Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ166

Integrating applications with Google Cloud services

For this question, use the HipLocal case study.

A recent security audit found that HipLocal’s database credentials for its Compute Engine-hosted MySQL databases are kept in plaintext on persistent disks. HipLocal must reduce the risk that these credentials could be stolen. What should it do?

  • A Create a service account and download its key. Use the key to authenticate to Cloud Key Management Service (KMS) to obtain the database credentials.
  • B Create a service account and download its key. Use the key to authenticate to Cloud Key Management Service (KMS) to obtain a key used to decrypt the database credentials.
  • C Create a service account and grant it the roles/iam.serviceAccountUser role. Impersonate as this account and authenticate using the Cloud SQL Proxy.
  • D Grant the roles/secretmanager.secretAccessor role to the Compute Engine service account. Store and access the database credentials with the Secret Manager API.
Explanation

Secret Manager is designed to store sensitive values such as database credentials. Granting the Compute Engine service account the Secret Manager Secret Accessor role lets the workload retrieve only the required secret through the API using its attached identity, rather than storing credentials on persistent disks or exporting a service-account key. Google Cloud recommends attached workload identities over exported service-account credentials and supports granting Secret Accessor at the individual-secret level for least-privilege access.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!