Examkin

Question

Difficulty: MediumManaging Cloud Run Resources

You need to configure Cloud Pub/Sub to trigger a Cloud Run microservice named `event-processor` using a secure push subscription. The Cloud Run service must reject any direct unauthenticated HTTP traffic from the public internet. Arrange the operational steps in the correct order to set up this secure integration.

  1. 1Create a dedicated service account to serve as the Cloud Pub/Sub push subscription identity.
  2. 2Deploy or update the `event-processor` Cloud Run service using the `--no-allow-unauthenticated` flag.
  3. 3Grant the `roles/run.invoker` role on the `event-processor` Cloud Run service to the newly created service account.
  4. 4Create the Cloud Pub/Sub push subscription specifying the Cloud Run service URL and attaching the service account.

Answer

The correct sequence starts by creating a dedicated service account for the Pub/Sub push identity, deploying the target Cloud Run service with unauthenticated access disabled, binding the `roles/run.invoker` role on the Cloud Run service to the service account, and finally creating the Pub/Sub push subscription configured with the service endpoint and identity.
To build a secure push integration between Pub/Sub and Cloud Run, the identity components and service perimeter must be established in logical order: first create the principal (service account), then provision the resource and endpoint (`--no-allow-unauthenticated`), assign authorization (`roles/run.invoker`), and lastly create the integration object (Pub/Sub push subscription).

Step-by-Step Solution

1
Create the service account identity using `gcloud iam service-accounts create`.
A service account email address is provisioned to represent the Pub/Sub push mechanism.
You need a dedicated principal identity to receive invoker permissions and sign authentication tokens.
2
Deploy the Cloud Run service with `gcloud run deploy event-processor --no-allow-unauthenticated`.
The Cloud Run service is instantiated with access restricted to authenticated invokers, returning a HTTPS service URL.
Enforcing private access ensures public requests are blocked and provides the target endpoint URL.
3
Add the IAM policy binding to the Cloud Run service using `gcloud run services add-iam-policy-binding event-processor --member=serviceAccount:... --role=roles/run.invoker`.
The push service account is authorized to invoke the private Cloud Run service.
Pub/Sub authentication relies on the service account possessing the specific `roles/run.invoker` predefined role.
4
Create the push subscription using `gcloud pubsub subscriptions create --topic=... --push-endpoint=... --push-auth-service-account=...`.
Pub/Sub automatically attaches OAuth/OIDC tokens signed by the service account when pushing messages to Cloud Run.
This final step connects the message queue to the verified, secure endpoint.

Key Concept

Securing Cloud Run Services with Pub/Sub Push Authentication and IAM Roles
Rate this question

Topics

Managing Cloud Run Resources

More questions from this topic