A Cloud Engineer is tasked with deploying a containerized microservice to Google Cloud Run from local source code while enforcing security best practices and least privilege. Place the following deployment steps in the correct chronological order from first to last.
- 1Enable the Cloud Run API (`run.googleapis.com`) and Cloud Build API (`cloudbuild.googleapis.com`) in the target project.
- 2Create a dedicated user-managed service account and grant it only the minimal IAM roles needed for the runtime workload.
- 3Submit the application source code to Cloud Build using `gcloud builds submit` to containerize and store the artifact in Artifact Registry.
- 4Execute `gcloud run deploy` specifying the Artifact Registry image path and attaching the custom service account using the `--service-account` flag.
Answer
The correct deployment sequence is: 1) Enable the Cloud Run and Cloud Build APIs, 2) Create a dedicated user-managed service account with minimal IAM roles, 3) Build and push the container image to Artifact Registry using gcloud builds submit, 4) Deploy the image to Cloud Run attaching the custom service account.
Deploying a containerized application to Cloud Run from source code follows a dependency-driven workflow. First, the required API endpoints (Cloud Run and Cloud Build) must be enabled in the project. Second, a custom service account with least-privilege permissions must be created so it can be assigned during service instantiation. Third, the container image must be built and stored in Artifact Registry using `gcloud builds submit`. Finally, `gcloud run deploy` is executed to launch the revision using the container image and custom service account.
Step-by-Step Solution
Key Concept
Cloud Run Source-to-Deployment Pipeline & Least-Privilege Identity Management