Google Professional Cloud Database Engineer Question 105
Single answerGoogle Cloud PlatformYou are managing a Cloud SQL instance for your organization, and you need to ensure that a new team member can query the database without being able to modify its schema. How should you configure the user's access?
- A
Grant the 'roles/cloudsql.client' IAM role to the user.
- B
Create a database user account for the team member and assign it the 'READER' role within the database.
- C
Grant the 'roles/cloudsql.admin' IAM role to the user.
- D
Create a database user account for the team member and assign it the 'EDITOR' role within the database.
Show answer and explanation
Correct answer: B
Explanation
To manage database access effectively, you must distinguish between IAM roles for managing the Cloud SQL instance and database-level roles for managing permissions within the database itself. The correct approach is to create a database user account for the team member and assign it a role that aligns with their responsibilities, such as the 'READER' role for read-only access. This ensures proper segregation of duties and adheres to the principle of least privilege.
- A. Incorrect.
Granting the 'roles/cloudsql.client' IAM role only provides the ability to connect to the Cloud SQL instance but does not manage database-level access or enforce specific permissions such as read-only access.
- B. Correct.
Creating a database user account and assigning it the 'READER' role within the database is the correct approach. This ensures the user can query data without being able to modify the schema.
- C. Incorrect.
Granting the 'roles/cloudsql.admin' IAM role provides full administrative access to the Cloud SQL instance, including the ability to modify the schema, which violates the requirement of read-only access.
- D. Incorrect.
Assigning the 'EDITOR' role within the database allows the user to modify the schema, which does not meet the requirement of restricting access to query-only permissions.