Custom Role Cloudsql Recommender Group

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise security team is reviewing access controls across production Google Cloud projects. The Database Operations group (dba-team@example.com) currently holds the predefined roles/cloudsql.admin role. An IAM evaluation and recommender analysis reveal that this group only requires read-only visibility into database configurations via the Google Cloud console, along with the ability to view Cloud SQL security insights and recommendations.

To adhere to the principle of least privilege while ensuring the Google Cloud console functions properly, which action should the security engineer take?

Grant the predefined roles/cloudsql.viewer role and the roles/recommender.iamAdmin role directly to individual user accounts within the database operations team.

Create a custom IAM role that includes only the cloudsql.instances.list and recommender.iamPolicyRecommendations.list permissions, and bind it to the dba-team@example.com group.

Create a custom IAM role that contains both cloudsql.instances.list and cloudsql.instances.get permissions alongside recommender.cloudsqlInstanceSecurity permissions, and bind the role to the dba-team@example.com group.

Grant the basic roles/viewer role to the dba-team@example.com group at the organization level.

Professional Cloud Security Engineer

Custom Role Cloudsql Recommender Group

Related questions