Google Cloud Platform (GCP): Cloud Run, IAM & Secret Manager

Serverless Microservices Architecture on GCP

Google Cloud Run provides fully managed serverless container execution with automatic scaling to zero, integrated secret management, and fine-grained Cloud IAM service accounts.

1. Deploying Container to Cloud Run with gcloud CLI

# Deploy container service to Google Cloud Run
gcloud run deploy api-gateway 
    --image gcr.io/linuxlab-project/api-gateway:v1.2.0 
    --platform managed 
    --region us-central1 
    --allow-unauthenticated 
    --min-instances 1 
    --max-instances 50 
    --memory 512Mi 
    --cpu 1 
    --set-secrets="DATABASE_URL=db-secret:latest"

2. Principle of Least Privilege with GCP Service Accounts

# Create dedicated service account
gcloud iam service-accounts create run-app-sa 
    --description="Service account for Cloud Run API service" 
    --display-name="CloudRun-API-SA"

# Grant Secret Manager Secret Accessor role
gcloud secrets add-iam-policy-binding db-secret 
    --member="serviceAccount:run-app-sa@linuxlab-project.iam.gserviceaccount.com" 
    --role="roles/secretmanager.secretAccessor"