Examkin

Question

Difficulty: HardDeploying Serverless Applications with Cloud Run and Cloud Functions

A cloud engineer is tasked with deploying an event-driven Go microservice using Google Cloud Functions (2nd gen). The function must execute whenever a new object is created in a Cloud Storage bucket in the project. To adhere to security best practices and ensure successful event delivery, several setup and deployment tasks must be performed in sequence. Arrange the operational steps below in the correct logical execution sequence from first to last.

  1. 1Enable the Cloud Functions, Cloud Build, Artifact Registry, Eventarc, and Cloud Run APIs in the GCP project.
  2. 2Create a dedicated user-managed service account to serve as the runtime identity for the Cloud Function.
  3. 3Grant the Pub/Sub Publisher role (`roles/pubsub.publisher`) to the Cloud Storage service account.
  4. 4Run `gcloud functions deploy` with the `--gen2` flag, passing `--trigger-event-filters="type=google.cloud.storage.object.v1.finalized"`, `--trigger-event-filters="bucket=MY_BUCKET"`, and `--service-account` pointing to the runtime service account.

Answer

The correct sequence of deployment steps is: 1) Enable the required Google Cloud APIs (Cloud Functions, Cloud Build, Artifact Registry, Eventarc, Cloud Run); 2) Create a dedicated user-managed service account for runtime execution; 3) Grant the Pub/Sub Publisher role (roles/pubsub.publisher) to the Cloud Storage system service account; 4) Execute the gcloud functions deploy command specifying the 2nd gen environment, event filters, storage bucket, and runtime service account.
The correct order follows fundamental GCP infrastructure dependency rules. First, project-level APIs (Cloud Functions, Cloud Build, Artifact Registry, Eventarc, Cloud Run) must be enabled. Second, the user-managed runtime service account must be created so it can be referenced in configurations. Third, IAM permissions permitting the Cloud Storage service account to publish events (`roles/pubsub.publisher`) must be granted so Eventarc event delivery functions properly. Finally, the function is deployed using `gcloud functions deploy --gen2` referencing the bucket event filters and runtime service account.

Step-by-Step Solution

1
Enable requisite Google Cloud APIs
Cloud Functions, Cloud Build, Artifact Registry, Eventarc, and Cloud Run APIs are active.
Cloud Functions (2nd gen) builds container images via Cloud Build, stores them in Artifact Registry, and runs them on Cloud Run while listening to events through Eventarc. Enabling these APIs is the mandatory prerequisite.
2
Provision a dedicated user-managed service account
A specific service account identity is created.
Following the principle of least privilege, a dedicated identity is needed so the function does not fall back to the default Compute Engine service account.
3
Authorize the Cloud Storage system service account
The Cloud Storage service account gains the roles/pubsub.publisher role.
Cloud Storage relies on Pub/Sub to push audit and storage events to Eventarc triggers. Without granting roles/pubsub.publisher to the Cloud Storage service account (`service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com`), event notifications will fail to deliver.
4
Deploy the 2nd gen Cloud Function
The Cloud Function is compiled, built into a container image, and deployed to Cloud Run with an active Eventarc trigger.
With APIs enabled, identities created, and event publisher permissions granted, running `gcloud functions deploy` with `--gen2` completes the build and deployment pipeline.

Key Concept

Deployment lifecycle and IAM prerequisites for Cloud Functions (2nd gen) with Cloud Storage Eventarc triggers
Estimated Time:2m 0s
Rate this question

Topics

Deploying Serverless Applications with Cloud Run and Cloud Functions