Google Professional Cloud Database Engineer Question 107
Single answerGoogle Cloud PlatformYour company uses Cloud SQL for PostgreSQL to host its production database. A new Data Analyst team needs read-only access to specific tables in the database. As a Professional Cloud Database Engineer, how should you configure their access securely while following Google Cloud best practices?
- A
Create a database user for the Data Analyst team and grant them the 'cloudsql.admin' IAM role at the project level.
- B
Create a database user for the Data Analyst team and assign them read-only privileges to the specific tables in the PostgreSQL database.
- C
Grant the Data Analyst team the 'roles/cloudsql.viewer' IAM role at the instance level to allow read-only access to the tables.
- D
Create a service account for the Data Analyst team and grant it the 'cloudsql.client' IAM role, then configure the necessary database-level permissions for the service account.
Show answer and explanation
Correct answer: B
Explanation
The best practice for managing database access in Cloud SQL is to create a database user and configure permissions at the database level. This approach ensures fine-grained control over which users have access to specific tables and follows the principle of least privilege. Database-level permissions are managed separately from IAM roles, which are used for managing access to Google Cloud resources, not specific database objects.
- A. Incorrect.
Granting the 'cloudsql.admin' IAM role provides administrative access to the entire Cloud SQL project, not just the database or specific tables. This violates the principle of least privilege and is not secure for the use case.
- B. Correct.
Creating a database user and assigning them read-only privileges to the specific tables in the PostgreSQL database is the correct approach. It ensures granular access control and aligns with best practices for database-level permissions.
- C. Incorrect.
The 'roles/cloudsql.viewer' IAM role only grants read-only access to the Cloud SQL instance metadata and does not allow access to the actual database or its tables.
- D. Incorrect.
While 'cloudsql.client' IAM role allows connecting to a Cloud SQL instance, it does not manage database-level permissions. Also, using a service account here is unnecessary since database users can be directly created for human users.