Examkin

Soru

Zorluk: OrtaManaging Cloud Run Resources

An organization deployed a backend microservice named `analytics-collector` on Cloud Run in the `us-central1` region. You need to ensure that only a dedicated service account, `[email protected]`, is authorized to invoke this Cloud Run service while preventing all unauthenticated public access. Which `gcloud` command should you execute to grant the necessary access using the principle of least privilege?

  1. gcloud run services add-iam-policy-binding analytics-collector --region=us-central1 --member="serviceAccount:[email protected]" --role="roles/run.invoker"Cevap
  2. B
    gcloud run services add-iam-policy-binding analytics-collector --region=us-central1 --member="serviceAccount:[email protected]" --role="roles/editor"
  3. C
    gcloud functions add-iam-policy-binding analytics-collector --region=us-central1 --member="serviceAccount:[email protected]" --role="roles/cloudfunctions.invoker"
  4. D
    gcloud run services update-traffic analytics-collector --region=us-central1 --to-revisions=LATEST=100

Cevap

Execute `gcloud run services add-iam-policy-binding analytics-collector --region=us-central1 --member="serviceAccount:[email protected]" --role="roles/run.invoker"` to grant explicit invocation permissions to the service account adhering to least privilege.
The correct command uses `gcloud run services add-iam-policy-binding` to bind the specific service account member to the predefined `roles/run.invoker` role on the Cloud Run service. This restricts invocation access strictly to that service account while enforcing the principle of least privilege.

Adım Adım Çözüm

1
Identify the resource type and operational requirement.
The resource is a Cloud Run service (`analytics-collector`) requiring invocation authorization for a specific service account.
Cloud Run services require the Cloud Run Invoker role (`roles/run.invoker`) for authorized HTTP requests when unauthenticated access is disabled.
2
Select the appropriate gcloud command group and IAM role following least privilege.
Use `gcloud run services add-iam-policy-binding` with `--role="roles/run.invoker"`.
Predefined roles like `roles/run.invoker` grant exact calling permissions without exposing management permissions provided by primitive roles like Editor.

Anahtar Kavram

Cloud Run IAM Access Control & Least Privilege
Bu soruyu puanla

Konular

Managing Cloud Run Resources

Bu konudan daha fazla soru