PROFESSIONAL-CLOUD-DATABASE-ENGINEER · Question #32
You are deploying a new Cloud SQL instance on Google Cloud using the Cloud SQL Auth proxy. You have identified snippets of application code that need to access the new Cloud SQL instance. The…
The correct answer is C. For the application server, set up a service account. The Google-recommended practice for workloads running on Compute Engine is to attach a service account to the VM instance. The Cloud SQL Auth proxy automatically uses the service account's credentials to authenticate to Cloud SQL, removing the need to manage passwords. Service…
Question
You are deploying a new Cloud SQL instance on Google Cloud using the Cloud SQL Auth proxy. You have identified snippets of application code that need to access the new Cloud SQL instance. The snippets reside and execute on an application server running on a Compute Engine machine. You want to follow Google-recommended practices to set up Identity and Access Management (IAM) as quickly and securely as possible. What should you do?
Options
- AFor each application code, set up a common shared user account.
- BFor each application code, set up a dedicated user account.
- CFor the application server, set up a service account.
- DFor the application server, set up a common shared user account.
How the community answered
(21 responses)- A14% (3)
- B5% (1)
- C76% (16)
- D5% (1)
Explanation
The Google-recommended practice for workloads running on Compute Engine is to attach a service account to the VM instance. The Cloud SQL Auth proxy automatically uses the service account's credentials to authenticate to Cloud SQL, removing the need to manage passwords. Service accounts are tied to the machine identity rather than a human user, follow the principle of least privilege, and are far more secure than shared user accounts (options A and D) or per-snippet dedicated human accounts (option B), which would be difficult to manage and audit.
Topics
Community Discussion
No community discussion yet for this question.