Professional Cloud ArchitectAnalyze and optimize technical and business processesMedium
A healthcare provider is building a new patient portal application on Google Cloud that needs to comply with strict regulatory requirements for data residency and sovereignty. Patient data, including medical records and personal identifiable information (PII), must be stored and processed exclusively within a specific geographic region (e.g., EU-West1) and not leave its borders. Which Google Cloud storage and compute configuration ensures this data residency requirement?
- AUse a multi-region Cloud Storage bucket with data encryption keys managed by Cloud KMS in a single region.
- BUse a single-region Cloud Storage bucket and Compute Engine instances deployed only in that region.
- CUse a dual-region Cloud Storage bucket and Compute Engine instances in a single region.
- DUse a multi-region Cloud Storage bucket and Compute Engine instances in a single region.
Show answer & explanationAnswer & explanation
Correct answer: B. Use a single-region Cloud Storage bucket and Compute Engine instances deployed only in that region.
To ensure strict data residency and sovereignty within a specific geographic region, both the storage for patient data (Cloud Storage bucket) and the compute resources processing that data (Compute Engine instances) must be explicitly configured to operate only within that single region. This prevents data from ever leaving the specified borders.
Why the other options are wrong
- A. While Cloud KMS in a single region helps with key management, a multi-region Cloud Storage bucket still stores data across multiple regions, violating data residency requirements. The encryption itself doesn't prevent data movement.
- C. A dual-region Cloud Storage bucket stores data in two distinct regions, which violates the 'not leave its borders' requirement for a single geographic region.
- D. A multi-region Cloud Storage bucket stores data across multiple specified regions, which violates the 'not leave its borders' requirement for a single geographic region.
Data Residency on Google Cloud
Data residency refers to the physical location where data is stored and processed, often a critical requirement for regulatory compliance and sovereignty.
- Single-region Cloud Storage buckets keep data within one region.
- Compute Engine instances process data within their deployed region.
- Multi-region and dual-region buckets allow data to cross regional borders.
- Network egress from a region can also be a residency concern.
Memory trick: Region's the rule, data's the jewel, keep it contained, that's the cool!