Examkin

Question

Difficulty: MediumManaging Encryption Keys with Cloud KMS

A DevOps engineer is configuring Customer-Managed Encryption Keys (CMEK) in Google Cloud KMS for a Cloud Storage bucket that stores database backups. Corporate security policy mandates strict separation of duties: the Cloud Storage service agent must only be able to perform encryption and decryption operations with the key, while the security operations team must manage key lifecycle and IAM access policies without having permission to encrypt or decrypt data. Which TWO actions should be performed to satisfy these requirements?

  1. Grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific CryptoKey.Answer
  2. Grant the security operations team the Cloud KMS Admin role (roles/cloudkms.admin) on the CryptoKey or Key Ring.Answer
  3. C
    Grant the security operations team the Owner primitive role (roles/owner) on the project hosting the Cloud KMS key ring.
  4. D
    Assign the Cloud Storage Service Agent permissions at the organization level and define a folder-level deny policy for unapproved key rings.
  5. E
    Delete the Cloud KMS Key Ring immediately after binding the CryptoKey to Cloud Storage to clean up administrative resources.

Answer

To enforce separation of duties, grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific CryptoKey, and grant the security operations team the Cloud KMS Admin role (roles/cloudkms.admin) on the CryptoKey or Key Ring.
Enforcing separation of duties in Cloud KMS requires granting functional roles to separate identities: `roles/cloudkms.cryptoKeyEncrypterDecrypter` provides data access permissions specifically to the Cloud Storage service agent, while `roles/cloudkms.admin` provides administrative key management permissions to the security operations team without allowing them to decrypt stored data.

Step-by-Step Solution

1
Identify the data access requirements for the service account performing encryption/decryption operations.
The Cloud Storage service agent requires the predefined role `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the key.
This allows the service agent to encrypt and decrypt bucket objects without granting administrative control over key management.
2
Identify the administrative requirements for key management without data access.
The security team requires `roles/cloudkms.admin` on the Key Ring or CryptoKey.
This role grants lifecycle and IAM management rights but does not contain `cloudkms.cryptoKeyVersions.useToEncrypt` or `cloudkms.cryptoKeyVersions.useToDecrypt` permissions.

Key Concept

Separation of Duties in Cloud KMS IAM Roles
Estimated Time:1m 30s
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic