An organization is deploying a globally distributed transactional application requiring multi-region relational database storage with strong consistency across continents. Additionally, database audit logs must be exported to an automated infrastructure-as-code (IaC) provisioned object storage bucket, complying with cloud-native key management governance that avoids holding raw key material. Which TWO architectural and provisioning actions should the platform team take to meet these requirements?
- Provision a Cloud Spanner instance configured with a multi-region instance configuration to handle global relational transactions.Answer
- BProvide raw Customer-Supplied Encryption Keys (CSEK) embedded directly within the automated IaC scripts for Cloud Storage bucket encryption.
- Configure Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS to protect the Cloud Storage bucket holding audit logs.Answer
- DMaintain the IaC state files on unversioned local disk storage shared via network mounts to minimize Cloud Storage API requests.
Answer
The team should provision a multi-region Cloud Spanner instance for globally consistent relational data and configure Customer-Managed Encryption Keys (CMEK) via Cloud KMS for protecting the Cloud Storage log bucket.
Provisioning a multi-region Cloud Spanner instance addresses the need for globally distributed, strongly consistent relational transactions. Configuring Customer-Managed Encryption Keys (CMEK) via Cloud KMS ensures full key management control over the Cloud Storage log bucket without exposing raw cryptographic keys in IaC code.
Step-by-Step Solution
Key Concept
Multi-region database selection and secure storage bucket encryption provisioning