Google Professional Cloud Security Engineer Question 310
Single answerGoogle Cloud PlatformYour team is building an application on Google Cloud that needs access to a database. The database credentials must be stored securely and accessed by the application without exposing them in the source code. How should you configure Secret Manager to ensure secure storage and access to the credentials?
- A
Store the database credentials in Secret Manager and grant the application service account the 'Secret Manager Secret Accessor' role.
- B
Store the database credentials in Secret Manager and allow all users in your project to access the secret by granting the 'roles/secretmanager.viewer' role at the project level.
- C
Store the database credentials in Secret Manager and configure the application to retrieve the secret using the Secret Manager API.
- D
Store the database credentials in Secret Manager and use the default Compute Engine service account to access the secret.
Show answer and explanation
Correct answer: A
Explanation
To securely store and access secrets in Secret Manager, you must follow the principle of least privilege by granting access only to the specific service account that requires it. Assigning the 'Secret Manager Secret Accessor' role to the application service account ensures that only the application can access the secret, preventing unauthorized access. This approach also avoids hardcoding sensitive information in the application code.
- A. Correct.
Correct. Granting the application service account the 'Secret Manager Secret Accessor' role allows the application to securely retrieve the secret without exposing it to unauthorized users.
- B. Incorrect.
Incorrect. Granting all users in the project access to the secret is not secure and violates the principle of least privilege.
- C. Incorrect.
Incorrect. While using the Secret Manager API is part of the solution, it is not complete without properly securing access with roles and permissions.
- D. Incorrect.
Incorrect. Using the default Compute Engine service account without assigning the appropriate permissions to access the secret is insecure and may not work as intended.