A security administration team needs to perform an immediate manual key rotation for a customer-managed key stored in Google Cloud KMS due to a updated corporate compliance policy. The team must ensure that new data is encrypted using the updated key version, existing data can still be decrypted, and least privilege IAM access is maintained without granting administrative control over the key ring. Which of the following actions should you perform to meet these requirements? (Select TWO)
- Create a new CryptoKeyVersion under the existing CryptoKey and set it as the primary version.Answer
- BDelete the old Cloud KMS Key Ring using gcloud to ensure outdated key material cannot be accessed.
- Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to application service accounts requiring data access instead of primitive roles.Answer
- DAssign the primitive Owner role on the project to the application service accounts to ensure uninterrupted key operation permissions.
- EConfigure an IAM deny policy on the child key ring resource to override access permissions granted at the parent project level.
Answer
To perform manual rotation while preserving decryption capabilities and least-privilege security, create a new CryptoKeyVersion and set it as primary, and assign the predefined Cloud KMS CryptoKey Encrypter/Decrypter role to application service accounts.
Creating a new key version and making it primary enables manual key rotation while keeping older versions active for decrypting previously encrypted data. Combining this with the predefined Cloud KMS CryptoKey Encrypter/Decrypter role ensures service accounts have only the cryptographic capabilities required for application workloads without administrative control over key resources.
Step-by-Step Solution
Key Concept
Cloud KMS Key Rotation and IAM Least Privilege