A cloud engineer is configuring operational access and network controls for an existing Cloud Run service named `inventory-service`. The service must fulfill two operational requirements: first, inbound network traffic must be restricted so that it accepts requests only from internal VPC networks and Google Cloud HTTP(S) Load Balancing; second, members of the developer group `[email protected]` must be granted administrative permission to deploy new container revisions and modify traffic splits without receiving broad administrative access across the entire project.
Which TWO actions should the cloud engineer execute? (Select TWO.)
- Run `gcloud run services update inventory-service --ingress=internal-and-cloud-load-balancing` to configure the ingress settings.Answer
- Grant the `roles/run.developer` IAM role to `[email protected]` on the Cloud Run service resource.Answer
- CGrant the primitive `roles/editor` role to `[email protected]` at the GCP project level.
- DExecute `gcloud functions deploy inventory-service --ingress-settings=internal-only` to restrict service ingress.
Answer
The correct operational steps are to update the Cloud Run service ingress setting using `gcloud run services update inventory-service --ingress=internal-and-cloud-load-balancing` and to grant the `roles/run.developer` role to `[email protected]` on the resource.
Configuring Cloud Run ingress with `gcloud run services update inventory-service --ingress=internal-and-cloud-load-balancing` restricts traffic to internal VPC callers and external load balancers. Concurrently, assigning the predefined `roles/run.developer` role to the developer group provides the specific permissions required to deploy revisions and manage traffic split percentages without violating the principle of least privilege.
Step-by-Step Solution
Key Concept
Cloud Run Resource Operational Management (Ingress Controls and Least Privilege IAM)