Your team is creating a serverless web application on Cloud Run. The application needs to access images stored in a private Cloud Storage bucket. You want to give the application Identity and Access…

Question

Options

• AEnforce signed URLs for the desired bucket. Grant the Storage Object Viewer IAM role on the
• BEnforce public access prevention for the desired bucket. Grant the Storage Object Viewer IAM
• CEnforce signed URLs for the desired bucket. Create and update the Cloud Run service to use a
• DEnforce public access prevention for the desired bucket. Create and update the Cloud Run

• A
  16% (9)
• B
  9% (5)
• C
  4% (2)
• D
  71% (39)

Explanation

The Google-recommended best practice for service-to-service authentication is to use a dedicated service account with the minimum required IAM permissions. Enforcing public access prevention on the bucket ensures the bucket can never be made publicly accessible, even by accident. Creating a dedicated service account for the Cloud Run service and granting it the Storage Object Viewer role on the bucket follows the principle of least privilege. Signed URLs (options A and C) are meant for granting temporary, time-limited access to external users or unauthenticated clients - not for internal service-to-service communication where IAM is the proper mechanism.

No community discussion yet for this question.