A multinational enterprise is provisioning a high-security environment on Google Cloud for financial transactions stored in Cloud SQL. Corporate policy mandates strict separation of duties: security teams must manage key lifecycles using Cloud KMS, while database administrators must manage database resources without having access to view key material or grant key permissions. You need to configure Customer-Managed Encryption Keys (CMEK) for the Cloud SQL instances while maintaining minimal required permissions for automated encryption operations. Which TWO configuration steps must the architecture team perform to satisfy these security and operational requirements?
- Grant the Cloud SQL Service Agent role 'roles/cloudkms.cryptoKeyEncrypterDecrypter' on the target Cloud KMS CryptoKey.Cevap
- Specify the fully qualified Cloud KMS CryptoKey resource identifier when provisioning or updating the Cloud SQL instance.Cevap
- CAssign the primitive 'roles/editor' role to the database service account on the Cloud KMS project to allow full key access.
- DPass a raw 256-bit AES encryption key in the API request body whenever executing automated Cloud SQL database backups.
Cevap
Grant the Cloud SQL Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key, and supply the fully qualified KMS key resource identifier during Cloud SQL instance configuration.
Enabling Customer-Managed Encryption Keys (CMEK) for Cloud SQL requires granting the Cloud SQL Service Agent fine-grained Cloud KMS CryptoKey Encrypter/Decrypter permissions on the designated key, as well as providing the KMS key resource ID during instance creation. This enforces strict separation of duties, ensuring database administrators cannot access or alter key materials while Cloud SQL performs automated cryptographic operations using Cloud KMS.
Adım Adım Çözüm
Anahtar Kavram
Customer-Managed Encryption Keys (CMEK) and Service Agent Least Privilege in GCP