateway to invoke the function.
- B
B. Configure Resource Principals for the function to securely access Oracle Object Storage without configuring any credentials in the code or environment variables.
- C
C. Deploy the function behind a public load balancer with its own public IP address, then reference the function's URL directly in the API Gateway.
- D
D. Manually embed the Oracle Object Storage credentials into the function's environment variables for authentication when accessing files.
Show answer and explanation
Correct answers: A, B
Explanation
In Oracle Cloud Infrastructure, the recommended way to expose a function externally is via an API Gateway route configured with the 'Function' backend. This approach ensures secure and efficient API management. For accessing other OCI services such as Object Storage, Resource Principals allow the function to securely obtain temporary credentials at runtime, eliminating the need to store credentials. Refer to Oracle� documentation on 'Using API Gateway with Oracle Functions' and 'Resource Principals for Oracle Functions' for more details on these best practices.
- A. Correct.
Option A is correct. To expose your function through the API Gateway, you must create a route with the 'Function' backend. You also need an IAM policy granting the API Gateway the permission to call ("invoke") the function. This ensures that external requests go through the gateway rather than directly invoking the function.
- B. Correct.
Option B is correct. Resource Principals is a best practice for securing access to other OCI services such as Object Storage. This approach allows the function to assume a dynamic identity, eliminating the need to embed credentials in code or manage them manually.
- C. Incorrect.
Option C is incorrect. Oracle Functions do not rely on a public IP address or a load balancer to be invoked. You integrate them with the API Gateway by using the gateway� route configuration that references the function� OCID. Deploying behind a public load balancer would not be the recommended approach for a serverless function, as it introduces unnecessary complexity and potential security issues.
- D. Incorrect.
Option D is incorrect. Manually embedding credentials is not recommended in OCI because it poses security risks. Resource Principals provide a more secure, managed way to grant the necessary permissions without exposing sensitive credentials.