Exam Professional Cloud Developer topic 1 question 105 discussion

I vote C https://cloud.google.com/sql/docs/mysql/roles-and-permissions

https://cloud.google.com/sql/docs/mysql/roles-and-permissions#:~:text=When%20you%20use%20an%20account%20to%20connect%20to%20a%20Cloud%20SQL%20instance%2C%20the%20account%20must%20have%20the%20Cloud%20SQL%20%3E%20Client%20role%20(roles/cloudsql.client)%2C%20which%20includes%20the%20permissions%20required%20for%20connecting.

Cloud SQL Client role: This role provides the necessary permissions to interact with Cloud SQL while minimizing access to other resources.

C. Assign the Cloud SQL Client role. The Cloud SQL Client role has the minimal set of permissions required to access Cloud SQL instances. This role includes permissions to connect to and use a Cloud SQL instance, but it doesn't include permissions to create, delete or manage the instance itself. This role should be granted to the service account associated with your Compute Engine instance, in order to allow your application to connect to the Cloud SQL instance using the Cloud SQL Proxy. You can assign the Cloud SQL Client role to a service account by using the Cloud Console, the gcloud command-line tool, or the Cloud Identity and Access Management (IAM) API. Once the role is assigned, your application will be able to authenticate to Cloud SQL using the service account and the Cloud SQL Proxy. It is important to note that the permissions granted by this role should be limited to the specific Cloud SQL instance that the application needs to connect to and not the entire project, to minimize the access and follow the principle of least privilege.

C is the answer. https://cloud.google.com/sql/docs/mysql/roles-and-permissions#proxy-roles-permissions If you are connecting to a Cloud SQL instance from a Compute Engine instance using Cloud SQL Auth proxy, you can use the default Compute Engine service account associated with the Compute Engine instance. As with all accounts connecting to a Cloud SQL instance, the service account must have the Cloud SQL > Client role.

C is correct