Examkin

Question

Difficulty: HardSecrets Management and Service Account Lifecycle Security

An enterprise security architect is designing an automated credential rotation workflow for a PostgreSQL database. The database credentials must be stored in Google Cloud Secret Manager, encrypted using a Customer-Managed Encryption Key (CMEK) stored in Cloud KMS, and automatically rotated every 30 days using a dedicated Cloud Run rotation service triggered by Pub/Sub notifications. You must establish the secure lifecycle configurations and IAM bindings following the principle of least privilege. What is the correct sequence of steps to configure this automated secret rotation workflow?

  1. 1Grant the Secret Manager Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the dedicated Cloud KMS key.
  2. 2Create the Pub/Sub topic for rotation notifications and create the Secret Manager secret configured with CMEK encryption and the Pub/Sub topic binding.
  3. 3Grant the Secret Manager Service Agent the Pub/Sub Publisher role on the created rotation Pub/Sub topic.
  4. 4Deploy the Cloud Run rotation service configured with a dedicated runtime service account that holds the Secret Manager Secret Version Manager role.
  5. 5Configure the 30-day automatic rotation schedule on the Secret Manager secret to initiate the automated rotation lifecycle.

Answer

The correct sequence of steps begins by granting the Secret Manager Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the CMEK key. Next, create the rotation Pub/Sub topic and the Secret Manager secret configured with CMEK. Third, grant the Secret Manager Service Agent the Pub/Sub Publisher role on the topic. Fourth, deploy the Cloud Run rotation service bound to a service account with the Secret Manager Secret Version Manager role. Finally, set the 30-day automatic rotation schedule on the secret.
The lifecycle of automated Secret Manager rotation with CMEK requires precise prerequisite sequencing. First, the Secret Manager Service Agent must have `cloudkms.cryptoKeyEncrypterDecrypter` permissions on the Cloud KMS key to allow secret creation and version encryption. Second, the secret can be created using CMEK alongside the designated Pub/Sub topic reference. Third, the Secret Manager Service Agent must be granted `pubsub.publisher` on the Pub/Sub topic so rotation events can be sent. Fourth, the Cloud Run rotation handler service must be deployed with a service account possessing `roles/secretmanager.secretVersionManager` to handle payload generation and updating credentials. Finally, applying the rotation schedule on the secret activates the end-to-end automated workflow without execution errors.

Step-by-Step Solution

1
Authorize Secret Manager to access Cloud KMS
Secret Manager Service Agent receives cloudkms.cryptoKeyEncrypterDecrypter on the CMEK key.
Secret Manager cannot write or wrap secrets using CMEK until its system-generated service agent has explicit encryption and decryption permissions.
2
Provision Pub/Sub topic and CMEK-encrypted Secret
The Pub/Sub notification channel and CMEK-encrypted secret object exist in Secret Manager.
Creating the secret object requires active KMS access and specifies the topic where rotation events will be published.
3
Authorize Secret Manager to publish Pub/Sub events
Secret Manager Service Agent receives pubsub.publisher on the topic.
Secret Manager must be granted publishing rights so that rotation schedule events can reach the Pub/Sub topic.
4
Deploy rotation service with appropriate IAM identity
Cloud Run service is deployed using a custom service account with secretmanager.secretVersionManager.
The compute worker performing credential rotation needs permissions to read secret versions, write new versions, and update database passwords.
5
Activate automatic rotation schedule
The secret's rotation schedule is set to 30 days.
Enabling rotation on the secret initiates automated lifecycle events, which depend on all underlying IAM permissions and endpoints being fully configured.

Key Concept

Secret Manager Automated Rotation Lifecycle with CMEK and Service Accounts
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic