Professional Data EngineerManaging and securing dataMedium
A financial services company is migrating its on-premises transactional database to Google Cloud. The database contains highly sensitive customer financial data that requires stringent access controls and encryption at rest. The company needs to ensure that only authorized applications and users can access specific tables and columns, and that all data is encrypted with customer-managed encryption keys (CMEK). Which Google Cloud storage service and access control mechanism should you recommend to meet these requirements?
- ACloud Storage with Uniform bucket-level access and Customer-Supplied Encryption Keys (CSEK).
- BFirestore in Datastore mode with Security Rules and CMEK.
- CCloud SQL with Cloud IAM roles and Customer-Managed Encryption Keys (CMEK).
- DBigQuery with Authorized Views and default Google-managed encryption keys.
Show answer & explanationAnswer & explanation
Correct answer: C. Cloud SQL with Cloud IAM roles and Customer-Managed Encryption Keys (CMEK).
Cloud SQL is a fully managed relational database service suitable for transactional data. It supports fine-grained access control through Cloud IAM and allows the use of CMEK for enhanced security and compliance.
Why the other options are wrong
- A. Cloud Storage is object storage, not ideal for relational transactional databases, and Uniform bucket-level access is too broad for column-level control. CSEK requires the customer to provide and manage encryption keys during every operation.
- B. Firestore in Datastore mode is a NoSQL document database, not a relational transactional database, and its security rules operate differently than the fine-grained controls often needed for relational tables and columns.
- D. BigQuery is an analytical data warehouse, not designed for transactional workloads, and Authorized Views provide row/column-level access control but the requirement specifies CMEK, not default Google-managed keys.
Cloud SQL & CMEK for Relational Data
Cloud SQL is a fully managed relational database service on Google Cloud that supports various database engines. It integrates with Customer-Managed Encryption Keys (CMEK) for enhanced data security and compliance.
- Supports PostgreSQL, MySQL, and SQL Server.
- Offers high availability, replication, and automatic backups.
- CMEK provides customer control over encryption keys.
Memory trick: SQL on the Cloud with a Key, keeps your data safe, hip hip hooray!