Examkin

Question

Difficulty: HardProvisioning Storage and Database Systems

An enterprise platform engineering team is setting up an automated Terraform provisioning pipeline for a production Cloud SQL for PostgreSQL database. Security and networking policies require that the database must utilize Customer-Managed Encryption Keys (CMEK), be accessible strictly via private IP over Private Services Access, and enforce IAM database authentication. To ensure an automated execution without resource dependency deadlocks or authorization failures, in what chronological order must these deployment steps be executed?

  1. 1Create the Cloud KMS KeyRing and CryptoKey in the target region, and grant the Cloud SQL Service Agent identity the Cloud KMS CryptoKey Encrypter/Decrypter IAM role.
  2. 2Allocate a named internal IP address range in the Virtual Private Cloud (VPC) network and create a Private Services Access connection to Google Managed Services.
  3. 3Provision the Cloud SQL for PostgreSQL instance configured with private IP networking, the CMEK key reference, and IAM database authentication enabled.
  4. 4Provision target database schemas and create IAM-authenticated database user accounts within the active instance.

Answer

The correct sequence for provisioning Cloud SQL with CMEK and Private Services Access is: 1) Create the Cloud KMS key and grant the Encrypter/Decrypter role to the Cloud SQL Service Agent; 2) Reserve an IP range and configure Private Services Access in the VPC; 3) Provision the Cloud SQL instance with private IP, CMEK reference, and IAM authentication; 4) Create database schemas and IAM database users.
Provisioning Cloud SQL infrastructure with CMEK and private connectivity requires strict adherence to foundational dependency chains. First, key permissions must be assigned to the Cloud SQL Service Agent (`[email protected]`) so GCP can access the CMEK key. Second, Private Services Access peering must be established in the VPC network so Cloud SQL can allocate internal IP addresses in the producer network. Third, the Cloud SQL instance is provisioned referencing the CMEK key and private network. Finally, database schemas and IAM database users are created inside the initialized database instance.

Step-by-Step Solution

1
Set up CMEK security permissions
Cloud SQL Service Agent obtains permissions to encrypt/decrypt using the target CryptoKey
Cloud SQL validates disk encryption permissions during initial instance creation. Lacking this permission causes instance creation to fail immediately.
2
Configure private network infrastructure
VPC peering is established between customer VPC and Google's service producer network
Private IP database instances cannot be attached to a VPC without an established Private Services Access peering connection.
3
Deploy the Cloud SQL instance
The Cloud SQL instance is provisioned with private IP connectivity and CMEK disk encryption
The database instance depends directly on pre-existing KMS role bindings and Private Services Access peering.
4
Configure database objects and access
Database schemas and IAM-mapped users are created
Logical database schemas and user roles are internal to the engine and require an operational database instance.

Key Concept

Cloud SQL Provisioning Dependency Sequencing
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic