You need to secure a Cloud Function so authorized end users can authenticate via your app using Google Sign-In while preventing unauthorized access. Following Google best practices, what deployment and IAM action should you take?

The correct approach is to deploy from a source repository and grant users roles/cloudfunctions.invoker. Deploying from a source repository (like Cloud Source Repositories or GitHub) is a best practice for version control, collaboration, and CI/CD pipelines, ensuring maintainability and reliability. The roles/cloudfunctions.invoker IAM role grants permission to invoke (call) a Cloud Function, which is precisely what authorized end-users need. This role allows invocation without granting broader administrative or development permissions, adhering to the principle of least privilege. Deploying from a local machine with gcloud is less ideal for production environments as it lacks version control and auditability. Granting roles/cloudfunctions.viewer would allow users to view function metadata but not invoke it. roles/cloudfunctions.admin and roles/cloudfunctions.developer provide extensive permissions (e.g., managing, updating, deleting functions) that are far beyond what end-users require for simple invocation, posing a significant security risk.