Professional Data EngineerBuilding and operationalizing data processing systemsHard
A data engineering team is developing a new streaming pipeline that processes real-time sensor data from industrial machinery. The data needs to be enriched with historical maintenance records stored in a Cloud SQL database. Due to data privacy regulations, the Cloud SQL database should only be accessible by specific service accounts with the least necessary privileges. Which Google Cloud security feature should be used to securely connect the Dataflow job to Cloud SQL?
- AService account-based authentication with Private IP.
- BAPI Keys for Cloud SQL authentication.
- CVPC Service Controls with a perimeter.
- DPublic IP connectivity with firewall rules.
Show answer & explanationAnswer & explanation
Correct answer: A. Service account-based authentication with Private IP.
Using service account-based authentication with Private IP for Cloud SQL ensures that the Dataflow job connects securely without exposing the database to the public internet, adhering to the principle of least privilege and data privacy regulations.
Why the other options are wrong
- B. API Keys are typically for API access and not the recommended secure authentication method for direct database connections like Cloud SQL from a Dataflow job.
- C. VPC Service Controls protect against data exfiltration but primarily by creating security perimeters, not by directly managing the connection method or authentication for a Dataflow job to Cloud SQL.
- D. Public IP with firewall rules exposes the database to the internet, which is a security risk and violates the principle of least privilege for sensitive data.
Service Account-based Authentication with Private IP
A secure method to connect Google Cloud services by assigning a service account to the client service (e.g., Dataflow) and configuring the database (e.g., Cloud SQL) for Private IP, allowing internal, authorized network access.
- Service accounts provide granular, auditable access control.
- Private IP ensures internal, secure network connectivity.
- Adheres to the principle of least privilege.
- Enhances security by eliminating public internet exposure.
Memory trick: Private IP + Service Account: The secret handshake.