A financial services organization based in Singapore is migrating its core transactional platform to Google Cloud. To comply with regional regulatory compliance and data sovereignty mandates, the enterprise must ensure that all storage resources and key management services are strictly restricted to the asia-southeast1 region. Additionally, any access by Google support engineers to customer data for operational tasks must require prior explicit approval from the customer's security team. Which TWO architectural mechanisms should a Cloud Architect implement to fulfill these compliance requirements?
- Enforce an Organization Policy using the Resource Locations constraint (constraints/gcp.resourceLocations) limited to the asia-southeast1 region.Cevap
- Enable Access Approval at the organization or project level to mandate explicit customer authorization before Google support personnel can inspect resources.Cevap
- CMandate Customer-Supplied Encryption Keys (CSEK) across all storage services to manually govern key storage locations.
- DGrant the primitive IAM Owner role (roles/owner) to the internal compliance team to oversee resource deployment geographic restrictions.
Cevap
Enforce an Organization Policy using the Resource Locations constraint (constraints/gcp.resourceLocations) limited to the asia-southeast1 region, and enable Access Approval at the organization or project level to mandate explicit customer authorization before Google support personnel can inspect resources.
Data residency and sovereign access requirements are effectively satisfied by pairing the Resource Locations organization policy constraint (to programmatically restrict resource and KMS location boundaries) with Access Approval (to enforce explicit customer approval for Google support interventions).
Adım Adım Çözüm
Anahtar Kavram
Data Sovereignty and Support Access Control via Resource Location Constraints and Access Approval