A company is setting up Customer-Managed Encryption Keys (CMEK) in Google Cloud KMS to protect sensitive data stored in a BigQuery dataset located in the us-central1 region. Following the principle of least privilege and separation of duties, the infrastructure team needs to allow BigQuery to automatically encrypt and decrypt data using the KMS key, while preventing the BigQuery service account from performing administrative operations on the key. Which configuration correctly satisfies these security requirements?
- AGrant the Owner primitive role on the project containing Cloud KMS to the BigQuery service agent.
- Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific KMS key to the BigQuery service agent.Cevap
- CGrant the Cloud KMS CryptoKey Encrypter/Decrypter role at the GCP Organization level and revoke permissions at the Key Ring level.
- DDelete the Cloud KMS Key Ring immediately after generating the key to enforce immutability and prevent administrative changes.
Cevap
Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific KMS key to the BigQuery service agent.
Granting the Cloud KMS CryptoKey Encrypter/Decrypter role directly on the specific key to the BigQuery service agent adheres to the principle of least privilege. It enables the service to perform required cryptographic encryption and decryption operations for CMEK without granting key management or administrative rights.
Adım Adım Çözüm
Anahtar Kavram
Cloud KMS Service Agent IAM Roles and Separation of Duties