Your company pushes batches of sensitive transaction data from its application server VMs to Cloud Pub/Sub for processing and storage.
What is the Google- recommended way for your application to authenticate to the required Google Cloud services?
Click on the arrows to vote for the correct answer
A. B. C. D.A.
For authenticating to Google Cloud services, Google recommends using service accounts. A service account is a special type of Google account that belongs to an application or a virtual machine (VM) rather than to an individual user.
In this scenario, the application server VMs need to authenticate to Cloud Pub/Sub for processing and storage of sensitive transaction data. Therefore, the recommended approach is to ensure that VM service accounts are granted the appropriate Cloud Pub/Sub IAM roles. This approach provides secure authentication and authorization for accessing Cloud Pub/Sub services.
Option A is the correct answer, and the other options are not recommended because:
B. This option suggests that VM service accounts should not have access to Cloud Pub/Sub, and instead, VM access scopes should be used to grant the appropriate Cloud Pub/Sub IAM roles. However, this approach is not recommended because VM access scopes are not as secure as using service accounts.
C. This option suggests generating an OAuth2 access token for accessing Cloud Pub/Sub, encrypting it, and storing it in Cloud Storage for access from each VM. However, this approach is not recommended because it requires managing access tokens and encryption keys, which can be complex and error-prone.
D. This option suggests creating a gateway to Cloud Pub/Sub using a Cloud Function and granting the Cloud Function service account the appropriate Cloud Pub/Sub IAM roles. However, this approach is not recommended because it adds unnecessary complexity and introduces an additional component that needs to be managed and secured.
In summary, the recommended approach for authenticating to Google Cloud services is to use service accounts, and in this scenario, the application server VMs should be granted the appropriate Cloud Pub/Sub IAM roles.