A cloud engineering team is automating the provisioning of an enterprise data archive on Google Cloud using Terraform. Regulatory compliance requires that all archived objects remain immutable and unmodifiable for seven years after upload. Additionally, company governance requires data at rest to be encrypted using keys managed in Cloud KMS, with automated infrastructure state tracking to prevent concurrency conflicts. Which TWO actions should the team incorporate into their automated provisioning design?
- Configure a Object Retention Policy on the Cloud Storage bucket with a seven-year duration and retain the policy in a locked state.Cevap
- Grant the Cloud Storage Service Agent service account the Cloud KMS CryptoKey Encrypter/Decrypter role on the dedicated Cloud KMS key.Cevap
- CSupply raw 256-bit key strings via Terraform configuration variables to implement Customer-Supplied Encryption Keys (CSEK) on the target bucket.
- DStore the primary Terraform state file in an unversioned local directory within the deployment pipeline workspace.
Cevap
To meet compliance and security requirements, the team must configure and lock a seven-year retention policy on the Cloud Storage bucket and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the specified CMEK key.
Locking a Cloud Storage retention policy enforces WORM compliance so objects cannot be deleted or overwritten during the retention period. Granting the Cloud Storage service agent encrypter/decrypter rights on the Cloud KMS key enables seamless server-side CMEK encryption during bucket resource provisioning.
Adım Adım Çözüm
Anahtar Kavram
Provisioning Immutable Cloud Storage with CMEK and IaC Best Practices