Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ69

Integrating applications with Google Cloud services

Your team develops services that run on Google Cloud. You need to build a data-processing service using Cloud Functions. The data that the function must process is sensitive. You need to make sure invocations can occur only from authorized services and follow Google-recommended best practices for securing functions. What should you do?

  • A Enable Identity-Aware Proxy in your project. Secure function access using its permissions.
  • B Create a service account with the Cloud Functions Viewer role. Use that service account to invoke the function.
  • C Create a service account with the Cloud Functions Invoker role. Use that service account to invoke the function.
  • D Create an OAuth 2.0 client ID for your calling service in the same project as the function you want to secure. Use those credentials to invoke the function.
Explanation

Use a dedicated service account as the calling service’s identity and grant it the Cloud Functions Invoker role (roles/cloudfunctions.invoker). That role authorizes invocation of a restricted 1st-generation HTTP function; the calling service authenticates as that service account. The Viewer role provides read-only access and does not authorize invocation, while an OAuth client ID does not itself grant IAM permission to invoke the function.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!