A biomedical research institute manages sensitive genomic datasets stored across Google Cloud Storage buckets and BigQuery datasets. Although strict Identity and Access Management (IAM) controls are enforced, security audits reveal a risk that authorized internal researchers could accidentally or maliciously copy sensitive data into external Cloud Storage buckets residing outside the organization's control. Which architectural control should the cloud architect implement to prevent data exfiltration to external resources?
- Configure a VPC Service Controls perimeter encompassing the BigQuery and Cloud Storage resources to restrict service data access to specified boundary boundaries.Answer
- BRestrict data access by replacing broad custom roles with fine-grained predefined IAM roles across all Cloud Storage buckets and BigQuery datasets.
- CEstablish VPC Network Peering between the analytics VPC and a centralized security VPC to route all storage storage API requests through an inspection firewall.
- DDowngrade all project-level service accounts and user identities from Editor primitive roles to Viewer primitive roles across the organization.
Answer
The correct strategy is to establish a VPC Service Controls perimeter around the BigQuery and Cloud Storage resources.
The option advocating VPC Service Controls is correct because VPC Service Controls allow organizations to establish defense-in-depth perimeters around Google Cloud managed services (such as Cloud Storage and BigQuery). This prevents data exfiltration by blocking API calls that attempt to move data to external projects or non-approved environments, even when the user or service account has legitimate IAM read permissions.
Step-by-Step Solution
Key Concept
VPC Service Controls for Data Exfiltration Prevention