An enterprise platform engineering team is preparing an automated pipeline to deploy a secure Cloud SQL for PostgreSQL database instance. The solution must strictly enforce network isolation using Private Service Access and enforce data encryption at rest using a Customer-Managed Encryption Key (CMEK). In what sequence should the cloud architect arrange the implementation steps to provision this infrastructure successfully without service dependency failures?
- 1Create a Cloud KMS key ring and CryptoKey, then assign the Cloud SQL Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the key.
- 2Allocate an internal IP range in the Virtual Private Cloud (VPC) and establish a Private Services Access connection to the Google service networking network.
- 3Provision the Cloud SQL for PostgreSQL instance, configuring it with Private IP on the peered VPC network and specifying the CMEK resource name.
- 4Provision the logical application databases and user credentials within the newly created Cloud SQL instance.
Cevap
The correct provisioning order requires setting up security and network dependencies prior to resource creation: first create and authorize the KMS key, second allocate private IP peering via Private Service Access, third provision the Cloud SQL instance referencing the key and network, and finally create internal databases and user credentials.
The correct sequence respects resource dependencies in Google Cloud. Configuring the Cloud KMS key and granting necessary IAM permissions to the Cloud SQL Service Agent is required first so the API can validate key access. Establishing Private Services Access (VPC peering and private IP allocation) is required second so the private IP interface can be bound. Provisioning the Cloud SQL instance referencing both the network and the CMEK key comes third. Finally, creating logical database schemas and application users inside the instance comes last because these resources depend on the active instance engine.
Adım Adım Çözüm
Anahtar Kavram
Dependency-Ordered Cloud Provisioning for CMEK and Private Service Access