Exam Professional Cloud Developer topic 1 question 256 discussion

I will go for D. Option C sounds good, but as the service account only have the Storage Object Viewer role it can't generate signed URLs for files from bucket because need storage.object.get, then it's incorrect.

This approach allows you to secure your Cloud Storage bucket by enforcing public access prevention, which prevents data from being accidentally shared with the public. By creating and updating the Cloud Run service to use a user-managed service account, you can ensure that only this service has access to the bucket. Granting the Storage Object Viewer IAM role on the bucket to the service account allows the service to read objects stored in the bucket.

D is right. 1) Create service account with role of viewing the objects under Cloud storage bucket 2) Create policies to prevent public access to the bucket. A and C: Neither of these are close to the solution. B is somewhat closer but the statement "Grant the Storage Object Viewer IAM role on the bucket to the Compute Engine default service account" is wrong since we need to create service account for the application and not for VM.

most secure and efficient way to give the application Identity and Access Management (IAM) permission to access the images in the bucket.