A healthcare software provider is deploying a patient record processing application on Compute Engine. The security compliance team mandates that raw 256-bit encryption keys must be generated and maintained entirely within the company's controlled on-premises environment and supplied in each API request, ensuring Google Cloud never persists or manages the key material in Cloud KMS. Additionally, security governance requires adhering to least privilege without granting excessive administrative permissions across cloud resources. Which encryption strategy and access management approach aligns with these requirements?
- Use Customer-Supplied Encryption Keys (CSEK) by providing the raw AES-256 key in API requests for disk encryption, and grant fine-grained predefined IAM roles to compute service accounts.Cevap
- BConfigure Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS with automated 90-day rotation, allowing Google Cloud to generate and store key material.
- CUse Customer-Supplied Encryption Keys (CSEK) for disk encryption and grant the primitive Owner role to the compute service account to ensure uninterrupted key operations.
- DRely on standard Google-default encryption at rest while using basic IAM permissions as the sole control against data exfiltration.
Cevap
Use Customer-Supplied Encryption Keys (CSEK) by providing the raw AES-256 key in API requests for disk encryption, and grant fine-grained predefined IAM roles to compute service accounts.
Customer-Supplied Encryption Keys (CSEK) are designed specifically for scenarios where raw AES-256 keys must be generated and managed outside of Google Cloud and supplied with each API request. Google does not store key material on disk or in Cloud KMS with CSEK. Additionally, pairing CSEK with fine-grained predefined IAM roles enforces least privilege and avoids granting excessive administrative authority.
Adım Adım Çözüm
Anahtar Kavram
Customer-Supplied Encryption Keys (CSEK) vs CMEK key custody model
Tahmini Süre:1m 30s