Examkin

Question

Difficulty: HardData Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

An enterprise security architect is designing an automated deployment pipeline to provision Cloud SQL database instances encrypted with Customer-Managed Encryption Keys (CMEK). The encryption keys reside in a centralized Cloud KMS key ring within a dedicated security project, while the databases are deployed in separate workload projects. During deployment, the Cloud SQL instance creation fails due to missing access permissions on the encryption key. A DevOps engineer recommends assigning the Editor primitive IAM role on the security project to resolve the access issue. Which solution complies with Google Cloud security best practices while enforcing the principle of least privilege?

  1. Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific KMS key to the Cloud SQL Service Agent account ([email protected]).Answer
  2. B
    Assign the Editor primitive IAM role on the centralized security project to the Cloud SQL Service Agent account and the deployment pipeline service account.
  3. C
    Reconfigure the database creation pipeline to use Customer-Supplied Encryption Keys (CSEK) by passing raw 256-bit AES encryption key strings directly in the deployment parameters.
  4. D
    Configure a VPC Service Controls perimeter encompassing both the workload project and the security project to automatically authorize key access across project boundaries.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key to the Cloud SQL Service Agent account for the workload project.
The correct solution grants the predefined Cloud KMS CryptoKey Encrypter/Decrypter role directly on the specific encryption key to the target project's Cloud SQL Service Agent. In Google Cloud, service-managed operations like database disk encryption require the service agent identity to have explicit key usage permissions. Applying this role at the key resource level adheres strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the identity responsible for performing encryption/decryption operations for Cloud SQL.
GCP services use specialized Service Agents (e.g., [email protected]) rather than generic user accounts or custom service accounts to perform CMEK operations.
When configuring CMEK, the service itself must be authorized to interact with Cloud KMS on behalf of the project.
2
Determine the least-privileged IAM role required for Cloud KMS operations.
The predefined role roles/cloudkms.cryptoKeyEncrypterDecrypter provides permission to encrypt and decrypt data using Cloud KMS keys.
Granting fine-grained resource-level roles on the specific key prevents over-privileging the service account with key administration rights or broad project permissions.
3
Evaluate and eliminate non-compliant or misconfigured architectural options.
Primitive Editor roles violate least privilege, CSEK is unnecessary and unsupported for Cloud SQL, and VPC Service Controls do not supersede IAM authorization.
Ensures adherence to GCP security design guidelines for multi-project CMEK topologies.

Key Concept

CMEK Integration with Service Agents and Least-Privilege IAM Roles
Rate this question

Topics

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)

More questions from this topic