Your organization operates in a highly regulated industry. Separation of concerns (SoC) and security principle of least privilege (PoLP) are critical. The operations team consists of: Person A is a database administrator. Person B is an analyst who generates metric reports. Application C is responsible for automatic backups. You need to assign roles to team members for Cloud Spanner. Which roles should you assign?
Show Answer & Explanation
Correct Answer: A. roles/spanner.databaseAdmin for Person A roles/spanner.databaseReader for Person B roles/spanner.backupWriter for Application C
Using least privilege (PoLP) and separation of concerns (SoC) for Cloud Spanner IAM: DBA needs full database admin rights → roles/spanner.databaseAdmin Analyst only reads data for reports → roles/spanner.databaseReader Backup application only creates backups → roles/spanner.backupWriter A is correct because backupWriter allows creating backups without granting excessive admin rights — perfectly aligned with PoLP.B is wrong because backupAdmin grants both create AND delete backup permissions — too broad for an automated backup process.C is wrong because databaseReader for the backup application gives read-only data access but no backup creation rights at all.D is wrong because databaseUser for the analyst allows both reads and writes — too broad for a report-only role.