A smart grid energy utility completed a rapid migration of its customer metering infrastructure to Google Cloud. A post-migration technical debt assessment identified two key architecture issues: simple stateless HTTP ingestion microservices are currently running on self-managed Compute Engine virtual machines requiring manual OS patching and fixed compute costs, and sensitive meter telemetry stored in Cloud Storage buckets remains vulnerable to data exfiltration by authorized identity credentials operating outside the enterprise network perimeter. Which TWO architectural mitigations should the Cloud Architect recommend to resolve this technical debt?
- Refactor the stateless HTTP ingestion microservices to deploy on Cloud Run to eliminate server maintenance and enable automatic scaling to zero.Cevap
- BMigrate the stateless HTTP microservices to a multi-zone Google Kubernetes Engine (GKE) cluster with autoscaling node pools.
- Configure VPC Service Controls around the Cloud Storage resources storing telemetry data to establish a secure perimeter against exfiltration.Cevap
- DRely exclusively on Cloud IAM predefined bucket-level roles to prevent telemetry data exfiltration.
- EGrant the ingestion service accounts the Project Owner primitive role to simplify permission management across all resources.
Cevap
The optimal mitigations are refactoring the stateless HTTP microservices to Cloud Run and establishing a VPC Service Controls perimeter around Cloud Storage.
Migrating simple stateless HTTP ingestion microservices to Cloud Run eliminates server patching and reduces baseline costs by scaling to zero when idle. Establishing VPC Service Controls creates a security perimeter around Cloud Storage to prevent data exfiltration, even if authorized IAM credentials are used outside the perimeter.
Adım Adım Çözüm
Anahtar Kavram
Mitigating operational and security technical debt using Cloud Run and VPC Service Controls