flowchart LR
  Client[Authenticated producer] --> API[Cloud Run ingress]
  API --> Topic[Pub/Sub topic]
  Topic --> Sub[Pub/Sub subscription]
  Sub --> Worker[Cloud Run worker]
  API --> Raw[(Cloud Storage raw-event bucket)]
  Worker --> Raw
  Worker --> Downstream[External downstream systems]
  API --> Logs[Cloud Logging]
  Worker --> Logs
  Logs --> Monitor[Cloud Monitoring]
  API -. IAM .-> Identity[Dedicated runtime service account]
  Worker -. IAM .-> Identity