Google Professional Cloud Database Engineer Question 100
Select 2Google Cloud PlatformYou are designing a secure database solution on Google Cloud for an e-commerce application. The application will use Cloud SQL for PostgreSQL, and you need to configure Identity and Access Management (IAM) policies to meet the following requirements:
- Developers should only have the ability to read data from the database.
- Database administrators (DBAs) should have full administrative access to the database.
- Service accounts used by the application should only have the ability to connect to the database.
Which IAM roles will you assign to meet these requirements?
- A
Grant the 'roles/cloudsql.viewer' role to developers.
- B
Grant the 'roles/cloudsql.admin' role to DBAs.
- C
Grant the 'roles/cloudsql.client' role to service accounts.
- D
Grant the 'roles/cloudsql.editor' role to developers.
- E
Grant the 'roles/cloudsql.admin' role to service accounts.
Show answer and explanation
Correct answers: B, C
Explanation
To meet the requirements, DBAs need the 'roles/cloudsql.admin' role to have full administrative access. Service accounts used by the application require the 'roles/cloudsql.client' role to establish secure connections to the Cloud SQL database. Developers' requirement to read data is not directly addressed by Cloud SQL IAM roles alone; instead, database-level permissions (such as granting SELECT privileges within PostgreSQL) must be configured separately in addition to IAM roles.
- A. Incorrect.
The 'roles/cloudsql.viewer' role allows users to view instance metadata but does not grant access to database data. This role is not sufficient for developers who need to read data from the database.
- B. Correct.
The 'roles/cloudsql.admin' role provides full administrative access to manage Cloud SQL instances, including instance creation, deletion, and modification. This is appropriate for DBAs who need full control.
- C. Correct.
The 'roles/cloudsql.client' role allows the ability to connect to Cloud SQL instances. This is suitable for service accounts used by the application to establish database connections.
- D. Incorrect.
The 'roles/cloudsql.editor' role allows editing of instance metadata and configurations but does not grant access to database data. This role is not appropriate for developers who only need read access.
- E. Incorrect.
The 'roles/cloudsql.admin' role provides full administrative access, which is not appropriate for service accounts as they only need the ability to connect.