A financial services organization is implementing customer-managed encryption keys (CMEK) using Cloud Key Management Service (Cloud KMS) to protect data across several Cloud Storage buckets. The compliance team requires a strict separation of duties and the enforcement of least privilege across cryptographic assets: Key administrators must create, rotate, and manage keys and permissions, but must be prevented from encrypting or decrypting data payloads. The Cloud Storage service agent must be capable of encrypting and decrypting data using the cryptographic keys, but must have no administrative privileges over key configurations. Access should be scoped to the minimal necessary resource level. Which IAM role configuration should you implement to satisfy these requirements?

Assign the Cloud KMS Admin (`roles/cloudkms.admin`) role to the key administrators on the KeyRing or project, and assign the Cloud KMS CryptoKey Encrypter/Decrypter (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) role to the Cloud Storage service agent on the specific CryptoKey.: ### What this configuration is This configuration establishes a strict **separation of duties** and implements the **principle of least privilege** by assigning distinct predefined Cloud KMS roles to human administrators and service identities at the appropriate resource hierarchy levels. ### How it meets the requirements - **Administrative Isolation**: The **Cloud KMS Admin** (`roles/cloudkms.admin`) role allows key administrators to create, update, and manage the lifecycle of KeyRings and CryptoKeys, as well as set IAM policies. Crucially, this role does not grant `cloudkms.cryptoKeyVersions.useToEncrypt` or `cloudkms.cryptoKeyVersions.useToDecrypt` permissions, preventing administrators from encrypting or decrypting data. - **Service-Level Cryptography**: The **Cloud KMS CryptoKey Encrypter/Decrypter** (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) role provides the Cloud Storage service agent (`service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com`) the exact permissions required to encrypt and decrypt object data during read and write operations. - **Granular Scope**: Granting the encrypter/decrypter role directly on the **specific CryptoKey** ensures access is restricted to the smallest required resource boundary. ### Key advantages and capabilities - **No Direct Data Decryption**: Prevents key managers from abusing key administrative rights to view sensitive underlying data. - **Least Privilege Compliance**: Adheres to Google Cloud security standards by scoping service agent access to the target CryptoKey rather than an entire project. - **Audit Alignment**: Simplifies compliance audits by clearly separating key governance from cryptographic data operations. - **Predefined Role Safety**: Leverages purpose-built predefined roles rather than overly broad basic roles. ### Why this is optimal Predefined Cloud KMS roles are inherently engineered to separate key administration from data plane cryptographic operations. Applying these bindings at the CryptoKey level ensures that both least privilege and organizational duty separation are strictly enforced.

StudyCerts

Cloud Kms Iam Separation Of Duties Cmek | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Kms Iam Separation Of Duties Cmek

Section: Managing customer-managed encryption keys with Cloud Key Management Service (Cloud KMS)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial services organization is implementing customer-managed encryption keys (CMEK) using Cloud Key Management Service (Cloud KMS) to protect data across several Cloud Storage buckets. The compliance team requires a strict separation of duties and the enforcement of least privilege across cryptographic assets:

Key administrators must create, rotate, and manage keys and permissions, but must be prevented from encrypting or decrypting data payloads.
The Cloud Storage service agent must be capable of encrypting and decrypting data using the cryptographic keys, but must have no administrative privileges over key configurations.
Access should be scoped to the minimal necessary resource level.

Which IAM role configuration should you implement to satisfy these requirements?

Assign the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to both the key administrators and the Cloud Storage service agent at the project level.

Assign the Cloud KMS Admin (roles/cloudkms.admin) role to the key administrators on the KeyRing or project, and assign the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to the Cloud Storage service agent on the specific CryptoKey.

Assign the Project Owner (roles/owner) role to the key administrators at the project level, and assign the Cloud KMS Admin (roles/cloudkms.admin) role to the Cloud Storage service agent on the KMS KeyRing.

Assign the Cloud KMS Admin (roles/cloudkms.admin) role to the key administrators, and assign the Storage Admin (roles/storage.admin) role to the Cloud Storage service agent on the target Cloud Storage bucket.

Professional Cloud Architect

Cloud Kms Iam Separation Of Duties Cmek

Related questions