Examkin

Question

Difficulty: MediumManaging Encryption Keys with Cloud KMS

A company is setting up Customer-Managed Encryption Keys (CMEK) in Google Cloud KMS to protect sensitive data stored in a BigQuery dataset located in the us-central1 region. Following the principle of least privilege and separation of duties, the infrastructure team needs to allow BigQuery to automatically encrypt and decrypt data using the KMS key, while preventing the BigQuery service account from performing administrative operations on the key. Which configuration correctly satisfies these security requirements?

  1. A
    Grant the Owner primitive role on the project containing Cloud KMS to the BigQuery service agent.
  2. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific KMS key to the BigQuery service agent.Answer
  3. C
    Grant the Cloud KMS CryptoKey Encrypter/Decrypter role at the GCP Organization level and revoke permissions at the Key Ring level.
  4. D
    Delete the Cloud KMS Key Ring immediately after generating the key to enforce immutability and prevent administrative changes.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific KMS key to the BigQuery service agent.
Granting the Cloud KMS CryptoKey Encrypter/Decrypter role directly on the specific key to the BigQuery service agent adheres to the principle of least privilege. It enables the service to perform required cryptographic encryption and decryption operations for CMEK without granting key management or administrative rights.

Step-by-Step Solution

1
Identify the service principal requiring access
The BigQuery service agent (service-[PROJECT_NUMBER]@gcp-sa-bigquery.iam.gserviceaccount.com) requires access to perform cryptographic operations.
GCP services use service agents to perform CMEK operations on behalf of users.
2
Apply the principle of least privilege and separation of duties
Assign the predefined role Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) directly on the targeted key resource.
This role allows the service agent to encrypt and decrypt data while restricting administrative capabilities such as key creation, rotation scheduling, or disabling versions.

Key Concept

Cloud KMS Service Agent IAM Roles and Separation of Duties
Rate this question

Topics

Managing Encryption Keys with Cloud KMS

More questions from this topic