An online gaming platform headquartered in Sweden is deploying a new telemetry and payment processing pipeline on Google Cloud. To satisfy strict European regulatory compliance and data sovereignty mandates, the platform must guarantee that all data assets remain physically located within European infrastructure and that Google administrative access to underlying data is logged and requires prior time-bound authorization. Which TWO architectural controls should you implement to satisfy these requirements?
- Enforce the Resource Locations (gcp.resourceLocations) organization policy constraint to restrict resource deployment exclusively to European regions.Answer
- Configure Access Approval combined with Access Transparency to receive notifications and explicitly authorize Google support access requests to customer data.Answer
- CMandate Customer-Supplied Encryption Keys (CSEK) across all BigQuery and Cloud Storage resources to maintain Cloud KMS key ring sovereignty.
- DAssign the primitive Owner role to the compliance audit service account to ensure it can continuously scan and modify organization-wide data governance rules.
Answer
The correct controls are enforcing the Resource Locations organization policy constraint to restrict resource creation to European locations and configuring Access Approval along with Access Transparency for Google personnel access oversight.
The combination of the Resource Locations organization policy constraint (gcp.resourceLocations) and Access Approval/Access Transparency directly addresses both strict data residency constraints and administrative data access governance requirements. The resource locations constraint guarantees data assets remain in European regions, while Access Approval ensures Google personnel must obtain explicit permission before accessing customer data.
Step-by-Step Solution
Key Concept
Data sovereignty controls using Organization Policy Resource Locations, Access Approval, and Access Transparency in Google Cloud