Examkin

Question

Difficulty: MediumProvisioning Storage and Database Systems

An enterprise platform engineering team is preparing an automated pipeline to deploy a secure Cloud SQL for PostgreSQL database instance. The solution must strictly enforce network isolation using Private Service Access and enforce data encryption at rest using a Customer-Managed Encryption Key (CMEK). In what sequence should the cloud architect arrange the implementation steps to provision this infrastructure successfully without service dependency failures?

  1. 1Create a Cloud KMS key ring and CryptoKey, then assign the Cloud SQL Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the key.
  2. 2Allocate an internal IP range in the Virtual Private Cloud (VPC) and establish a Private Services Access connection to the Google service networking network.
  3. 3Provision the Cloud SQL for PostgreSQL instance, configuring it with Private IP on the peered VPC network and specifying the CMEK resource name.
  4. 4Provision the logical application databases and user credentials within the newly created Cloud SQL instance.

Answer

The correct provisioning order requires setting up security and network dependencies prior to resource creation: first create and authorize the KMS key, second allocate private IP peering via Private Service Access, third provision the Cloud SQL instance referencing the key and network, and finally create internal databases and user credentials.
The correct sequence respects resource dependencies in Google Cloud. Configuring the Cloud KMS key and granting necessary IAM permissions to the Cloud SQL Service Agent is required first so the API can validate key access. Establishing Private Services Access (VPC peering and private IP allocation) is required second so the private IP interface can be bound. Provisioning the Cloud SQL instance referencing both the network and the CMEK key comes third. Finally, creating logical database schemas and application users inside the instance comes last because these resources depend on the active instance engine.

Step-by-Step Solution

1
Configure encryption infrastructure and IAM permissions
Cloud KMS CryptoKey is created and the Cloud SQL Service Agent ([email protected]) has permissions to encrypt and decrypt.
Cloud SQL API calls specify the CMEK key during creation; if the service agent lacks permissions at creation time, deployment fails immediately.
2
Set up private networking infrastructure
Internal IP block is reserved in the VPC and VPC Network Peering is established with Google's Service Networking tenant project.
Private Service Access must exist for Cloud SQL to assign a private IP address from the designated range.
3
Execute Cloud SQL instance creation
Cloud SQL instance is created in a private subnet, encrypted with CMEK.
Both prerequisites (network peering and KMS permissions) are satisfied, allowing the instance resource to instantiate.
4
Configure databases and application users
PostgreSQL database schemas and user identities are configured.
Logical database structures exist inside the database instance and can only be created on a running instance.

Key Concept

Dependency-Ordered Cloud Provisioning for CMEK and Private Service Access
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic