A DevOps engineer needs to deploy an event-driven Python microservice to Cloud Functions (2nd gen) that processes real-time telemetry published to a Cloud Pub/Sub topic in Google Cloud. The deployment must enforce least-privilege security by using a custom service account for function execution and Eventarc event handling. What is the correct sequence of steps to configure, deploy, and verify this serverless application using the gcloud CLI?
- 1Create the target Cloud Pub/Sub topic to serve as the event trigger source.
- 2Create a dedicated user-managed service account and assign the Eventarc Event Receiver role to grant execution permissions.
- 3Execute `gcloud functions deploy` specifying `--gen2`, `--runtime=python311`, `--trigger-topic`, and `--service-account` flags.
- 4Grant the Cloud Run Invoker role (`roles/run.invoker`) on the underlying Cloud Run service to the Eventarc trigger service account.
- 5Publish a payload message to the Cloud Pub/Sub topic and check Cloud Logging to verify end-to-end event processing.
Answer
The correct sequence begins by creating the Pub/Sub topic (item 1), creating and granting roles to the custom service account (item 2), deploying the Cloud Function 2nd gen with the appropriate gcloud flags (item 3), binding the Cloud Run Invoker IAM role to the Eventarc trigger (item 4), and finally testing and inspecting execution in Cloud Logging (item 5).
Deploying a 2nd generation Cloud Function with event triggers requires setting up dependent resources first (Pub/Sub topic and IAM execution service account), running the deployment command specifying 2nd gen architecture, ensuring the Eventarc trigger identity has Cloud Run Invoker permissions on the underlying service, and finally testing execution by publishing a message and checking Cloud Logging.
Step-by-Step Solution
Key Concept
Deploying Cloud Functions (2nd gen) with Cloud Pub/Sub triggers and IAM service accounts