A multinational e-commerce company is migrating its telemetry processing pipeline to Google Cloud. The architecture requires storing raw telemetry data in Cloud Storage and querying processed datasets in BigQuery. The security compliance team requires that all data at rest be encrypted using keys stored within Google Cloud where key usage is fully audited, while strictly adhering to the principle of least privilege for automated service access. Which configuration strategy should the Cloud Architect recommend?
- Configure Customer-Managed Encryption Keys (CMEK) in Cloud KMS, and grant the Cloud Storage and BigQuery service agents the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific encryption key.Cevap
- BImplement Customer-Supplied Encryption Keys (CSEK) by supplying raw 256-bit AES encryption keys in the HTTP headers of every API payload to guarantee full key control.
- CConfigure Customer-Managed Encryption Keys (CMEK) in Cloud KMS, and grant the Cloud Storage and BigQuery service accounts the Editor primitive role at the project level.
- DConfigure Customer-Managed Encryption Keys (CMEK) in Cloud KMS and rely exclusively on KMS key access permissions to prevent data exfiltration to external buckets.
Cevap
Configure Customer-Managed Encryption Keys (CMEK) in Cloud KMS, and grant the Cloud Storage and BigQuery service agents the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific encryption key.
Configuring Customer-Managed Encryption Keys (CMEK) through Cloud KMS provides centralized key management, key rotation capabilities, and full logging of cryptographic operations in Cloud Audit Logs. Granting the predefined role `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Cloud Storage and BigQuery service agents grants only the specific permissions needed to perform encryption and decryption tasks, strictly observing the principle of least privilege.
Adım Adım Çözüm
Anahtar Kavram
Customer-Managed Encryption Keys (CMEK) and Least Privilege IAM for Cloud KMS Service Agents