You are planning to migrate a 10TB relational database from an on-premises environment la Cloud SQL for PostgreSQL. The database contains sensitive customer Information. You want to follow Google-recommended practices to keep data secure during the migration. What should you do? Choose 2 answers

To securely migrate a sensitive on-premises database to Cloud SQL, the primary goals are to protect data in transit and control access to the new instance. Establishing a Private Service Connect connection creates a secure, private network endpoint for the Cloud SQL instance within your VPC, which can be accessed from your on-premises environment via Cloud VPN or Interconnect. This prevents data from traversing the public internet. Additionally, configuring the instance with an internal IP address and using Identity and Access Management (IAM) roles enforces the principle of least privilege, ensuring only authorized identities can access and manage the database, which is a fundamental security best practice.

C. Using an external IP address exposes the database to the public internet, which is not a recommended practice for sensitive data, even with firewall rules.
D. Automatic patching and binary logging are important for ongoing operational security and recovery, not specifically for securing the data transfer during the migration phase.
E. Storage Transfer Service is designed for moving data to Cloud Storage, not for migrating a live relational database to Cloud SQL.

1. Private IP and IAM: Google Cloud documentation explicitly recommends using private IP addresses and IAM database authentication for security. "To prevent access from untrusted sources, we recommend that you... Don't grant extensive access... Use IAM database authentication... When possible, use private IP addresses."

Source: Google Cloud Documentation, "Security recommendations for Cloud SQL", Section: "Network security".

2. Private Service Connect: This service is designed to provide private connectivity to Cloud SQL instances, avoiding public IP exposure. "Private Service Connect lets you connect to Cloud SQL instances from multiple VPC networks that belong to different groups, teams, projects, or organizations."

Source: Google Cloud Documentation, "Private Service Connect for Cloud SQL", Overview section.

3. IAM Roles for Access Control: IAM provides granular control over who can manage and access Cloud SQL instances, which is a core security principle. "Cloud SQL is integrated with Identity and Access Management (IAM) to help you manage access to your Cloud SQL instances."

Source: Google Cloud Documentation, "Overview of access control for Cloud SQL".