Topic 1 Question 268

Professional Cloud Developer

Topic 1 Question 268
You manage a system that runs on stateless Compute Engine VMs and Cloud Run instances. Cloud Run is connected to a VPC, and the ingress setting is set to Internal. You want to schedule tasks on Cloud Run. You create a service account and grant it the roles/run.invoker Identity and Access Management (IAM) role. When you create a schedule and test it, a 403 Permission Denied error is returned in Cloud Logging. What should you do?
- Grant the service account the roles/run.developer IAM role.
- Configure a cron job on the Compute Engine VMs to trigger Cloud Run on schedule.
- Change the Cloud Run ingress setting to 'Internal and Cloud Load Balancing.'
- Use Cloud Scheduler with Pub/Sub to invoke Cloud Run.
ユーザの投票
コメント(4)
- 正解だと思う選択肢: D
  Cloud Scheduler can trigger Cloud Run services, but in this case, where the ingress is set to 'Internal', direct invocation might not work. Instead, you can use Cloud Scheduler in combination with Pub/Sub. Cloud Scheduler can create a Pub/Sub message on a schedule, and this Pub/Sub message can then trigger the Cloud Run service. This approach is commonly used for invoking services with restricted network access.
  
  👍 2
  plutonians1232023/12/02
- D. is the best solution because it effectively circumvents the limitation of the Internal ingress setting of Cloud Run. This setting restricts external access, which is likely causing the 403 error. By using Cloud Scheduler to trigger a Pub/Sub topic, and then having Pub/Sub trigger the Cloud Run service, you maintain internal access security while enabling external scheduling. This method is both secure and adheres to the internal-only access requirements, leveraging managed services for scalability and reliability.
  
  👍 1
  vspringe2023/11/13
- 正解だと思う選択肢: D
  D. When setting PubSub subscription, use type push and use the service account with the invoker role as authentication. A. no need more permissions. B. it could work id the vms are in the same VPC, but it is not best practice. C. That setting is only for connecting to load balancer
  
  👍 1
  diegodoal2023/11/15
シャッフルモード

ユーザの投票

コメント(4)