Examkin

Question

Difficulty: MediumManaging Encryption Keys with Cloud KMS

An organization requires an application service account residing in Project A to encrypt and decrypt sensitive application data using a Customer-Managed Encryption Key (CMEK) hosted in a central Cloud KMS project (Project B). The application service account must adhere to the principle of least privilege and must not possess permissions to create key versions, manage key ring permissions, or destroy keys. How should the cloud administrator configure IAM access for the service account in Project B?

  1. Grant the application service account the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) directly on the target CryptoKey in Project B.Answer
  2. B
    Grant the application service account the primitive Editor role (roles/editor) at the Project B project level.
  3. C
    Grant the application service account the Cloud KMS Admin role (roles/cloudkms.admin) on the Key Ring in Project B.
  4. D
    Delete the Key Ring from Project B and recreate it inside Project A under the default Compute Engine service account to avoid cross-project IAM configuration.

Answer

Grant the application service account the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) directly on the target CryptoKey in Project B.
Granting the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific key provides the minimal set of permissions required to encrypt and decrypt data without allowing key administrative actions or project-level modification rights.

Step-by-Step Solution

1
Identify the specific functional requirement for the application service account.
The service account needs only to encrypt and decrypt data using a specific Cloud KMS key in Project B.
Security compliance requires adhering strictly to the principle of least privilege.
2
Select the appropriate IAM predefined role for Cloud KMS operations.
The Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) provides cryptographic execution permissions (cloudkms.cryptoKeyVersions.useToEncrypt and cloudkms.cryptoKeyVersions.useToDecrypt) without administrative rights.
Admin roles or broad primitive roles grant excessive privileges such as key management or resource creation.
3
Apply the IAM role at the narrowest scope (the target CryptoKey in Project B).
The service account in Project A gains access to perform cryptographic operations on the designated key in Project B.
Google Cloud IAM allows cross-project role bindings directly on Cloud KMS resources.

Key Concept

Cloud KMS Predefined IAM Roles and Least Privilege Access Control
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic