Google Professional Cloud Database Engineer Question 106
Select 2Google Cloud PlatformYour company uses Cloud SQL for PostgreSQL to manage its database needs. A new application team requires access to the database, but you need to ensure they only have the ability to read data from specific tables without modifying them. Which steps should you take to configure their access appropriately?
- A
Create a new database user for the application team and grant them the 'roles/cloudsql.viewer' IAM role.
- B
Create a new database user for the application team and grant them the 'SELECT' privilege on the required tables.
- C
Enable the Cloud SQL Admin API to manage database-level access for the new team.
- D
Use IAM Conditions to restrict access to the database based on the time of day and user attributes.
- E
Ensure the application team connects to the database using the created user credentials.
Show answer and explanation
Correct answers: B, E
Explanation
To manage database access effectively, you must create a database user and assign the appropriate permissions at the database level. In this case, granting the 'SELECT' privilege ensures the application team can read data from specific tables, while using the new user credentials ensures access is controlled and aligned with the configured permissions. IAM roles and APIs do not manage table-level access within the database.
- A. Incorrect.
This is incorrect because the 'roles/cloudsql.viewer' IAM role allows viewing of Cloud SQL instances and metadata but does not control access to specific database tables.
- B. Correct.
This is correct because granting the 'SELECT' privilege on specific tables ensures the application team can read the data without modifying it.
- C. Incorrect.
This is incorrect because enabling the Cloud SQL Admin API is not directly related to managing database table-level access.
- D. Incorrect.
This is incorrect because while IAM Conditions can restrict access, they operate at the IAM level, not at the database table level.
- E. Correct.
This is correct because the application team must use the credentials of the newly created database user to connect and adhere to the configured table-level access permissions.