PROFESSIONAL-CLOUD-DEVELOPER · Question #122
You are deploying your application on a Compute Engine instance that communicates with Cloud SQL. You will use Cloud SQL Proxy to allow your application to communicate to the database using the servic
The correct answer is C. Assign the Cloud SQL Client role.. The principle of least privilege requires granting only the permissions necessary to perform a task. The Cloud SQL Client role grants the minimal permissions needed to connect to a Cloud SQL instance via the Cloud SQL Auth Proxy - specifically the cloudsql.instances.connect permi
Question
You are deploying your application on a Compute Engine instance that communicates with Cloud SQL. You will use Cloud SQL Proxy to allow your application to communicate to the database using the service account associated with the application's instance. You want to follow the Google-recommended best practice of providing minimum access for the role assigned to the service account. What should you do?
Options
- AAssign the Project Editor role.
- BAssign the Project Owner role.
- CAssign the Cloud SQL Client role.
- DAssign the Cloud SQL Editor role.
How the community answered
(44 responses)- A7% (3)
- B5% (2)
- C73% (32)
- D16% (7)
Explanation
The principle of least privilege requires granting only the permissions necessary to perform a task. The Cloud SQL Client role grants the minimal permissions needed to connect to a Cloud SQL instance via the Cloud SQL Auth Proxy - specifically the cloudsql.instances.connect permission. No broader database administration rights are required for a connecting application. Project Editor (Option A) and Project Owner (Option B) grant far-reaching permissions across the entire project, violating least privilege. Cloud SQL Editor (Option D) grants rights to modify Cloud SQL instance configurations, which is broader than what a connecting application needs.
Topics
Community Discussion
No community discussion yet for this question.