A financial analytics firm is moving internal auditing data to Google Cloud Storage. Company security policy mandates that encryption keys must be generated and managed inside Google Cloud hardware security modules (HSMs), key rotation must be controlled via policy, and service access must follow the principle of least privilege without granting administrative privileges over key management. Which encryption and key management strategy should you implement?
- Generate a Customer-Managed Encryption Key (CMEK) using Cloud KMS backed by Cloud HSM, and grant the Cloud Storage Service Agent the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the key.Answer
- BImplement Customer-Supplied Encryption Keys (CSEK) by supplying raw AES-256 encryption keys in each API request header so Google Cloud automatically manages key rotation and HSM lifecycle.
- CCreate a Cloud KMS key ring with Cloud HSM keys and assign the primitive Owner role on the key ring to the Cloud Storage service account to guarantee permissions for encryption operations.
- DUse Google-default encryption for Cloud Storage buckets and configure a VPC Service Controls perimeter to manage key rotation and cryptographic operations automatically.
Answer
Generate a Customer-Managed Encryption Key (CMEK) using Cloud KMS backed by Cloud HSM, and grant the Cloud Storage Service Agent the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the key.
The correct approach uses Customer-Managed Encryption Keys (CMEK) created in Cloud KMS with Cloud HSM protection. Assigning the predefined role `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Cloud Storage service agent strictly grants necessary cryptographic access without granting key administration rights, fulfilling both HSM key management and least privilege requirements.
Step-by-Step Solution
Key Concept
Customer-Managed Encryption Keys (CMEK) with Cloud HSM provide hardware-backed key lifecycle management while enabling least-privilege access via granular IAM roles like CryptoKey Encrypter/Decrypter.