Examkin

Question

Difficulty: EasyProgrammatic GCP Interaction via SDK, CLI, and APIs

A developer is building a Node.js microservice deployed to Cloud Run that needs to programmatically publish telemetry messages to a Google Cloud Pub/Sub topic. Which authentication approach should the developer use to allow the Google Cloud Client Library to interact with Pub/Sub securely?

  1. Rely on Application Default Credentials (ADC) by letting the client library automatically retrieve identity tokens from the Cloud Run metadata server.Answer
  2. B
    Generate a service account JSON key file, embed it directly inside the application container image, and load it into the client library.
  3. C
    Grant the primitive Owner role to the Cloud Run default service account so that API calls bypass IAM authorization restrictions.
  4. D
    Generate a service account key using Terraform and commit the unencrypted Terraform state file to the application code repository for runtime credential fetching.

Answer

Rely on Application Default Credentials (ADC) by letting the client library automatically retrieve identity tokens from the Cloud Run metadata server.
The correct option uses Application Default Credentials (ADC), which allows Google Cloud Client Libraries to automatically fetch short-lived access tokens directly from the runtime container's metadata server without embedding static keys.

Step-by-Step Solution

1
Identify the authentication requirement for GCP client libraries running on managed compute environments like Cloud Run.
GCP client libraries naturally look for credentials using the Application Default Credentials (ADC) strategy.
ADC abstracts credential lookup across different execution environments.
2
Evaluate the security mechanism on Cloud Run.
Cloud Run attaches a designated identity (service account) to the container instance via the internal metadata server.
This allows applications to obtain short-lived OAuth 2.0 access tokens programmatically without managing service account keys.

Key Concept

Application Default Credentials (ADC) and Metadata Server Authentication
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic