An analytics team needs to read data out of Cloud SQL for SQL Server and update a table in Cloud Spanner. You need to create a service account and grant least privilege access using predefined roles. What roles should you assign to the service account?

The principle of least privilege dictates assigning only the permissions essential for a task. To read data from Cloud SQL, the service account must first connect to the instance. The roles/cloudsql.instanceUser role grants the necessary cloudsql.instances.connect permission for this. To update a table in Cloud Spanner, the service account needs write access to the data. The roles/spanner.databaseUser role provides permissions to both read from and write to a database, which is the most precise fit for updating data without granting excessive administrative privileges.

A. roles/cloudsql.viewer does not grant permission to connect to the database instance to read data; it only allows viewing the instance's metadata.
B. roles/cloudsql.editor and roles/spanner.admin are administrative roles that provide far more permissions than needed, violating the principle of least privilege.
C. roles/spanner.databaseReader is a read-only role and is insufficient for the requirement to update a table in Cloud Spanner. ---

1. Google Cloud Documentation, "Cloud SQL > Predefined Cloud IAM roles": This document specifies the permissions for each Cloud SQL role. It shows that roles/cloudsql.instanceUser contains cloudsql.instances.connect, which is required for a service account to connect to an instance. In contrast, roles/cloudsql.viewer lacks this permission.

Source: Google Cloud, Cloud SQL Documentation, "Predefined Cloud IAM roles". Accessed at https://cloud.google.com/sql/docs/mysql/iam-roles#predefined-roles (Note: Roles are consistent across Cloud SQL database engines).

2. Google Cloud Documentation, "Spanner > Access control with IAM": This page details the Spanner IAM roles. It defines roles/spanner.databaseUser as providing permissions to read and write data (spanner.databases.read, spanner.databases.write), which aligns with the "update a table" requirement. It also shows that roles/spanner.databaseReader is read-only and roles/spanner.admin is for full control.

Source: Google Cloud, Spanner Documentation, "Access control with IAM", section "Predefined roles". Accessed at https://cloud.google.com/spanner/docs/iam#predefinedroles.