An analytics team needs to read data out of Cloud SQL for SQL Server and update a table in Cloud Spanner. You need to create a service account and grant least privilege access using predefined…

The correct answer is A. roles/cloudsql.viewer and roles/spanner.databaseUser. The principle of least privilege means granting only the permissions needed. For reading from Cloud SQL, roles/cloudsql.viewer is the minimum read-only predefined role that allows access to Cloud SQL instance data without write permissions. For writing to Cloud Spanner…

Ensuring database security and compliance

Question

An analytics team needs to read data out of Cloud SQL for SQL Server and update a table in Cloud Spanner. You need to create a service account and grant least privilege access using predefined roles. What roles should you assign to the service account?

Options

Aroles/cloudsql.viewer and roles/spanner.databaseUser
Broles/cloudsql.editor and roles/spanner.admin
Croles/cloudsql.client and roles/spanner.databaseReader
Droles/cloudsql.instanceUser and roles/spanner.databaseUser

How the community answered

(31 responses)

A
77% (24)
B
3% (1)
C
6% (2)
D
13% (4)

Explanation

The principle of least privilege means granting only the permissions needed. For reading from Cloud SQL, roles/cloudsql.viewer is the minimum read-only predefined role that allows access to Cloud SQL instance data without write permissions. For writing to Cloud Spanner, roles/spanner.databaseUser grants both read and write access to Spanner database data - the minimum role that allows INSERT/UPDATE operations. Option B grants excessive privileges (cloudsql.editor allows writes to Cloud SQL; spanner.admin is full admin). Option C (spanner.databaseReader) only allows reads on Spanner, not writes. Option D (cloudsql.instanceUser) is for OS-level login, not SQL data access.

Topics

#IAM#Cloud SQL#Cloud Spanner#Least Privilege

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-DATABASE-ENGINEER Practice