Database / Google Spanner Database Interview questions
How is fine-grained access control implemented in Spanner?
Beyond project-level IAM roles, which grant or deny access to an entire instance or database, Spanner supports database roles that restrict access down to individual tables, columns, or views inside a single database.
CREATE ROLE analyst; GRANT SELECT(CustomerId, OrderDate) ON TABLE Orders TO ROLE analyst; GRANT ROLE analyst TO 'user:jane@example.com';
A database role is defined with standard GRANT/REVOKE DDL, and IAM is used to grant a Cloud Identity principal the ability to act under that database role via the spanner.databaseRole.user permission. This two-layer model lets a team give broad IAM access to an application's service account while still restricting exactly which columns that account, or specific human users, can query, which matters for masking sensitive fields like PII from analysts who only need aggregate data.
What do Spanner database roles restrict access to, beyond IAM?
Which permission lets an IAM principal act under a database role?
More Related questions...
