PROFESSIONAL-CLOUD-DATABASE-ENGINEER · Question #124
Your organization operates in a highly regulated industry. Separation of concerns (SoC) and security principle of least privilege (PoLP) are critical. The operations team consists of: - Person A is a
The correct answer is A. roles/spanner.databaseAdmin for Person A. To satisfy both Separation of Concerns and the Principle of Least Privilege in Cloud Spanner, each principal should receive only the permissions required for their specific role. The correct assignment is: Person A (DBA) gets roles/spanner.databaseAdmin, which grants full DDL and
Question
Your organization operates in a highly regulated industry. Separation of concerns (SoC) and security principle of least privilege (PoLP) are critical. The operations team consists of:
- Person A is a database administrator.
- Person B is an analyst who generates metric reports.
- Application C is responsible for automatic backups.
You need to assign roles to team members for Cloud Spanner. Which roles should you assign?
Options
- Aroles/spanner.databaseAdmin for Person A
- Broles/spanner.databaseAdmin for Person A
- Croles/spanner.databaseAdmin for Person A
- Droles/spanner.databaseAdmin for Person A
How the community answered
(55 responses)- A87% (48)
- B2% (1)
- C4% (2)
- D7% (4)
Explanation
To satisfy both Separation of Concerns and the Principle of Least Privilege in Cloud Spanner, each principal should receive only the permissions required for their specific role. The correct assignment is: Person A (DBA) gets roles/spanner.databaseAdmin, which grants full DDL and DML access needed to manage the database; Person B (analyst) gets roles/spanner.databaseReader, which provides read-only access sufficient for generating metric reports; Application C (automated backups) gets roles/spanner.backupWriter, which grants only the permission needed to create backups without broader database access. Granting databaseAdmin to analysts or the backup application would violate PoLP by providing far more access than necessary.
Topics
Community Discussion
No community discussion yet for this question.