A media streaming company hosts user profile data in Cloud SQL for PostgreSQL and media assets in Cloud Storage. The security team mandates that all data at rest must be encrypted using customer-managed keys hosted in a Hardware Security Module (HSM) with automated key rotation enabled. Additionally, access to key operations must strictly follow the principle of least privilege. Which of the following actions should you perform? (Select TWO.)
- Create a key in Cloud KMS using the HSM protection level and grant the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Cloud SQL and Cloud Storage Service Agents.Cevap
- Configure an automated rotation schedule on the Cloud KMS key so that new key versions are periodically generated without requiring manual re-encryption of existing stored data.Cevap
- CSupply Customer-Supplied Encryption Keys (CSEK) in request headers for both Cloud SQL and Cloud Storage to guarantee Google never stores key material.
- DAssign the primitive Editor role on the GCP project to the service accounts managing Cloud SQL and Cloud Storage to ensure they have encryption rights.
Cevap
Create an HSM-backed key in Cloud KMS (CMEK) with the Cloud KMS CryptoKey Encrypter/Decrypter role granted to service agents, and configure an automated rotation schedule on the Cloud KMS key.
Using Cloud KMS keys backed by Cloud HSM fulfills regulatory mandates for hardware-based key management (CMEK) while granting the Cloud KMS CryptoKey Encrypter/Decrypter role to service agents enforces least privilege. Configuring automated key rotation ensures ongoing key security compliance without disrupting access to existing encrypted data.
Adım Adım Çözüm
Anahtar Kavram
Customer-Managed Encryption Keys (CMEK) with Cloud HSM and IAM Least Privilege