A health technology enterprise stores sensitive patient medical analytics inside Google Cloud Storage buckets and BigQuery datasets. Authorized data engineers access these services from an on-premises data center connected via Dedicated Interconnect. The enterprise security policy strictly dictates that even users with legitimate administrative IAM permissions must be prevented from exfiltrating data by copying it to external Google Cloud Storage buckets or unapproved Google Cloud projects outside the enterprise organization. Which architectural control should the Cloud Architect implement to meet this requirement?
- Define a VPC Service Controls service perimeter enclosing the project containing BigQuery and Cloud Storage, and use access levels to permit access only from the corporate network IP ranges.Answer
- BRemove primitive IAM roles and grant IAM fine-grained predefined roles with IAM Conditions restricting storage operations based on request origin.
- CEstablish VPC Network Peering between the corporate VPC and external partner VPCs, applying egress firewall rules to block outbound traffic to external IP addresses.
- DConfigure Control Plane Authorized Networks on Google Kubernetes Engine clusters to restrict API endpoint access exclusively to designated corporate subnets.
Answer
Define a VPC Service Controls service perimeter enclosing the project containing BigQuery and Cloud Storage, and use access levels to permit access only from the corporate network IP ranges.
VPC Service Controls allow organizations to set up perimeter security around sensitive Google Cloud resources such as Cloud Storage and BigQuery. This restricts service access to authorized network contexts (via Access Context Manager access levels) and blocks data egress to resources outside the perimeter boundary, effectively preventing data exfiltration even by compromised or malicious authorized accounts.
Step-by-Step Solution
Key Concept
VPC Service Controls Data Exfiltration Prevention
Estimated Time:1m 30s