Examkin

Question

Difficulty: HardManaging Encryption Keys with Cloud KMS

An organization is deploying an application on Compute Engine that writes confidential audit logs to a Cloud Storage bucket using Customer-Managed Encryption Keys (CMEK). The compliance policy mandates strict separation of duties: security administrators must handle key creation and policy configuration, but must not be able to encrypt or decrypt data. Conversely, the application service account must only be able to encrypt and decrypt data using the key. Which TWO IAM configurations fulfill these requirements according to Google Cloud best practices?

  1. Grant the security administrators the Cloud KMS Admin role (roles/cloudkms.admin) on the Key Ring, and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the CryptoKey.Answer
  2. B
    Grant the security administrators the Project Owner role (roles/owner) at the project level to allow key lifecycle management, while granting the Compute Engine default service account the Cloud KMS CryptoKey Encrypter/Decrypter role.
  3. C
    Grant the Cloud Storage Service Agent the Cloud KMS Admin role on the Key Ring so it can automatically manage key rotation schedules during bucket write operations.
  4. D
    Ensure that the security administrators are granted the Cloud KMS CryptoKey Encrypter/Decrypter role on the project level so permissions inherit down to all newly created Key Rings.
  5. E
    Revoke all IAM permissions from security administrators after key creation and permanently delete the Cloud KMS Key Ring object to prevent further configuration changes.

Answer

Granting the Cloud KMS Admin role to security administrators allows administrative key operations without data encryption/decryption capabilities. Granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage Service Agent allows the service to perform CMEK cryptographic operations for the bucket.
The correct security baseline mandates granting the predefined Cloud KMS Admin role to key managers so they can manage permissions and key settings without ability to inspect encrypted data. Concurrently, assigning the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Cloud Storage Service Agent allows automated CMEK bucket operations under least privilege.

Step-by-Step Solution

1
Identify role requirements for security administrators based on separation of duties
Security administrators require key administration (creating keys, managing IAM permissions) but must not possess data encryption/decryption capabilities.
The predefined role 'Cloud KMS Admin' (roles/cloudkms.admin) provides key management access without granting 'cloudkms.cryptoKeyVersions.useToEncrypt' or 'cloudkms.cryptoKeyVersions.useToDecrypt'.
2
Identify service account CMEK permissions required for Cloud Storage
The Cloud Storage Service Agent (not the compute engine default service account or admin user) requires cryptographic permissions to use the key for CMEK operations.
When configuring CMEK on Cloud Storage buckets, Google Cloud uses the Cloud Storage Service Agent identity to perform encryption and decryption tasks using the Cloud KMS CryptoKey Encrypter/Decrypter role.
3
Evaluate distractor configurations against least privilege and GCP KMS constraints
Primitive roles like Owner grant overly broad privileges, broad inheritance violates separation of duties, and Key Rings cannot be deleted in GCP.
Cloud KMS resources are immutable in terms of object deletion, and least privilege rules mandate using specific predefined roles.

Key Concept

Cloud KMS Separation of Duties and CMEK IAM Roles
Estimated Time:2m 0s
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic