Google Professional Cloud DevOps Engineer Question 82
Single answerGoogle Cloud PlatformYour organization uses Google Cloud to host several microservices that require access to sensitive database credentials. You’ve been tasked with implementing a solution to manage these secrets securely and ensure they are rotated regularly without requiring code changes in the microservices. Which approach should you use?
- A
Store the database credentials in Google Cloud Secret Manager and configure the microservices to access the secrets directly using IAM permissions.
- B
Embed the database credentials directly in the source code of the microservices and use Cloud Source Repositories for version control.
- C
Use Google Cloud Certificate Manager to store the database credentials and configure TLS for the microservices.
- D
Store the database credentials in Google Cloud Storage buckets with public access disabled and manage access using signed URLs.
Show answer and explanation
Correct answer: A
Explanation
Google Cloud Secret Manager is the recommended service for securely managing sensitive information like database credentials. It integrates with IAM for granular access control and provides features like automatic secret rotation, which ensures security and reduces operational overhead. This makes it the best choice for managing secrets in a microservices architecture.
- A. Correct.
This is the correct option. Google Cloud Secret Manager provides a secure and centralized solution for managing secrets like database credentials. It allows microservices to access secrets directly using IAM permissions, ensuring security and enabling automatic updates or rotations without requiring code changes.
- B. Incorrect.
This is not a secure practice. Embedding secrets in source code introduces security risks, such as accidental exposure through version control systems or unauthorized access.
- C. Incorrect.
Google Cloud Certificate Manager is designed for managing certificates, such as SSL/TLS certificates, rather than secrets like database credentials.
- D. Incorrect.
While Google Cloud Storage offers security features, it is not designed specifically for secret management. Using it for storing secrets, even with public access disabled, is not recommended as it lacks features like automatic secret rotation and fine-grained access control specifically for secrets.