An organization is deploying an event-driven Python microservice to Cloud Functions (2nd gen) in the `us-central1` region to process medical image uploads from a Cloud Storage bucket named `medical-records-archive`. Security policy dictates that the function must run using a non-default custom service account (`[email protected]`) enforcing the principle of least privilege, and must be triggered whenever new objects are finalized in the storage bucket. Which TWO configuration steps or deployment flags must be used to achieve this setup successfully?
- Include the `[email protected]` flag when executing `gcloud functions deploy`.Cevap
- BGrant the primitive `roles/owner` role to `[email protected]` at the organization level so it can access Cloud Storage triggers.
- Grant the `roles/storage.objectViewer` role on the `medical-records-archive` bucket to `[email protected]`.Cevap
- DDeploy the application to Cloud Run using `gcloud run deploy` because Cloud Functions (2nd gen) does not support Cloud Storage Eventarc triggers.
Cevap
The deployment must specify the custom service account using the service account deployment flag and grant that service account the Storage Object Viewer role on the target bucket.
Deploying 2nd gen Cloud Functions with custom execution identities requires explicitly attaching the service account during deployment via the service account flag and granting that service account specific resource access roles, such as reading objects from the Cloud Storage bucket.
Adım Adım Çözüm
Anahtar Kavram
Cloud Functions (2nd gen) identity binding and IAM least privilege configuration for Cloud Storage event processing