Examkin

Soru

Zorluk: OrtaManaging Cloud Run Resources

A cloud engineer needs to grant a specific service account named `[email protected]` permission to invoke an existing internal Cloud Run service named `payment-processor`. Following Google Cloud best practices and the principle of least privilege, which `gcloud` command should the engineer execute?

  1. gcloud run services add-iam-policy-binding payment-processor --member="serviceAccount:[email protected]" --role="roles/run.invoker"Cevap
  2. B
    gcloud run services add-iam-policy-binding payment-processor --member="serviceAccount:[email protected]" --role="roles/editor"
  3. C
    gcloud functions add-iam-policy-binding payment-processor --member="serviceAccount:[email protected]" --role="roles/run.invoker"
  4. D
    gcloud run services update-traffic payment-processor --to-revisions=LATEST=100

Cevap

Execute `gcloud run services add-iam-policy-binding payment-processor --member="serviceAccount:[email protected]" --role="roles/run.invoker"` to grant the specific Cloud Run Invoker role to the service account.
The correct command uses `gcloud run services add-iam-policy-binding` with the target Cloud Run service name (`payment-processor`), specifies the full service account identifier in the `--member` flag, and assigns the predefined least-privilege role `roles/run.invoker`.

Adım Adım Çözüm

1
Identify the target resource and required operational task.
The target is an existing Cloud Run service named `payment-processor`, and the task is to grant invocation access.
Cloud Run resource management requires using `gcloud run services` CLI subcommands.
2
Determine the least-privilege IAM role required for invoking Cloud Run services.
The required predefined role is Cloud Run Invoker (`roles/run.invoker`).
Primitive roles like Editor or Owner provide excessive administrative rights across the resource.
3
Construct the exact IAM policy binding command.
Run `gcloud run services add-iam-policy-binding payment-processor --member="serviceAccount:[email protected]" --role="roles/run.invoker"`.
This command binds the specific role to the specified member on the target service resource.

Anahtar Kavram

Cloud Run Service Access Management using IAM Policy Bindings
Bu soruyu puanla

Konular

Managing Cloud Run Resources

Bu konudan daha fazla soru