- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud

Securing Microservices in Cloud Run
In this lab, you'll be tasked with deploying an off-the-shelf Cloud Run application that takes headless screenshots of web page URLs. The screenshots are written to a Google Cloud Storage bucket. However, to reduce an attack vector and pass an internal security audit, you must ensure your public web service has no actual access to Google Cloud Storage. To accomplish this, you will deploy a public frontend, which can only speak to the backend. The backend itself must also follow the principle of least privilege. To perform this hands-on lab, you should be familiar with the Cloud Shell and have some experience with Cloud Run.

Lab Info
Table of Contents
-
Challenge
Build the Frontend and Backend Container Images
-
Obtain the code from GitHub:
git clone https://github.com/ACloudGuru-Resources/content-google-cloud-run-deep-dive/
git clone https://github.com/ACloudGuru-Resources/content-google-cloudrun-deepdive-screenshot screenshot-backend
-
Create a Cloud Storage bucket in your project with the naming convention:
your-project-screenshots
. -
Update
screenshot.js
in the backend application, replacing the values ofGOOGLE_CLOUD_PROJECT_ID
andBUCKET_NAME
with your project ID and the name of the bucket you just created. -
Use Cloud Build to create container images called
screenshot-frontend
andscreenshot-backend
, and store them in Container Registry in your project.
-
-
Challenge
Deploy the Backend Service
-
Create a service account for the backend service called
backend-identity
. -
Create an IAM policy binding for the project that grants this service account the role of
roles/storage.objectCreator
. (Hint: Use thegcloud projects add-iam-policy-binding
command.) -
Deploy the
screenshot-backend
service, using thebackend-identity
service account as its runtime identity. Do not allow unauthenticated invocations, and grant512
mebibytes of memory to the service. -
Test that the service has been deployed successfully with
curl
in the Cloud Shell terminal. First, obtain an auth token:TOKEN=$(gcloud auth print-identity-token)
-
Access your service URL, with the token in the header, specifying a further URL to screenshot (in this example, we screenshot google.com):
curl -H "Authorization: Bearer $TOKEN" https://<SCREENSHOT-BACKEND_URL>.run.app/?url=https://www.google.com
-
-
Challenge
Deploy the Frontend Service
- Create a service account for the frontend service called
frontend-identity
. - Create an IAM policy binding that says the
frontend-identity
service account is permitted to invoke thescreenshot-backend
service. (Hint: Use thegcloud run services add-iam-policy-binding
command.) - Deploy the
screenshot-frontend
service, using thefrontend-identity
service account as its runtime identity. Allow unauthenticated invocations, and use--set-env-vars
to set aBACKEND_URL
environment variable with thebackend-service
URL as its value. - If you are successful, you should be able to access your frontend service and provide it with a URL to screenshot, then find that screenshot in your GCS bucket.
- Create a service account for the frontend service called
About the author
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.