Question

Difficulty: EasyProvisioning Storage and Database Systems

A cloud architect needs to provision a new relational database using Cloud SQL with Customer-Managed Encryption Keys (CMEK) enabled. What is the correct chronological sequence of steps required to successfully provision this encrypted database infrastructure?

  1. 1Create a Cloud KMS Key Ring and CryptoKey in the target deployment region.
  2. 2Grant the Cloud SQL Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the created CryptoKey.
  3. 3Provision the Cloud SQL instance while passing the customer-managed key configuration.
  4. 4Create the logical relational database inside the provisioned Cloud SQL instance.

Answer

The correct sequence begins with creating the Cloud KMS Key Ring and CryptoKey, followed by granting the Cloud SQL Service Agent the required Encrypter/Decrypter role on that key, then provisioning the Cloud SQL instance referencing the CMEK, and finally creating the logical database inside the instance.
Provisioning CMEK-encrypted managed services on Google Cloud requires creating the encryption key first, delegating `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Cloud SQL service account second, provisioning the encrypted instance third, and finally creating the logical database.

Step-by-Step Solution

1
Create the Cloud KMS key resource
A regional Cloud KMS Key Ring and CryptoKey are available.
Encryption keys must exist before permissions can be assigned or services configured to use them.
2
Assign IAM roles to the service account
The Cloud SQL service agent is authorized to use the KMS key.
Provisioning will fail if the Cloud SQL service account cannot access the key during instance creation.
3
Provision the Cloud SQL database instance
An encrypted Cloud SQL instance is running.
The underlying disk storage is encrypted using the specified CMEK during initial instance creation.
4
Create the application database
The target relational database is ready for data ingestion.
Logical database structures exist on top of the already provisioned and encrypted storage instance.

Key Concept

Customer-Managed Encryption Key (CMEK) Provisioning Sequence for Managed Storage and Databases
Rate this question