Examkin

Question

Difficulty: MediumProvisioning Storage and Database Systems

A cloud architect is establishing an automated deployment sequence to provision a high-availability Cloud SQL PostgreSQL database instance using Customer-Managed Encryption Keys (CMEK) and Private Services Access (PSA) within a dedicated VPC. To ensure all infrastructure dependencies and security access controls are satisfied before instance initialization, in what correct sequential order should these provisioning steps be executed?

  1. 1Enable the required Google Cloud APIs for Cloud SQL, Cloud KMS, and Service Networking.
  2. 2Allocate an internal IP range and establish a Private Services Access connection with the service producer network in the VPC.
  3. 3Grant the Cloud SQL Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the target encryption key.
  4. 4Provision the regional Cloud SQL PostgreSQL instance configured with Private IP and the customer-managed encryption key.

Answer

The correct sequence is: 1) Enable the required Google Cloud APIs for Cloud SQL, Cloud KMS, and Service Networking, 2) Allocate an internal IP range and establish a Private Services Access connection with the service producer network in the VPC, 3) Grant the Cloud SQL Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the target encryption key, and 4) Provision the regional Cloud SQL PostgreSQL instance configured with Private IP and the customer-managed encryption key.
Provisioning managed database systems with strict security controls requires resolving infrastructure dependencies sequentially. First, service APIs must be enabled to activate Cloud KMS, Service Networking, and Cloud SQL capabilities along with their respective service agents. Second, Private Services Access must be configured by reserving an internal IP block and creating VPC peering so the database can bind to a private IP. Third, IAM access must be delegated to the Cloud SQL Service Agent on the Cloud KMS key so it can encrypt storage blocks during creation. Finally, the Cloud SQL instance can be provisioned referencing both the private network and the CMEK key.

Step-by-Step Solution

1
Enable required Google Cloud Service APIs
Cloud SQL Admin API, KMS API, and Service Networking API become active, spawning the necessary service account identities.
Infrastructure APIs must be activated before downstream networking peering or IAM role assignments can be managed.
2
Set up Private Services Access (PSA)
An IP block is allocated and VPC network peering to Google Service Networking is created.
Cloud SQL instances with Private IP require an established Private Services Access connection to route private network traffic within the VPC.
3
Configure CMEK IAM Permissions
The Cloud SQL Service Agent ([email protected]) receives the roles/cloudkms.cryptoKeyEncrypterDecrypter role.
Cloud SQL validates encryption key access at creation time; omitting this step prior to creation causes instance initialization to fail.
4
Deploy the Cloud SQL Instance
The database instance provisions successfully with private networking and customer-managed encryption.
All prerequisite infrastructure, network routing, and IAM key delegation are ready for resource allocation.

Key Concept

Sequential Dependency Resolution for Cloud SQL Private Services Access and CMEK Provisioning
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic