Professional Data EngineerManaging and securing dataMedium
A healthcare provider is storing patient medical records in Cloud Storage. Due to regulatory compliance, these records must be encrypted at rest and accessible only by a specific service account that manages data ingestion. Furthermore, the encryption keys must be rotated annually. Which encryption and access control strategy should be used?
- AGoogle-managed encryption keys with Cloud IAM roles for the service account.
- BClient-side encryption before uploading to Cloud Storage, with public/private key pairs.
- CCustomer-managed encryption keys (CMEK) with Cloud IAM roles for the service account.
- DCustomer-supplied encryption keys (CSEK) with Uniform bucket-level access.
Show answer & explanationAnswer & explanation
Correct answer: C. Customer-managed encryption keys (CMEK) with Cloud IAM roles for the service account.
CMEK allows customers to control their encryption keys, including rotation, which meets the annual rotation requirement. Cloud IAM roles provide fine-grained access control for the specific service account.
Why the other options are wrong
- A. Google-managed encryption keys do not allow customer control over key rotation schedules.
- B. Client-side encryption is possible, but it shifts the key management burden entirely to the client and might not integrate seamlessly with Cloud Storage's native features for access control and auditing.
- D. CSEK requires the customer to provide the key with every request, which is operationally complex, and Uniform bucket-level access is too broad for specific service account access to individual objects.
Cloud Storage CMEK
Customer-Managed Encryption Keys (CMEK) for Cloud Storage allow you to use encryption keys that you manage in Cloud Key Management Service (KMS) to encrypt your data at rest in Cloud Storage buckets.
- Provides enhanced control over encryption keys.
- Integrates with Cloud KMS for key management and rotation.
- Data is still encrypted by Google, but with your key.
- Meets many compliance requirements for key control.
Memory trick: CMEK is the Key for control, let IAM roll!