Associate Data Practitioner

4.1 Configure access control and governance

Access control determines who or what can see and use data and services. In GCP, the main tool for this is Identity and Access Management (IAM). IAM lets you grant permissions to principals, which can be individual users, service accounts, or groups. Permissions are bundled into roles, and you assign a role to a principal for a specific resource. For example, you might give a data analyst a role on a BigQuery dataset that allows them to run queries but not delete the data. The flow of a permission check is: when a principal tries to perform an action, the system checks if they have a role on that resource granting the necessary permission.

Governance involves setting organization-wide rules and policies. Organization Policies are rules that apply to all resources in a folder or the entire organization, overriding IAM permissions. For instance, a policy could prevent anyone from creating resources with a public IP address, even if their IAM role would allow it. This creates a security boundary. Choosing between IAM and Organization Policies depends on the scope: use IAM for fine-grained access to specific resources, and use Organization Policies for broad guardrails that enforce compliance across many projects.

4.2 Configure lifecycle management

Lifecycle management automates what happens to data as it ages, mainly to control costs. This is most commonly applied to objects stored in Cloud Storage. You create lifecycle rules that trigger actions based on conditions like the object's age or storage class. For example, a rule can automatically move files that are 30 days old from the Standard storage class to the cheaper Nearline class, and then delete them after a year.

The lifecycle of an object moves through defined states based on these rules. An object starts in its initial storage class. When a rule's condition is met, the service performs the configured action, like a transition to a colder storage class or a deletion. This process depends on the object's metadata, specifically its creation time. You choose different rules based on the data's value over time: frequently accessed data stays in hotter, more expensive classes, while archival data moves to the coldest class. This trade-off balances access speed against storage cost.

4.3 Identify high availability and disaster recovery strategies for data in Cloud Storage and Cloud SQL

High availability (HA) means keeping data accessible during minor, local failures. For Cloud Storage, data is automatically stored redundantly across multiple zones in a region, providing high availability without extra configuration. For Cloud SQL, you enable HA by creating a primary instance with a standby replica in a different zone within the same region. If the primary fails, traffic automatically fails over to the standby.

Disaster recovery (DR) protects against major regional outages. For Cloud Storage, you can create a multi-region bucket, which stores copies of your data in at least two geographically separated regions. This provides the highest durability. For Cloud SQL, DR strategies include creating read replicas in a different region or taking regular backups and storing them in a multi-region Cloud Storage bucket. The choice between HA and DR involves a trade-off: HA setups within a region are faster and cheaper, while cross-region DR is more resilient to large-scale disasters but can have higher latency and cost.

4.4 Apply security measures and ensure compliance with data privacy regulations

Security measures protect data from unauthorized access and exposure. A key measure is encryption. Data in GCP services like Cloud Storage and BigQuery is encrypted at rest by default. You can also manage your own encryption keys using Cloud Key Management Service (KMS) for more control. For data in transit, use TLS/SSL encryption. Another important measure is Data Loss Prevention (DLP) API, which can scan and redact sensitive information like credit card numbers from datasets.

Compliance means following laws like GDPR or HIPAA. GCP provides tools to help. You can use Access Transparency logs to see when Google support personnel access your data. To control data location, you can use Organization Policies to restrict where data can be stored. For auditing, services like Cloud Audit Logs track all administrative actions. Ensuring compliance involves configuring these tools to meet your specific regulatory requirements, creating a clear audit trail of who accessed what data and when.