Professional Cloud Security EngineerEnsuring complianceMedium
A financial services company uses Google Cloud for its critical trading platform. Due to strict regulatory requirements, they must be able to demonstrate that any access to their data by Google support personnel is fully transparent and auditable. They need to ensure that they can approve or deny access requests and view detailed logs of all such access. Which two Google Cloud services, when used together, best meet these requirements?
- AAccess Transparency and Cloud Audit Logs
- BAccess Approval and Access Transparency
- CCloud Identity and Access Management and Security Command Center
- DResource Manager and Essential Contacts
Show answer & explanationAnswer & explanation
Correct answer: B. Access Approval and Access Transparency
Access Approval allows customers to explicitly approve or deny Google support personnel access to their data, providing an approval workflow. Access Transparency provides near real-time logs of Google administrators' actions when they access customer data, fulfilling the auditable and transparent access requirement. Together, they offer both control and visibility.
Why the other options are wrong
- A. Access Transparency provides logs, but Cloud Audit Logs alone does not offer the approval mechanism for Google access.
- C. Cloud IAM manages user permissions, and Security Command Center provides security insights, but they do not specifically manage or log Google's access to customer data in this manner.
- D. Resource Manager manages the resource hierarchy, and Essential Contacts handles notification contacts, neither directly addresses Google's access to customer data.
Access Approval & Access Transparency
Access Approval allows customers to approve or deny Google personnel access to their data, while Access Transparency provides logs of Google's administrative actions on customer resources.
- Access Approval provides explicit control over Google access.
- Access Transparency offers immutable logs of Google's actions.
- Crucial for highly regulated industries requiring auditability.
Memory trick: Approve and See: Google's Data Journey.