An organization is deploying a globally distributed transactional application requiring multi-region relational database storage with strong consistency across continents. Additionally, database audit logs must be exported to an automated infrastructure-as-code (IaC) provisioned object storage bucket, complying with cloud-native key management governance that avoids holding raw key material. Which TWO architectural and provisioning actions should the platform team take to meet these requirements?
- Provision a Cloud Spanner instance configured with a multi-region instance configuration to handle global relational transactions.Cevap
- BProvide raw Customer-Supplied Encryption Keys (CSEK) embedded directly within the automated IaC scripts for Cloud Storage bucket encryption.
- Configure Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS to protect the Cloud Storage bucket holding audit logs.Cevap
- DMaintain the IaC state files on unversioned local disk storage shared via network mounts to minimize Cloud Storage API requests.
Cevap
The team should provision a multi-region Cloud Spanner instance for globally consistent relational data and configure Customer-Managed Encryption Keys (CMEK) via Cloud KMS for protecting the Cloud Storage log bucket.
Provisioning a multi-region Cloud Spanner instance addresses the need for globally distributed, strongly consistent relational transactions. Configuring Customer-Managed Encryption Keys (CMEK) via Cloud KMS ensures full key management control over the Cloud Storage log bucket without exposing raw cryptographic keys in IaC code.
Adım Adım Çözüm
Anahtar Kavram
Multi-region database selection and secure storage bucket encryption provisioning