You built an application on your development laptop that uses Google Cloud services.
Your application uses Application Default Credentials for authentication and works fine on your development laptop.
You want to migrate this application to a Compute Engine virtual machine (VM) and set up authentication using Google- recommended practices and minimal changes.
What should you do?
Click on the arrows to vote for the correct answer
A. B. C. D.B.
https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instancesTo migrate an application that uses Google Cloud services from a development laptop to a Compute Engine virtual machine (VM) and set up authentication using Google-recommended practices and minimal changes, the following steps should be taken:
B. Create a service account with appropriate access for Google services, and configure the application to use this account.
This is the correct answer. By creating a service account, you can assign appropriate permissions for Google services to the service account and configure your application to use it. This way, your application can access Google services securely without having to store any user credentials or access tokens on the VM.
Here are the reasons why the other options are not the best choices:
A. Assign appropriate access for Google services to the service account used by the Compute Engine VM.
This option is not recommended because you should not use the default service account for Compute Engine VMs. The default service account has overly broad permissions and is shared across all VMs in a project, which makes it a security risk. Instead, you should create a new service account and assign it the minimum necessary permissions.
C. Store credentials for service accounts with appropriate access for Google services in a config file, and deploy this config file with your application.
This option is not recommended because storing credentials in a config file can be a security risk if the file is not properly secured. Furthermore, this option requires you to manage and update the credentials manually, which can be error-prone and time-consuming.
D. Store credentials for your user account with appropriate access for Google services in a config file, and deploy this config file with your application.
This option is not recommended because it requires you to store your user credentials on the VM, which can be a security risk if the VM is compromised. Additionally, user credentials should not be used for application authentication because they can be revoked or expire without warning, which can cause downtime for your application.
In conclusion, creating a service account and configuring your application to use it is the recommended approach for migrating an application that uses Google Cloud services to a Compute Engine VM.