A DevOps engineer needs to deploy a Cloud Functions (2nd gen) service from local source code to handle background file processing triggered by a Cloud Storage bucket event. The deployment must adhere to the principle of least privilege using a custom service account. What is the correct sequence of steps to perform this deployment?
- 1Create a dedicated custom IAM service account for the function.
- 2Grant the required IAM roles to the custom service account.
- 3Run `gcloud functions deploy` specifying the Cloud Storage trigger and the `--service-account` flag.
- 4Upload a test file to the Cloud Storage bucket to verify event delivery and function execution.
Answer
The correct sequence of steps is: 1) Create a dedicated custom IAM service account for the function. 2) Grant the required IAM roles to the custom service account. 3) Run `gcloud functions deploy` specifying the Cloud Storage trigger and the `--service-account` flag. 4) Upload a test file to the Cloud Storage bucket to verify event delivery and function execution.
Deploying an event-driven Cloud Function following GCP security best practices requires creating the custom service account first. Next, IAM roles must be granted to that service account so it possesses the appropriate execution permissions. Third, executing `gcloud functions deploy` attaches the configured service account and sets up the Cloud Storage trigger. Finally, uploading a file to the bucket tests and verifies that the live function executes as expected.
Step-by-Step Solution
Key Concept
Order of operations for deploying event-driven Cloud Functions with custom service account identities