Examkin

Question

Difficulty: Very hardManaging Storage and Database Solutions

Your organization requires a cloud engineer to export a production Cloud SQL for PostgreSQL instance to a Cloud Storage bucket for long-term compliance archiving. The destination bucket has restricted access, and the export operation must execute successfully without permission errors. What is the correct sequence of steps to perform and verify this database export using the gcloud CLI?

  1. 1Retrieve the automatically assigned service account email address for the Cloud SQL instance using `gcloud sql instances describe`.
  2. 2Grant the Cloud SQL service account the Storage Object Admin (`roles/storage.objectAdmin`) role on the target Cloud Storage bucket.
  3. 3Initiate the database export by running `gcloud sql export sql` with the instance name, database name, and Cloud Storage URI specified.
  4. 4Check the progress and verify completion of the export task by running `gcloud sql operations list` or `gcloud sql operations describe`.

Answer

The correct order of operations is: First, retrieve the Cloud SQL instance's managed service account email. Second, grant that service account the Storage Object Admin role on the destination bucket. Third, run `gcloud sql export sql` to start the export job. Fourth, monitor the operation using `gcloud sql operations list` or `describe` until it completes.
Exporting data from Cloud SQL to Cloud Storage requires proper IAM authorization for the instance's managed service account. The process must begin by describing the Cloud SQL instance to extract its automatically generated service account email. Next, that service account must be granted write access (`roles/storage.objectAdmin`) on the destination GCS bucket. After IAM permissions are active, executing `gcloud sql export sql` starts the asynchronous dump process. Finally, executing `gcloud sql operations list` or `describe` confirms that the asynchronous task finished without errors.

Step-by-Step Solution

1
Identify Cloud SQL Service Account
Obtained the unique Cloud SQL instance service account email address.
Cloud SQL background processes run under the instance's unique service account rather than the identity of the user invoking the CLI command.
2
Configure Storage IAM Permissions
Granted `roles/storage.objectAdmin` on the destination Cloud Storage bucket to the Cloud SQL service account.
Without explicit bucket-level write permissions, the Cloud SQL service account will fail to write the SQL dump file to the bucket.
3
Execute the SQL Export Command
Started the asynchronous export job sending data to `gs://<bucket-name>/<filename>.sql`.
Once authorization is in place, `gcloud sql export sql` triggers the actual database dump generation.
4
Verify Operation Completion
Confirmed that the operational status of the export job transitioned to `DONE`.
Because export commands return an operation ID and run asynchronously, verifying operation state via `gcloud sql operations` is necessary to ensure success.

Key Concept

Cloud SQL Instance Service Account Authorization and Data Export Lifecycle
Rate this question

Topics

Managing Storage and Database Solutions