Examkin

Question

Difficulty: MediumManaging Encryption Keys with Cloud KMS

A cloud engineering team is using a continuous integration service account to automate infrastructure deployment in Google Cloud. The deployment pipeline must create Cloud KMS key rings and crypto keys, as well as configure key rotation schedules. However, security policy strictly prohibits this service account from having permissions to encrypt or decrypt data payloads, enforcing the principle of least privilege. Which identity and access management strategy meets these requirements?

  1. Grant the Cloud KMS Admin role (roles/cloudkms.admin) to the service account on the specific project or key ring.Answer
  2. B
    Grant the primitive Editor role (roles/editor) to the service account at the project level to ensure full deployment capabilities.
  3. C
    Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the service account and delete key rings after deployment.
  4. D
    Grant the primitive Owner role (roles/owner) at the project level and rely on revoking encrypt/decrypt permissions at the key ring level.

Answer

Granting the Cloud KMS Admin role (roles/cloudkms.admin) to the service account allows it to create and manage key rings and crypto keys without granting data encryption or decryption permissions.
The Cloud KMS Admin role (roles/cloudkms.admin) grants administrative control over Cloud KMS resources (creating key rings, keys, setting rotation schedules) without granting permissions to perform encryption or decryption operations (which require roles/cloudkms.cryptoKeyEncrypterDecrypter or similar). This achieves separation of duties and adheres to the principle of least privilege.

Step-by-Step Solution

1
Identify the required permissions for the service account
The service account requires administration rights (creating key rings, keys, and rotation schedules) but must not have cryptographic data access (encrypter/decrypter).
Security policy enforces separation of duties and least privilege.
2
Evaluate Google Cloud KMS IAM roles
The predefined role roles/cloudkms.admin permits key management operations while explicitly omitting cryptographic data operations such as cloudkms.cryptoKeyVersions.useToEncrypt and useToDecrypt.
Predefined roles split key management responsibilities from key usage responsibilities.

Key Concept

Separation of duties in Cloud KMS IAM roles
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic