Examkin

Soru

Zorluk: ZorDeploying Serverless Applications with Cloud Run and Cloud Functions

A Cloud Engineer is tasked with deploying a secure Python microservice to Google Cloud Run using the gcloud CLI. The deployment must adhere to least-privilege security practices by using a custom execution service account, building and storing the container image in Artifact Registry, blocking public unauthenticated HTTP access, and granting invocation permissions to a specific caller service account. Arrange the following deployment and configuration steps in the correct chronological sequence from first to last.

  1. 1Create a dedicated custom IAM service account in the GCP project to serve as the Cloud Run service execution identity.
  2. 2Package the application source code into a container image and push it to Artifact Registry using `gcloud builds submit`.
  3. 3Deploy the container image to Cloud Run using `gcloud run deploy` with the `--service-account` flag pointing to the custom runtime service account and `--no-allow-unauthenticated` flag set.
  4. 4Grant the Cloud Run Invoker role (`roles/run.invoker`) on the deployed Cloud Run service to the caller principal.

Cevap

The correct sequence is: 1) Create the dedicated custom IAM service account, 2) Build and push the container image to Artifact Registry using gcloud builds submit, 3) Deploy the container image to Cloud Run specifying the custom service account and disabling unauthenticated access, and 4) Grant the Cloud Run Invoker role (roles/run.invoker) on the deployed service to the authorized caller principal.
The correct order follows the lifecycle dependencies of GCP resource creation and deployment. First, the runtime execution identity (service account) must be created so it is available for reference. Second, the container image must be built and pushed to Artifact Registry using Cloud Build. Third, Cloud Run deploys the image while attaching the runtime service account and blocking unauthenticated access. Finally, after the service resource is deployed, resource-level IAM policy bindings (Cloud Run Invoker) can be added to allow access to the designated caller.

Adım Adım Çözüm

1
Create the custom execution service account
An IAM service account principal is created in Google Cloud Identity/IAM.
Cloud Run deployment flags require an existing service account email address when binding execution identity during service creation.
2
Build and push the container image to Artifact Registry
The container artifact URI is generated and ready for deployment.
Cloud Run requires a valid container image location in Container Registry or Artifact Registry to instantiate revisions.
3
Execute gcloud run deploy with security flags
The Cloud Run service resource is instantiated with unauthenticated access blocked.
Deploying the service instantiates the resource and configures runtime settings like the execution service account and ingress authentication requirement.
4
Bind roles/run.invoker to the caller principal on the Cloud Run service
The caller principal is granted permission to invoke the private HTTP endpoint.
IAM policy bindings targeting specific Cloud Run service resources require the service to already exist in the project.

Anahtar Kavram

Deploying Cloud Run services with custom execution identities, Artifact Registry builds, and resource-level IAM invoker permissions
Bu soruyu puanla

Konular

Deploying Serverless Applications with Cloud Run and Cloud Functions