The finance department needs to use a Cloud Composer DAG to connect to a legacy PostgreSQL database in a VPC network. The DAG must use Workload…

The most secure and recommended method for a Cloud Composer (which runs on GKE) workload to access a Google Cloud resource like Cloud SQL is by using Workload Identity. This approach associates a dedicated Google Service Account (GSA) with the Kubernetes Service Account (KSA) used by the Airflow worker pods. By granting this GSA the specific, least-privilege roles/cloudsql.client IAM role, the worker can securely authenticate to the Cloud SQL Auth Proxy without needing to manage or store database credentials. The proxy then establishes a secure connection to the PostgreSQL database instance within the VPC. This method directly fulfills the requirement of using Workload Identity for secure authentication.

A. Storing credentials in an Airflow variable is insecure as they are not encrypted at rest and are easily accessible. It also does not use Workload Identity.

B. While Kubernetes Secrets are a valid way to store credentials, this method is for traditional username/password authentication, not the identity-based authentication required by Workload Identity.

D. Granting the highly permissive Project Editor role to any service account, especially the default one, violates the principle of least privilege and creates a significant security risk.

1. Google Cloud Documentation - Cloud Composer: "Configure Workload Identity". This document explicitly states, "Workload Identity is the recommended way for your DAGs to access Google Cloud services in a secure and manageable way." It details the process of using a custom service account for Airflow workers. (See section: "Use Workload Identity in your environment").

2. Google Cloud Documentation - Cloud SQL for PostgreSQL: "Connect from Google Kubernetes Engine". This guide details the use of the Cloud SQL Auth Proxy to connect from GKE. It specifies the required permissions: "The service account for your application must have the Cloud SQL Client role." (See section: "Before you begin", Step 4).

3. Google Cloud Documentation - IAM: "Cloud SQL roles". This page defines the roles/cloudsql.client role, stating it "Provides permissions to connect to Cloud SQL instances." This confirms it as the correct, least-privilege role for this task. (See table entry for "Cloud SQL Client").