An enterprise architecture team is implementing an automated Infrastructure as Code workflow to provision a multi-region Cloud Spanner database encrypted with Customer-Managed Encryption Keys (CMEK). Place the operational steps in the mandatory execution sequence required to successfully deploy the database and grant application access without permission or lifecycle failures.
- 1Create the Cloud KMS KeyRing and CryptoKey, and assign the `roles/cloudkms.cryptoKeyEncrypterDecrypter` IAM role to the Cloud Spanner Service Agent (`[email protected]`).
- 2Provision the multi-region Cloud Spanner instance resource (`google_spanner_instance`) defining the compute capacity and regional configuration.
- 3Create the Cloud Spanner database resource (`google_spanner_database`) within the instance, passing the Cloud KMS CryptoKey resource name into the `encryption_config` block.
- 4Apply database-level IAM policy bindings (`google_spanner_database_iam_binding`) to grant application service accounts the `roles/spanner.databaseUser` role.
Cevap
The mandatory operational sequence is: 1) Create the Cloud KMS KeyRing/CryptoKey and grant the Cloud Spanner Service Agent the Encrypter/Decrypter role; 2) Provision the Cloud Spanner instance; 3) Provision the Cloud Spanner database specifying the KMS key in the encryption configuration; 4) Apply database IAM bindings for application service accounts.
Provisioning a CMEK-encrypted Cloud Spanner database requires strict prerequisite ordering: first, the Cloud Spanner service agent must be granted Cloud KMS encrypter/decrypter permissions on the key; second, the parent Spanner instance must be provisioned; third, the database is created using the KMS key configuration; finally, fine-grained IAM database user permissions are assigned to application service accounts.
Adım Adım Çözüm
Anahtar Kavram
Cloud Spanner CMEK Provisioning Dependencies and Lifecycle Ordering