A financial services organization is storing sensitive transactional data in Cloud Spanner. Compliance regulations mandate that data at rest must be encrypted using encryption keys managed in Google Cloud KMS by a centralized security team, completely separated from database administrators. Additionally, automated key rotation must be configured without requiring application code changes or manually re-encrypting existing data. Which key management strategy should the cloud architect recommend?
- Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS, and grant the Cloud Spanner Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the KMS key.Answer
- BImplement Customer-Supplied Encryption Keys (CSEK) by passing raw 256-bit AES keys in API request headers, enabling Cloud KMS to manage automated key rotation.
- CConfigure Customer-Managed Encryption Keys (CMEK) using Cloud KMS, and grant database administrators the primitive Owner role on the Cloud KMS KeyRing to simplify operational management.
- DUse Google-default encryption while relying on IAM data access roles and perimeters to protect data at rest and prevent exfiltration without configuring Cloud KMS.
Answer
Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS, granting the Cloud Spanner Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.
The correct strategy uses Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. Security teams can configure automated key rotation schedules in Cloud KMS, while granting the Cloud Spanner Service Agent the specific fine-grained Cloud KMS CryptoKey Encrypter/Decrypter role (`roles/cloudkms.cryptoKeyEncrypterDecrypter`). This maintains strict separation of duties and satisfies regulatory mandates.
Step-by-Step Solution
Key Concept
Customer-Managed Encryption Keys (CMEK) and Key Management Service (KMS) Access Control