Examkin

Soru

Zorluk: ZorEnabling and Managing Cloud Service APIs

Your organization uses a central CI/CD project named `proj-pipeline` hosting a deployment service account. This service account is configured to provision microservices inside a dedicated workload project named `proj-microservices-prod`. During the initial deployment execution, the pipeline fails with an error indicating that the Cloud Run API (`run.googleapis.com`) is not enabled. Following Google Cloud security and operational best practices, which action should be performed to resolve this issue?

  1. Enable the `run.googleapis.com` API inside `proj-microservices-prod` using an identity granted the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on `proj-microservices-prod`.Cevap
  2. B
    Enable the `run.googleapis.com` API inside `proj-pipeline` using an identity granted the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on `proj-pipeline`.
  3. C
    Grant the deployment service account the primitive Editor (`roles/editor`) role at the Organization level so that API enablement automatically inherits down to `proj-microservices-prod`.
  4. D
    Submit a Cloud Quota increase request for Cloud Run API requests per minute under `proj-microservices-prod` to automatically enable the service.

Cevap

Enable the `run.googleapis.com` API inside `proj-microservices-prod` using an identity granted the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on `proj-microservices-prod`.
In Google Cloud, API enablement is scoped to individual projects where resources reside. To deploy Cloud Run services in `proj-microservices-prod`, the `run.googleapis.com` API must be enabled on `proj-microservices-prod`. Using the predefined Service Usage Admin role adheres to the principle of least privilege.

Adım Adım Çözüm

1
Identify the resource target project
Resources (Cloud Run services) are being created inside `proj-microservices-prod`.
Google Cloud service APIs must be enabled on the target project hosting the resources, not the project initiating the deployment request.
2
Select the appropriate IAM permission role following least privilege
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides the `serviceusage.services.enable` permission.
Predefined roles specific to Service Usage should be preferred over broad primitive roles like Owner or Editor.
3
Enable the API using gcloud CLI or Cloud Console
Execute `gcloud services enable run.googleapis.com --project=proj-microservices-prod`.
Enabling the service API allows resource allocation and API calls targeting that service in `proj-microservices-prod`.

Anahtar Kavram

Enabling and Managing Cloud Service APIs
Bu soruyu puanla

Konular

Enabling and Managing Cloud Service APIs

Bu konudan daha fazla soru