You must create a Cloud Function in Project A that writes to a Cloud Storage bucket in Project B, following least privilege. What should you do?

The correct approach involves creating a dedicated service account in Project A, where the Cloud Function resides. This service account should then be explicitly assigned to the Cloud Function during deployment. Finally, to adhere to the principle of least privilege, grant this specific service account only the necessary permission (roles/storage.objectCreator) on the target Cloud Storage bucket in Project B. Option 1 is incomplete as it misses the crucial step of deploying the Cloud Function with the newly created service account. Without this, the function will default to using the project's default service account. Option 3 is less secure because it uses the broader default App Engine service account, which might have more permissions than necessary for this specific function. Option 4 is incorrect because a Cloud Function in Project A cannot be deployed using a service account from Project B. Service accounts are project-specific for deployment.