You have two Google Cloud projects, named Project A and Project B. You need to create a Cloud Function in Project A that saves the output in a Cloud Storage bucket in Project B. You want to follow the

The correct answer is B. 1. Create a Google service account in Project A. To follow least privilege when a Cloud Function in Project A writes to a Cloud Storage bucket in Project B, you should create a service account in Project A (where the function runs) and grant that service account only the 'Storage Object Creator' (or similar minimal) role on the

Managing Application Security

Question

You have two Google Cloud projects, named Project A and Project B. You need to create a Cloud Function in Project A that saves the output in a Cloud Storage bucket in Project B. You want to follow the principle of least privilege. What should you do?

Options

A
1. Create a Google service account in Project B.
B
1. Create a Google service account in Project A
C
1. Determine the default App Engine service account
D
1. Determine the default App Engine service account

How the community answered

(36 responses)

A
14% (5)
B
75% (27)
C
6% (2)
D
6% (2)

Explanation

To follow least privilege when a Cloud Function in Project A writes to a Cloud Storage bucket in Project B, you should create a service account in Project A (where the function runs) and grant that service account only the 'Storage Object Creator' (or similar minimal) role on the specific bucket in Project B. Creating the service account in the project that owns the workload (Project A) is correct because the Cloud Function assumes that identity. Choice A creates the service account in the wrong project. Choices C and D both use the default App Engine service account, which has broad project-level permissions and violates least privilege.

Topics

#Cloud Functions#Service Accounts#IAM#Least Privilege

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-DEVELOPER Practice