How to Enable Cloud Pub/Sub API for App Engine

ACE By islever Editorial Last updated

Setting up cloud projects and accounts. Managing service accounts.

Short answer

A Enable the Cloud Pub/Sub API in the API Library on the GCP Console so the App Engine service account can authenticate to it.

Question

You want to send and consume Cloud Pub/Sub messages from your App Engine application. The Cloud Pub/Sub API is currently disabled. You will use a service
account to authenticate your application to the API. You want to make sure your application can use Cloud Pub/Sub. What should you do?
  1. Enable the Cloud Pub/Sub API in the API Library on the GCP Console. Correct Answer
  2. Rely on the automatic enablement of the Cloud Pub/Sub API when the Service Account accesses it.
  3. Use Deployment Manager to deploy your application. Rely on the automatic enablement of all APIs used by the application being deployed.
  4. Grant the App Engine Default service account the role of Cloud Pub/Sub Admin. Have your application enable the API on the first connection to Cloud Pub/ Sub.

Key Takeaways

The question tests whether a disabled GCP API can be turned on implicitly; the trap is assuming service-account access or Deployment Manager deployment will auto-enable the Cloud Pub/Sub API.

Cloud Pub/Sub must be explicitly enabled per project before an App Engine application can publish or consume messages with its service account. This page confirms that enabling the Cloud Pub/Sub API in the Console API Library is the required first step, and explains why automatic enablement options fail.

Common mistake: Option B is the most common wrong pick, because learners assume that a service account's first authenticated call automatically enables the API — Google Cloud has no such automatic enablement for disabled APIs.

Expert Analysis

Why the Answer Is Correct

The Cloud Pub/Sub API is explicitly stated as disabled, and in Google Cloud an API must be enabled for the project before any client, including an App Engine app using the App Engine Default service account, can call it. Enabling it in the API Library of the GCP Console (option A) is the documented, least-privileged way to make the API usable. Once enabled, the service account can simply authenticate to the API with whatever Pub/Sub roles it has been granted, with no extra permissions needed for setup. As ESP_SAP's quoted quickstart notes, the flow is "Set up a Cloud Console project... Enable the Pub/Sub API for that project."

Why the Other Options Are Wrong

Option B is wrong because there is no automatic API enablement triggered when a service account first accesses a disabled API — the call would simply fail with a permission/enabled-API error. Option C is wrong for the same reason: Deployment Manager does not magically enable every API a deployed application touches; APIs used by a deployment must be enabled beforehand. Option D is wrong because enabling an API from inside the application requires serviceusage.services.enable and would hand the app the excessive Cloud Pub/Sub Admin role, which contradicts least privilege — Schladde noted that "D could be possible, but to much permissions are given to the app."

Community Comment Notes

The community overwhelmingly converges on A, with Buruguduystunstugudunstu explaining that "Since the Cloud Pub/Sub API is currently disabled, the first step is to enable it" via the API Library. Schladde adds nuance that APIs can also be enabled programmatically with gcloud or the Service Usage API, but still concludes A for this question, observing that "rely on..." is never a good option. obeythefist frames the underlying doctrine correctly: "there's no automatic enablement of the API," which eliminates both B and C.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Treat any "API is currently disabled" stem as an enablement question first and an IAM question second — the correct answer is almost always an explicit enable step in the API Library. Reject any option that says the platform will enable the API automatically, and reject options that grant broad admin roles to the application just to perform setup.

Frequently Asked Questions

Why can't the service account auto-enable the Cloud Pub/Sub API on first access?

Google Cloud has no automatic enablement for disabled APIs; a first call to a disabled API simply fails until an admin enables it for the project.

Why is granting Cloud Pub/Sub Admin to enable the API a bad answer?

It forces the app to hold serviceusage.services.enable plus a broad admin role at runtime, violating least privilege when a one-time Console enable step suffices.

More ACE FAQ →

Discussion 28 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 28

  1. ESP_SAP 👍 33
    Correct Answer is (A) Quickstart: using the Google Cloud Console This page shows you how to perform basic tasks in Pub/Sub using the Google Cloud Console. Note: If you are new to Pub/Sub, we recommend that you start with the interactive tutorial. Before you begin Set up a Cloud Console project. Set up a project Click to: Create or select a project. Enable the Pub/Sub API for that project. You can view and manage these resources at any time in the Cloud Console. Install and initialize the Cloud SDK. Note: You can run the gcloud tool in the Cloud Console without installing the Cloud SDK. To run the gcloud tool in the Cloud Console, use Cloud Shell . https://cloud.google.com/pubsub/docs/quickstart-console
  2. Bharathy 👍 25
    We need to enable the pub/sub API, if we are going to use it in your project... then APP engine can able to access it with required ServiceAccount
  3. Buruguduystunstugudunstuy 👍 9 Answered A
    Answer A is correct. Enable the Cloud Pub/Sub API in the API Library on the GCP Console. Since the Cloud Pub/Sub API is currently disabled, the first step is to enable it. This can be done through the API Library on the GCP Console. Once the API is enabled, the service account can be used to authenticate the App Engine application to the Cloud Pub/Sub API. Answer B is incorrect because there is no automatic enablement of APIs when a service account accesses them. The API needs to be enabled manually in the API Library or through the command-line interface. Answer C is incorrect because enabling APIs through Deployment Manager requires that the APIs be enabled in the project before Deployment Manager can use them. Answer D is incorrect because granting the App Engine Default service account the Cloud Pub/Sub Admin role could be a security risk, and it is not necessary to enable the API.
  4. Kaushik_Mallick 👍 4
    Does anyone has latest questions & answers. Also if you guide me the reading material/blog/portal to pass this exam.
  5. sedado77 👍 3 Answered A
    Yup its A
Show 23 more comments
  1. Schladde 👍 2 Answered A
    A is correct, although there are options to activate APIs programmatically (gcloud, curl) https://cloud.google.com/service-usage/docs/enable-disable B and C are incorrect because "rely on ..." is never a good option D could be possible, but to much permissions are given to the app
  2. obeythefist 👍 2
    This question seems to be asking "Can you automatically enable the API or do you have to do it manually?" and I think the answer is that there's no automatic enablement of the API.
  3. Gohs 👍 2
    Not all API are enabled by default so you have to manually enable the API you'll need.
  4. shawnkkk 👍 2
    A. Enable the Cloud Pub/Sub API in the API Library on the GCP Console.
  5. ggalvez 👍 2
    Es A. Nunca esta habilitada la API PUB/SUB
  6. mcaromit 👍 2
    As a first step A is the correct answer
  7. bidyut123 👍 2 Answered A
    ANSWER SHOULD BE A.
  8. gspb 👍 1
    In the question - "You want to make sure your application can use Cloud Pub/Sub" Since we want to make sure that our application uses pub/sub, enabling it manually is the best option. Hence, option A is correct
  9. nliaustemac 👍 1
    A. is the correct answer: Enable the Cloud Pub/Sub API in the API Library on the GCP Console.
  10. INASR 👍 1
    Sure A , you need to enable API for any service you want to use in google
  11. swatititame 👍 1
    • A. Enable the Cloud Pub/Sub API in the API Library on the GCP Console.
  12. flashlight01 👍 1 Answered A
    Enable the Cloud Pub/Sub API in the API Library on the GCP Console.
  13. Captain1212 👍 1
    Yes A, is more correct as first you need to enable the API itself
  14. vikram___ 👍 1
    Enabling API is the first step before using it, Ans A
  15. Cloudmoh 👍 1 Answered A
    Yes, the Cloud pub/sub-API should be enabled.
  16. BAGCP 👍 1
    Even i also want this information
  17. iPablo26 👍 1
    Enable the Cloud Pub/Sub Api
  18. Nick334 👍 1
    I am also looking for it.
  19. gielda211 👍 1 Answered A
    A is correct
  20. Romio2023 👍 1
    hello test
  21. AzureDP900 👍 1
    A is right
  22. haroldbenites 👍 1
    go for A
  23. Gayathree 👍 1 Answered A
    a

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Single Instance Managed Instance Group Configuration on GCP

S-grade

Authenticating On-Premises Apps to GCP AutoML APIs

S-grade

Consolidating Multi-Project Monitoring in One Stackdriver Dashboard

S-grade

Granting External Auditors Access to BigQuery Audit Logs

S-grade

Practice All ACE Questions

Access 84 questions with complete answers and detailed explanations.

View Full ACE Practice Test →

← Back to ACE Study Guide