You are the database specialist at BlueOrbit Logistics and you must grant access for a group of analysts who need to run queries against Cloud Spanner production databases while they must not write…

The correct answer is B. roles/spanner.databaseReader. roles/spanner.databaseReader grants SELECT (read) access to data in Cloud Spanner databases without any ability to write data, modify schemas, or perform instance administration-exactly matching the analysts' requirements. roles/spanner.databaseAdmin (Option A) allows schema…

Securing database systems

Question

You are the database specialist at BlueOrbit Logistics and you must grant access for a group of analysts who need to run queries against Cloud Spanner production databases while they must not write data, change schemas, or administer instances. Which IAM role should you assign to meet this requirement?

Options

Aroles/spanner.databaseAdmin
Broles/spanner.databaseReader
Croles/spanner.viewer
Droles/spanner.databaseUser

How the community answered

(46 responses)

A
2% (1)
B
87% (40)
C
7% (3)
D
4% (2)

Explanation

roles/spanner.databaseReader grants SELECT (read) access to data in Cloud Spanner databases without any ability to write data, modify schemas, or perform instance administration-exactly matching the analysts' requirements. roles/spanner.databaseAdmin (Option A) allows schema changes and full database management, which violates the restriction. roles/spanner.viewer (Option C) grants visibility into instance and database metadata (configuration, IAM policies) but does not allow querying actual table data. roles/spanner.databaseUser (Option D) allows both reads and writes to data, which violates the no-write requirement.

Topics

#IAM Roles#Cloud Spanner#Access Control#Database Security

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-DATABASE-ENGINEER Practice