hardMultiple ChoiceObjective-mapped
Cloud Run Per-Service Service Account with Pub/Sub Least Privilege
An organization uses Cloud Run to deploy microservices. Each microservice needs to authenticate to Cloud Pub/Sub topics. The Security Engineer wants to enforce that each service only uses its own service account and cannot impersonate others. The team also wants to rotate credentials automatically. What is the best practice to achieve this?
Quick Answer
The correct answer is to assign a dedicated service account to each Cloud Run service with the necessary Pub/Sub publisher role. This approach enforces least privilege by ensuring that each microservice can only publish to its specific topic and cannot impersonate another service’s identity. Cloud Run automatically rotates the short-lived tokens associated with these per-service service accounts via the metadata server, eliminating manual key rotation. On the Google Professional Cloud Security Engineer exam, this scenario tests your understanding of identity-based access control for serverless workloads, where a common trap is to use a single shared service account with broad permissions. Remember the key principle: one service, one account, one topic. A useful memory tip is “per-service, per-topic, per-role” — each Cloud Run service gets its own identity, scoped to only the Pub/Sub topic it needs, with credentials rotated automatically by the platform.
⚠ Common exam trap
Many exam-takers confuse the Compute Engine default service account (which is shared and not recommended for production) with the ability to assign dedicated service accounts per Cloud Run service, or they mistakenly think Workload Identity Federation is the correct approach for internal Google Cloud services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a dedicated service account to each Cloud Run service with the necessary Pub/Sub publisher role.
Cloud Run allows you to assign a dedicated, per-service service account at deployment time. By granting each service account only the Pub/Sub publisher role on its specific topic, you enforce least-privilege access and prevent impersonation. Cloud Run automatically rotates the short-lived tokens associated with these service accounts via the metadata server, eliminating the need for manual key management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign a dedicated service account to each Cloud Run service with the necessary Pub/Sub publisher role.
Why this is correct
Cloud Run uses the attached service account to obtain short-lived tokens automatically.
- ✗
Configure each Cloud Run service to use the Compute Engine default service account and rely on the metadata server.
Why it's wrong here
Cloud Run does not have a metadata server; it uses the attached service account.
- ✗
Use Workload Identity Federation to map each service to a Google service account.
Why it's wrong here
Workload Identity Federation is for external identities, not Cloud Run.
- ✗
Create a service account key for each service and store it in Cloud Secret Manager.
Why it's wrong here
Keys are long-lived and require manual rotation.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer needs to deploy a Cloud Run service that will read from a Cloud Pub/Sub topic. What is the least privileged IAM role to grant to the Cloud Run service's service account?
easy- A.roles/pubsub.subscriber on the topic resource
- B.roles/pubsub.viewer
- ✓ C.roles/pubsub.subscriber
- D.roles/pubsub.publisher
Why C: The Cloud Run service needs only the ability to pull (subscribe to) messages from the Pub/Sub topic. The `roles/pubsub.subscriber` role grants the `pubsub.subscriptions.consume` and `pubsub.subscriptions.get` permissions required to read messages, and when applied at the topic resource level (as implied by the option), it allows the service account to create and manage a subscription on that topic. This is the least privileged role that enables the read operation without granting unnecessary permissions like publishing or viewing all topics.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.