Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ145

Integrating applications with Google Cloud services

You have a Python application running in production on Cloud Run. The application must read and write data stored in a Cloud Storage bucket within the same project. You want to grant the application access according to the principle of least privilege. What should you do?

  • A Create a user-managed service account with a custom Identity and Access Management (IAM) role.
  • B Create a user-managed service account with the Storage Admin Identity and Access Management (IAM) role.
  • C Create a user-managed service account with the Project Editor Identity and Access Management (IAM) role.
  • D Use the default service account linked to the Cloud Run revision in production.
Explanation

A dedicated user-managed service account lets the Cloud Run workload have only the permissions required to read and write the relevant Cloud Storage data. A custom IAM role can be limited to those necessary permissions and granted at the bucket scope. Storage Admin and Project Editor provide broader administrative access than needed, while the default service account is not the recommended dedicated identity for a minimally permissioned production workload.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!