With the service enabled successfully, we will turn our attention to securing access. To achieve this, we will be creating a new service account with the specific task of managing the invocation of the new service.
Thinking back to the original design, the service is actually invoked by Cloud Pub/Sub rather than a user. As we have chained together a series of events, we can take advantage of this to minimize the external sources that are able to initiate our new service. The following steps illustrate how to create a service account tasked with the invocation of a new Cloud Run PDF service instance.
