Google Professional Cloud Database Engineer Question 103
Select 2Google Cloud PlatformYou are designing a multi-tier application on Google Cloud, which uses Cloud SQL for the database layer. The application consists of a front-end App Engine service and a backend Compute Engine instance. Both components require access to the Cloud SQL database. As a Professional Cloud Database Engineer, what IAM policies should you configure to ensure secure and least-privilege access?
- A
Grant the 'Cloud SQL Client' role to the App Engine service account.
- B
Grant the 'Cloud SQL Admin' role to the App Engine service account.
- C
Grant the 'Cloud SQL Client' role to the Compute Engine service account.
- D
Grant the 'Editor' role to the Compute Engine service account.
- E
Grant the 'Cloud SQL Viewer' role to both service accounts.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure secure and least-privilege access, the 'Cloud SQL Client' role should be granted to the service accounts used by App Engine and Compute Engine. This role provides the required permissions for connecting to and interacting with the Cloud SQL database, without granting unnecessary privileges. Other roles like 'Cloud SQL Admin' or 'Editor' exceed the permissions needed for database connectivity, while 'Cloud SQL Viewer' does not provide sufficient permissions.
- A. Correct.
This is correct. The 'Cloud SQL Client' role provides the necessary permissions for App Engine to connect to and interact with the Cloud SQL database.
- B. Incorrect.
This is incorrect. The 'Cloud SQL Admin' role grants permissions to manage the database instance, which is unnecessary and violates the principle of least privilege for application connectivity.
- C. Correct.
This is correct. The 'Cloud SQL Client' role provides the necessary permissions for the Compute Engine instance to connect to and interact with the Cloud SQL database.
- D. Incorrect.
This is incorrect. The 'Editor' role grants broad permissions to resources in the project and is not specific to Cloud SQL, making it inappropriate for this use case.
- E. Incorrect.
This is incorrect. The 'Cloud SQL Viewer' role only allows viewing metadata about the database instance, which is insufficient for connecting to the database.