CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Best Practices for Managing Database Credentials in GCP-ACE
Understanding how to manage database credentials securely is crucial for GCP-ACE success. Learn the best practices and avoid common pitfalls.
Managing sensitive data securely is a frequent stumbling block for candidates. Developers must understand best practices to protect credentials and avoid vulnerabilities.
The question
A developer needs to deploy an application that will use sensitive data stored in a Cloud SQL database. What is the best practice for managing database credentials securely?
- A. Store credentials in the application's source code.
- B. Use Secret Manager to store and manage database credentials.
- C. Hardcode credentials in environment variables.
- D. Use IAM roles to grant access to the database without credentials.
Think before you scroll
Before you choose an answer, consider how each option manages security and access to sensitive information. Think about the risks associated with exposing credentials and the tools available in Google Cloud Platform (GCP).
The answer
The correct option is B. Use Secret Manager to store and manage database credentials. This approach provides secure and controlled access to sensitive information, aligning with best practices for credential management.
Why the other options lose
- A. Store credentials in the application's source code. This method exposes sensitive information directly in the codebase, increasing the risk of unauthorized access and making it difficult to manage changes securely.
- C. Hardcode credentials in environment variables. While slightly better than storing them in source code, hardcoding credentials still poses a security risk. Environment variables can be exposed in various ways, making this approach insecure.
- D. Use IAM roles to grant access to the database without credentials. IAM roles can provide access control but do not eliminate the need for credentials. In this scenario, database credentials are still necessary to access the Cloud SQL database securely.
The concept behind it
The principle here is to always keep sensitive information secure. Tools like Secret Manager are designed to manage and protect credentials effectively. This practice ensures that access to sensitive data is controlled and monitored.
Exam trap to remember
Always avoid hardcoding credentials—secure storage solutions are essential for protecting sensitive data.