Examkin

Question

Difficulty: MediumProvisioning Storage and Database Systems

A cloud platform team needs to provision a high-throughput Cloud Bigtable database environment for a real-time analytics application on Google Cloud. The deployment must comply with corporate security standards requiring Customer-Managed Encryption Keys (CMEK) for data at rest, and governance policies requiring application workload separation using App Profiles. In which sequence should the platform engineering team execute these provisioning steps to ensure successful deployment without authorization or dependency failures?

  1. 1Create a Cloud KMS KeyRing and CryptoKey in the target region.
  2. 2Grant the Cloud Bigtable Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the KMS key.
  3. 3Provision the Cloud Bigtable instance and cluster specifying the KMS key URI for CMEK encryption.
  4. 4Create the Bigtable tables and configure App Profiles with workload routing policies.

Answer

The correct provisioning order is: 1) Create the Cloud KMS KeyRing and CryptoKey, 2) Grant the Cloud Bigtable Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role, 3) Provision the Cloud Bigtable instance and cluster specifying the CMEK key URI, and 4) Create the Bigtable tables and configure App Profiles.
The deployment sequence must follow Google Cloud resource dependency and security authorization requirements. First, the Cloud KMS key must be created to obtain a valid resource path. Second, the service-managed Cloud Bigtable Service Agent account (`[email protected]`) must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role so GCP can access the key. Third, the Cloud Bigtable instance and cluster are created using the KMS key URI. Finally, tables and App Profiles are deployed into the running instance to complete application onboarding.

Step-by-Step Solution

1
Create the Cloud KMS KeyRing and CryptoKey in the designated deployment region.
A valid KMS key resource identifier is instantiated.
Downstream IAM role assignments and resource encryption references depend on the existence of the KMS key.
2
Bind the `roles/cloudkms.cryptoKeyEncrypterDecrypter` role to the Cloud Bigtable Service Agent on the CryptoKey.
The Bigtable service account gains permission to wrap and unwrap data encryption keys.
Attempting to create a CMEK-encrypted instance without granting this role first causes immediate provisioning failure during key validation.
3
Deploy the Cloud Bigtable instance and cluster referencing the CMEK key URI.
The parent database infrastructure is provisioned and encrypted.
Parent instance infrastructure must be fully provisioned before child objects such as tables and app profiles can be created.
4
Create Bigtable tables and set up App Profiles for application workload isolation.
Database tables and routing profiles become operational for client applications.
Child resources depend strictly on an existing, ready Cloud Bigtable instance.

Key Concept

Cloud Bigtable CMEK Provisioning Workflow and Resource Dependency Management
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic