Google Professional Cloud Database Engineer Question 104
Select 2Google Cloud PlatformYou are designing a database solution on Google Cloud using Cloud SQL for PostgreSQL. The database needs to be accessed by a Compute Engine instance for application queries, and by a group of developers for administrative purposes. How should you configure IAM policies to ensure secure and least-privilege access to the database?
- A
Grant the Compute Engine service account the 'Cloud SQL Client' role.
- B
Grant each developer the 'Cloud SQL Admin' role.
- C
Grant each developer the 'Cloud SQL Viewer' role.
- D
Grant the Compute Engine service account the 'Cloud SQL Admin' role.
- E
Create a custom role with only required permissions for developers and assign it to them.
Show answer and explanation
Correct answers: A, E
Explanation
To ensure secure and least-privilege access, the Compute Engine service account should be granted the 'Cloud SQL Client' role, which is sufficient for enabling application queries without unnecessary administrative permissions. For developers, creating and assigning a custom role with only the permissions they require ensures they have adequate access for their tasks while avoiding excessive privileges. This configuration follows best practices for IAM policies and access control.
- A. Correct.
Correct: The 'Cloud SQL Client' role allows the Compute Engine service account to connect to the database without giving unnecessary administrative permissions, adhering to the principle of least privilege.
- B. Incorrect.
Incorrect: The 'Cloud SQL Admin' role grants full administrative privileges, which is not necessary for developers if they only need to perform specific tasks. This violates the principle of least privilege.
- C. Incorrect.
Incorrect: The 'Cloud SQL Viewer' role only provides read-only access to view metadata about the database and is insufficient for administrative tasks required by developers.
- D. Incorrect.
Incorrect: The 'Cloud SQL Admin' role provides full administrative access to the database, which is excessive for the Compute Engine service account that only needs to perform application queries.
- E. Correct.
Correct: Creating a custom role with only the required permissions for developers ensures they have enough access for their tasks without granting excessive privileges, aligning with the principle of least privilege.