Google Associate Cloud EngineerPlanning and configuring a cloud solutionHard
A developer is building a new application that needs to securely connect to a Cloud SQL instance from a Compute Engine instance located in a private VPC network. The connection must not traverse the public internet. Which is the most secure and recommended way to establish this connection?
- AConfigure VPC Service Controls around the Cloud SQL instance.
- BEstablish a VPN tunnel between the Compute Engine instance and the Cloud SQL instance.
- CUse the Cloud SQL Auth Proxy on the Compute Engine instance.
- DConfigure the Cloud SQL instance with a public IP address and restrict access using authorized networks.
Show answer & explanationAnswer & explanation
Correct answer: C. Use the Cloud SQL Auth Proxy on the Compute Engine instance.
The Cloud SQL Auth Proxy provides a secure way to connect to Cloud SQL instances from Compute Engine without exposing the database to the public internet. It uses IAM for authentication and encrypts all traffic, ensuring a secure and private connection.
Why the other options are wrong
- A. VPC Service Controls help create security perimeters around Google Cloud resources to prevent data exfiltration, but they don't directly facilitate a private network connection method between a Compute Engine instance and Cloud SQL; the Auth Proxy handles the connection itself.
- B. While a VPN tunnel can secure traffic, establishing a VPN directly between a single Compute Engine instance and a Cloud SQL instance is overly complex and not the recommended, managed solution for this specific use case, especially when the Auth Proxy exists.
- D. Using a public IP address, even with authorized networks, still exposes the instance to the public internet, which is less secure than a private connection.
Cloud SQL Auth Proxy
A proxy client for Cloud SQL that provides secure, encrypted connections to Cloud SQL instances without the need for whitelisted IP addresses or SSL certificates.
- Uses IAM for authentication.
- Encrypts all traffic.
- Connects to Cloud SQL instances privately.
Memory trick: Auth Proxy privately connects securely.