Google Professional Cloud Database Engineer Question 102
Select 3Google Cloud PlatformYou are designing a database solution on Google Cloud Platform (GCP) that requires secure access to a Cloud SQL instance. The database will be accessed by a Compute Engine virtual machine (VM) and a team of developers who need read-only access for analytics. Which Identity and Access Management (IAM) policies should you configure to ensure secure and appropriate access?
- A
Assign the 'roles/cloudsql.client' role to the Compute Engine service account.
- B
Assign the 'roles/cloudsql.editor' role to the team of developers.
- C
Assign the 'roles/cloudsql.readonly' role to the team of developers.
- D
Assign the 'roles/cloudsql.admin' role to the Compute Engine service account.
- E
Enable the Cloud SQL Admin API to allow proper IAM policy enforcement.
Show answer and explanation
Correct answers: A, C, E
Explanation
To ensure secure and appropriate database access, you must configure IAM roles according to the principle of least privilege. The Compute Engine service account needs the 'roles/cloudsql.client' role to connect securely, while the developers need the 'roles/cloudsql.readonly' role for their specific read-only requirements. Additionally, enabling the Cloud SQL Admin API is a prerequisite for IAM policy enforcement on Cloud SQL instances. Assigning overly permissive roles, such as 'roles/cloudsql.editor' or 'roles/cloudsql.admin,' should be avoided to maintain security.
- A. Correct.
Correct: The 'roles/cloudsql.client' role allows the Compute Engine service account to connect to the Cloud SQL instance securely. This is the appropriate role for a VM accessing the database.
- B. Incorrect.
Incorrect: The 'roles/cloudsql.editor' role provides permissions to modify database instances, which is unnecessary and overly permissive for the team of developers who only require read-only access.
- C. Correct.
Correct: The 'roles/cloudsql.readonly' role provides the developers with read-only access to the database, which is appropriate for their analytics-related tasks.
- D. Incorrect.
Incorrect: The 'roles/cloudsql.admin' role is overly permissive and not required for the Compute Engine service account. This role is intended for managing the Cloud SQL instance, not for database connectivity.
- E. Correct.
Correct: Enabling the Cloud SQL Admin API is required for IAM policies to work properly in controlling access to Cloud SQL instances.