Examkin

Soru

Zorluk: ZorManaging Encryption Keys with Cloud KMS

An organization is deploying Compute Engine VM instances with Customer-Managed Encryption Keys (CMEK) applied to their boot disks in the europe-west3 region. The deployment pipeline uses a dedicated deployment service account with the Cloud KMS Admin role (roles/cloudkms.admin) on the target Key Ring. When creating the instances, the pipeline fails with an authorization error stating that encryption could not be performed. Which action should a cloud engineer take to resolve this failure while maintaining the principle of least privilege?

  1. Grant the Compute Engine Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific KMS key.Cevap
  2. B
    Grant the deployment service account the primitive Owner role (roles/owner) at the project level to ensure broad permission over all cryptographic resources.
  3. C
    Delete the existing Cloud KMS Key Ring and recreate it with open access permissions in the europe-west3 region.
  4. D
    Remove local IAM bindings on the Key Ring so that access permissions granted at the parent Organization level inherit downwards and override access restrictions.

Cevap

Grant the Compute Engine Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific KMS key.
When configuring CMEK for Compute Engine resources, the Google-managed Compute Engine Service Agent executes the cryptographic operations on the disk. The Cloud KMS Admin role grants permissions to manage key resources and policies, but explicitly excludes encryption and decryption capabilities due to separation of duties. To resolve the error, the Compute Engine Service Agent must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key.

Adım Adım Çözüm

1
Identify the service identity responsible for disk encryption in Compute Engine.
Recognize that GCP services use service agents (such as [email protected]) to access CMEK keys on behalf of users.
The user deployment service account provisions the VM, but the Compute Engine Service Agent performs the underlying cryptographic API calls.
2
Evaluate separation of duties in Cloud KMS IAM roles.
Understand that the Cloud KMS Admin role (roles/cloudkms.admin) only allows managing keys and key rings, not encrypting or decrypting data.
Google Cloud enforces separation of duties between key management and key usage.
3
Assign the least-privilege predefined role to the correct identity.
Grant roles/cloudkms.cryptoKeyEncrypterDecrypter to the Compute Engine Service Agent on the target key.
This enables Compute Engine to access the CMEK key to encrypt and decrypt VM boot disks securely.

Anahtar Kavram

Cloud KMS Separation of Duties and Service Agent CMEK Authorization
Bu soruyu puanla

Konular

Managing Encryption Keys with Cloud KMS

Bu konudan daha fazla soru