An organization deployed a backend microservice named `analytics-collector` on Cloud Run in the `us-central1` region. You need to ensure that only a dedicated service account, `[email protected]`, is authorized to invoke this Cloud Run service while preventing all unauthenticated public access. Which `gcloud` command should you execute to grant the necessary access using the principle of least privilege?
- gcloud run services add-iam-policy-binding analytics-collector --region=us-central1 --member="serviceAccount:[email protected]" --role="roles/run.invoker"Answer
- Bgcloud run services add-iam-policy-binding analytics-collector --region=us-central1 --member="serviceAccount:[email protected]" --role="roles/editor"
- Cgcloud functions add-iam-policy-binding analytics-collector --region=us-central1 --member="serviceAccount:[email protected]" --role="roles/cloudfunctions.invoker"
- Dgcloud run services update-traffic analytics-collector --region=us-central1 --to-revisions=LATEST=100
Answer
Execute `gcloud run services add-iam-policy-binding analytics-collector --region=us-central1 --member="serviceAccount:[email protected]" --role="roles/run.invoker"` to grant explicit invocation permissions to the service account adhering to least privilege.
The correct command uses `gcloud run services add-iam-policy-binding` to bind the specific service account member to the predefined `roles/run.invoker` role on the Cloud Run service. This restricts invocation access strictly to that service account while enforcing the principle of least privilege.
Step-by-Step Solution
Key Concept
Cloud Run IAM Access Control & Least Privilege