An infrastructure team needs to secure an existing Cloud Run service named `order-processor` deployed in the `us-central1` region. The service must only accept network traffic originating from internal Virtual Private Cloud (VPC) networks within the same project, and execution permissions must be granted exclusively to an automated service account named `[email protected]` following the principle of least privilege. Which TWO configuration steps should the team perform?
- Update the Cloud Run service ingress setting using `gcloud run services update order-processor --ingress=internal --region=us-central1`.Answer
- Grant the Cloud Run Invoker predefined role (`roles/run.invoker`) to `serviceAccount:[email protected]` on the `order-processor` service resource.Answer
- CGrant the primitive Editor role (`roles/editor`) to `serviceAccount:[email protected]` at the project root level.
- DRe-deploy the service workload using `gcloud functions deploy order-processor --ingress-settings=internal-only` to apply network security boundaries.
Answer
To properly secure the Cloud Run service, restrict network access to internal VPC traffic using `gcloud run services update order-processor --ingress=internal --region=us-central1`, and grant the predefined Cloud Run Invoker role (`roles/run.invoker`) to the dedicated service account on the resource.
Securing a Cloud Run service according to operational best practices requires updating ingress settings via `gcloud run services update --ingress=internal` and binding the standard predefined role `roles/run.invoker` directly to the caller service account on the resource level.
Step-by-Step Solution
Key Concept
Managing Cloud Run Access Control and Ingress Policies