A DevOps team is deploying an event-driven Python microservice as a Cloud Functions (2nd gen) service to process file uploads arriving in a Cloud Storage bucket. The microservice must execute using a dedicated custom service account under the principle of least privilege while interacting with Cloud Storage and Firestore. Which TWO actions must the team perform to successfully deploy and configure this serverless workload?
- Pass the custom service account email address using the `--service-account` flag when executing the `gcloud functions deploy` command.Answer
- Grant the `roles/eventarc.eventReceiver` IAM role to the runtime service account to allow it to receive trigger events.Answer
- CAssign the primitive `roles/editor` role to the default Compute Engine service account to streamline Cloud Storage and Firestore access.
- DEnable the Cloud Functions and Eventarc APIs at the Google Cloud Organization resource node rather than within the individual target project.
Answer
The team must pass the custom service account email via the `--service-account` flag during deployment and grant the `roles/eventarc.eventReceiver` IAM role to the runtime service account.
Deploying a 2nd gen Cloud Function with Cloud Storage triggers requires specifying the custom service account via `--service-account` during `gcloud functions deploy` and granting `roles/eventarc.eventReceiver` to that service account so it can receive incoming trigger events.
Step-by-Step Solution
Key Concept
Deploying 2nd gen Cloud Functions with custom service accounts and Eventarc triggers