A Cloud Run app needs access to images in a private Cloud Storage bucket. You must grant access securely following Google best practices. What should you do?

The correct approach is to enforce public access prevention and use a user-managed service account. Enforcing public access prevention ensures the bucket contents are not accidentally exposed. Configuring Cloud Run with a user-managed service account (instead of the default Compute Engine service account) adheres to the principle of least privilege and allows for granular control over permissions specific to the Cloud Run service. Granting Storage Object Viewer to this dedicated service account provides the necessary read access to the images without over-privileging. Signed URLs are for temporary, time-limited access for unauthenticated users, which is not the primary use case here for a Cloud Run service accessing its own resources.