A cloud engineer needs to deploy a Python microservice as a Cloud Functions (2nd gen) function triggered by messages published to a Cloud Pub/Sub topic. The deployment must adhere to least-privilege security by utilizing a dedicated user-managed service account instead of the default compute service account. Arrange the following deployment tasks in the correct chronological order from start to finish.
- 1Enable the Cloud Functions, Cloud Build, Eventarc, and Pub/Sub APIs in the GCP project.
- 2Create a custom user-managed service account to serve as the runtime identity for the function.
- 3Grant the required granular IAM roles to the custom service account for resource access.
- 4Run `gcloud functions deploy` specifying `--gen2`, `--trigger-topic`, and `--service-account` flags.
- 5Publish a message to the target Cloud Pub/Sub topic using `gcloud pubsub topics publish` to test execution.
Answer
The correct sequence starts with enabling required GCP service APIs, followed by creating the custom service account, binding the necessary IAM roles to that service account, executing the `gcloud functions deploy` command with the Pub/Sub trigger and service account flags, and finally publishing a test message to the Pub/Sub topic to verify execution.
The correct order follows the standard Cloud GCP resource dependency lifecycle: baseline API enablement must precede resource creation. Next, the execution identity (service account) must be created and granted necessary permissions prior to deployment so that the runtime environment is properly secured. The `gcloud functions deploy` command attaches the custom service account and provisions the Eventarc Pub/Sub trigger. Finally, triggering a test Pub/Sub message verifies that the deployed architecture functions end-to-end.
Step-by-Step Solution
Key Concept
Deploying 2nd gen Cloud Functions with Pub/Sub Event Triggers and Custom Service Accounts