As a Database Engineer, you are responsible for setting up secure connectivity and access control for your organization's Google Cloud Spanner databases. Which of the following IAM roles should be granted to a user who only needs to read data from the Spanner databases, without modifying or managing the instances?