A cloud architect needs to provision a new relational database using Cloud SQL with Customer-Managed Encryption Keys (CMEK) enabled. What is the correct chronological sequence of steps required to successfully provision this encrypted database infrastructure?
- 1Create a Cloud KMS Key Ring and CryptoKey in the target deployment region.
- 2Grant the Cloud SQL Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the created CryptoKey.
- 3Provision the Cloud SQL instance while passing the customer-managed key configuration.
- 4Create the logical relational database inside the provisioned Cloud SQL instance.
Answer
The correct sequence begins with creating the Cloud KMS Key Ring and CryptoKey, followed by granting the Cloud SQL Service Agent the required Encrypter/Decrypter role on that key, then provisioning the Cloud SQL instance referencing the CMEK, and finally creating the logical database inside the instance.
Provisioning CMEK-encrypted managed services on Google Cloud requires creating the encryption key first, delegating `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Cloud SQL service account second, provisioning the encrypted instance third, and finally creating the logical database.
Step-by-Step Solution
Key Concept
Customer-Managed Encryption Key (CMEK) Provisioning Sequence for Managed Storage and Databases