PCD Question 105

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  https://cloud.google.com/sql/docs/mysql/roles-and-permissions#:~:text=When%20you%20use%20an%20account%20to%20connect%20to%20a%20Cloud%20SQL%20instance%2C%20the%20account%20must%20have%20the%20Cloud%20SQL%20%3E%20Client%20role%20(roles/cloudsql.client)%2C%20which%20includes%20the%20permissions%20required%20for%20connecting.

• Chose C1

  Cloud SQL Client role: This role provides the necessary permissions to interact with Cloud SQL while minimizing access to other resources.

• 1

  C. Assign the Cloud SQL Client role. The Cloud SQL Client role has the minimal set of permissions required to access Cloud SQL instances. This role includes permissions to connect to and use a Cloud SQL instance, but it doesn't include permissions to create, delete or manage the instance itself. This role should be granted to the service account associated with your Compute Engine instance, in order to allow your application to connect to the Cloud SQL instance using the Cloud SQL Proxy. You can assign the Cloud SQL Client role to a service account by using the Cloud Console, the gcloud command-line tool, or the Cloud Identity and Access Management (IAM) API. Once the role is assigned, your application will be able to authenticate to Cloud SQL using the service account and the Cloud SQL Proxy. It is important to note that the permissions granted by this role should be limited to the specific Cloud SQL instance that the application needs to connect to and not the entire project, to minimize the access and follow the principle of least privilege.