Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A database administrator needs to create and configure Cloud SQL instances within a Google Cloud development project. The administrator must be able to perform all administrative tasks on Cloud SQL resources, but must not have permissions to manage other Google Cloud services or edit project IAM policies. Following Google's recommended security best practices of least privilege, which role should be granted to the administrator?

  1. Cloud SQL Admin (roles/cloudsql.admin)Answer
  2. B
    Editor (roles/editor)
  3. C
    Cloud SQL Viewer (roles/cloudsql.viewer)
  4. D
    Owner (roles/owner) at the project level with an IAM deny policy applied to other services

Answer

Grant the Cloud SQL Admin (roles/cloudsql.admin) predefined role at the project level.
The Cloud SQL Admin (roles/cloudsql.admin) predefined role provides complete administrative access to Cloud SQL instances, databases, and backups without granting access to manage unrelated GCP services or project-level IAM bindings.

Step-by-Step Solution

1
Analyze administrative requirements and resource scope
The user requires full control specifically over Cloud SQL instances without needing permissions on other GCP services.
Selecting an IAM role requires matching necessary permissions directly to specified job duties.
2
Evaluate role options against Google Cloud best practices
The predefined role Cloud SQL Admin (roles/cloudsql.admin) provides full management rights over Cloud SQL while scoped strictly to that service.
Google Cloud best practices dictate using predefined or custom roles instead of broad primitive roles to enforce least privilege.

Key Concept

Granting service-specific predefined roles rather than primitive roles to enforce the principle of least privilege.
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic