Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a new service account, grant the Cloud Run Deployer role, and export a key file to the instance

  Why it's wrong here

  Exporting a service account key file to the instance creates a long-lived credential that must be stored, rotated, and protected; if the instance is compromised, the key can be exfiltrated and used outside the instance. Attaching the service account directly to the instance via the metadata server avoids this risk, so while this option technically works, it violates the security best practice of avoiding service account keys in favor of instance-attached identities.

• ✓

  Grant the Cloud Run Deployer role to the Compute Engine default service account

  Why this is correct

  The Compute Engine default service account is automatically attached to the instance and is authenticated through the instance metadata server, so no key file is needed. Granting it the roles/run.deployer role gives the pipeline permission to create and update Cloud Run services that run in the same project, while adhering to the principle of least privilege and avoiding long-lived credentials. This is the recommended pattern for workloads running on Compute Engine that need to deploy Cloud Run resources.

• ✗

  Use the Cloud Run service agent with the roles/run.serviceAgent role

  Why it's wrong here

  The Cloud Run service agent (with roles/run.serviceAgent) is a Google-managed identity used by the Cloud Run control plane to perform operations like reading container images or writing logs; it is not an identity that a CI/CD pipeline should assume. The pipeline runs with its own service account, and using the service agent would grant internal service permissions that are neither intended nor appropriate for external deployments, and it would not provide the deployer role needed for the pipeline's actions.

• ✗

  Grant the Cloud Run Admin role to the user account running the pipeline

  Why it's wrong here

  The pipeline runs as a service account, not as an individual user, so granting roles/run.admin to a user account does not affect the pipeline's permissions. Moreover, Cloud Run Admin is a broad role that allows creating, deleting, and updating all Cloud Run resources, which violates least privilege when compared to the more focused roles/run.deployer. The correct approach is to grant the deployer role to the service account identity that the pipeline actually uses, not to a human user's account.

Go deeper

Related to this question