Google Professional Cloud Database Engineer Question 101
Select 3Google Cloud PlatformYou are managing a Cloud SQL instance in Google Cloud and need to ensure that only the application servers hosted in a specific Google Kubernetes Engine (GKE) cluster can connect to the database. Additionally, you want to ensure that developers can view the database but not modify it. How should you configure the IAM policies and database connectivity to meet these requirements?
- A
Grant the Cloud SQL Client role to the GKE service account used by the application servers.
- B
Grant the Cloud SQL Admin role to the developers for the Cloud SQL instance.
- C
Enable private IP for the Cloud SQL instance and configure a VPC peering connection with the GKE cluster.
- D
Grant the Cloud SQL Viewer role to the developers for the Cloud SQL instance.
- E
Allow all incoming connections from any IP range in the Cloud SQL instance's authorized networks settings.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the requirements, the GKE service account needs the Cloud SQL Client role to connect to the database securely. Enabling private IP and configuring VPC peering ensures the database is only accessible from the GKE cluster. The developers should be assigned the Cloud SQL Viewer role to allow them to view the database without granting excessive permissions. Avoid overly permissive configurations like enabling all incoming IPs or assigning admin roles unnecessarily to maintain security and least privilege access.
- A. Correct.
Correct: The Cloud SQL Client role is required for the GKE service account so that the application servers can authenticate and connect to the database securely.
- B. Incorrect.
Incorrect: The Cloud SQL Admin role provides full administrative access to the database, including the ability to modify or delete it, which violates the requirement of read-only access for developers.
- C. Correct.
Correct: Enabling private IP and using VPC peering ensures secure connectivity between the GKE cluster and the Cloud SQL instance without exposing it to public IPs.
- D. Correct.
Correct: The Cloud SQL Viewer role provides read-only access to developers, which aligns with the requirement that they can view but not modify the database.
- E. Incorrect.
Incorrect: Allowing all incoming connections from any IP range is a security risk and does not restrict access to the GKE cluster or authorized users.