You must restrict Cloud Functions invocations to authorized services following Google best practices. What should you do?

To restrict Cloud Functions invocations to authorized services, Google best practices recommend using a service account with the Cloud Functions Invoker role. This role grants permission to invoke HTTP-triggered functions. The authorized service can then use this service account to authenticate its requests, ensuring only services with the appropriate permissions can trigger the function. Using Identity-Aware Proxy (IAP) is for securing access to web applications and resources, not directly for programmatic Cloud Functions invocation. Creating a service account with the Cloud Functions Viewer role only allows viewing function metadata, not invoking it. While OAuth 2.0 client IDs are used for authentication, using a service account with the specific Cloud Functions Invoker role is the more direct and recommended method for service-to-service authentication for Cloud Functions.