Google Professional Cloud Developer Question 229
Select 3Google Cloud PlatformYou are developing an application that connects to a Cloud SQL instance and an AlloyDB cluster for managing user data. The application is deployed on Google Kubernetes Engine (GKE). To ensure secure authentication to these services, what steps should you take to authenticate to Cloud SQL and AlloyDB securely?
- A
Use the Cloud SQL Auth proxy to establish a secure connection to the Cloud SQL instance.
- B
Embed the Cloud SQL username and password directly in the application code for authentication.
- C
Use the AlloyDB Auth proxy to securely connect to the AlloyDB cluster.
- D
Assign a service account with the appropriate IAM roles to the GKE workload and use Workload Identity for authentication.
- E
Enable public IP access on Cloud SQL and AlloyDB and restrict access using IP whitelisting.
Show answer and explanation
Correct answers: A, C, D
Explanation
To securely authenticate to Google Cloud services like Cloud SQL and AlloyDB, it is recommended to use the respective Auth proxies to leverage IAM-based authentication and avoid managing database credentials manually. Additionally, using Workload Identity with a properly configured service account ensures secure and seamless authentication for GKE workloads without exposing sensitive data. Hardcoding credentials or relying solely on IP-based restrictions is not recommended as they are less secure and harder to manage in dynamic environments.
- A. Correct.
Correct: The Cloud SQL Auth proxy simplifies and secures the authentication process by using IAM and avoiding the need for managing database credentials.
- B. Incorrect.
Incorrect: Embedding credentials in the application code is not a secure practice and increases the risk of credential exposure.
- C. Correct.
Correct: The AlloyDB Auth proxy ensures secure connections to the AlloyDB cluster by managing authentication through IAM instead of hardcoded credentials.
- D. Correct.
Correct: Assigning a service account with proper IAM roles and using Workload Identity allows the GKE workload to securely authenticate to the Cloud SQL and AlloyDB services without exposing sensitive credentials.
- E. Incorrect.
Incorrect: While IP whitelisting can add a layer of security, it is not sufficient or recommended as a primary authentication mechanism compared to using IAM-based authentication proxies.