Google Associate Cloud Engineer Question 128
Select 3Google Cloud PlatformYou are tasked with deploying a containerized application to Cloud Run on Google Cloud. The application requires access to a Cloud SQL instance. What steps must you take to ensure that your Cloud Run service can securely connect to the Cloud SQL instance?
- A
A. Enable the Cloud SQL Admin API in your Google Cloud project.
- B
B. Attach a service account with appropriate Cloud SQL Client permissions to the Cloud Run service.
- C
C. Configure the Cloud Run service to use a VPC Connector.
- D
D. Add the Cloud Run service account to the 'Cloud SQL Client' IAM role for your Cloud SQL instance.
- E
E. Use the 'gcloud run deploy' command with the '--add-cloudsql-instances' flag to specify the Cloud SQL instance.
Show answer and explanation
Correct answers: B, D, E
Explanation
To securely connect a Cloud Run service to a Cloud SQL instance, you must ensure that the service account used by Cloud Run has the 'Cloud SQL Client' role permissions. This allows it to authenticate and connect to the database. Additionally, when deploying the service, you must specify the Cloud SQL instances it should connect to using the '--add-cloudsql-instances' flag. These steps ensure that the Cloud Run service can access the Cloud SQL instance securely without needing a VPC Connector.
- A. Incorrect.
A. Enabling the Cloud SQL Admin API is necessary for managing Cloud SQL resources but not directly for connecting a Cloud Run service to a Cloud SQL instance.
- B. Correct.
B. Attaching a service account with the right permissions is crucial for allowing Cloud Run to access Cloud SQL.
- C. Incorrect.
C. Configuring a VPC Connector is not required for accessing Cloud SQL from Cloud Run, as Cloud SQL proxy handles the connection.
- D. Correct.
D. Adding the Cloud Run service account to the 'Cloud SQL Client' IAM role allows it to establish a connection to the Cloud SQL instance.
- E. Correct.
E. Using the '--add-cloudsql-instances' flag is necessary to specify which Cloud SQL instance the Cloud Run service should connect to.