Google Professional Cloud Developer Question 234
Select 3Google Cloud PlatformYour application needs to connect securely to a Cloud SQL database instance without embedding credentials in the application code. You want to leverage the Cloud SQL Auth proxy for authentication. Which steps must you take to ensure the connection is established securely?
- A
Install the Cloud SQL Auth proxy on the same machine as your application.
- B
Provide a service account key file to the Cloud SQL Auth proxy for authentication.
- C
Grant the appropriate IAM role, such as 'Cloud SQL Client', to the service account being used.
- D
Enable the 'Allow public IP' option on the Cloud SQL instance.
- E
Use the Cloud SQL instance connection name when configuring the Cloud SQL Auth proxy.
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely authenticate to a Cloud SQL instance using the Cloud SQL Auth proxy, you must run the proxy on the same machine as your application, grant the appropriate IAM role to the service account, and provide the instance connection name. This approach avoids embedding credentials in your code and ensures a secure connection without relying on public IPs.
- A. Correct.
Correct: The Cloud SQL Auth proxy must run on the same machine as your application to securely redirect traffic to the Cloud SQL instance.
- B. Incorrect.
Incorrect: It is not recommended to use a service account key file for authentication due to security risks. Instead, the Cloud SQL Auth proxy can use Application Default Credentials.
- C. Correct.
Correct: Granting the 'Cloud SQL Client' IAM role to the service account allows the Cloud SQL Auth proxy to authenticate and connect to the database.
- D. Incorrect.
Incorrect: Enabling public IP is not required when using the Cloud SQL Auth proxy, as it works over secure private connections.
- E. Correct.
Correct: The Cloud SQL instance connection name is necessary to configure the Cloud SQL Auth proxy and establish the connection.