You are configuring a new application that has access to an existing Cloud Spanner database. The new application reads from this database to gather statistics for a dashboard. You want to follow…

Question

Options

• AReuse the existing service account that populates this database.
• BCreate a new service account, and grant it the Cloud Spanner Database Admin role.
• CCreate a new service account, and grant it the Cloud Spanner Database Reader role.
• DCreate a new service account, and grant it the spanner.databases.select permission.

• A
  6% (3)
• B
  2% (1)
• C
  80% (41)
• D
  12% (6)

Explanation

The correct answer is C. Google recommends using predefined IAM roles and the principle of least privilege. Since the new application only reads data to populate a dashboard, the Cloud Spanner Database Reader role grants exactly the permissions needed (read access) - no more. Creating a dedicated service account for this application ensures proper separation of concerns and auditability. Option A (reusing an existing service account) violates the principle of least privilege and separation of concerns. Option B (Database Admin role) grants far more permissions than necessary, including write and admin capabilities. Option D grants a single granular permission (spanner.databases.select), but Google's recommended practice is to use predefined roles rather than individual permissions to ensure complete and consistent access coverage.

No community discussion yet for this question.