Your enterprise DevOps team is architecting a continuous integration and continuous deployment (CI/CD) pipeline on Google Cloud. The architecture spans a dedicated security project for key management (proj-kms-sec) and a pipeline project (proj-cicd-prod). The pipeline requires Customer-Managed Encryption Keys (CMEK) to protect the following components: Deployment credentials stored in Google Cloud Secret Manager with a user-managed replication policy targeting us-central1 and us-east1 Build artifacts stored in a regional Cloud Storage bucket in us-central1 Container images stored in an Artifact Registry repository located in us-central1 How should you configure the Cloud KMS keys and IAM permissions to support envelope encryption across these CI/CD pipeline resources?

Create regional symmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the us-central1 key to the Cloud Storage and Artifact Registry service agents, and grant the role on both regional keys to the Secret Manager service identity.: ### What Customer-Managed Encryption Keys (CMEK) and Service Agent Roles Are **Customer-Managed Encryption Keys (CMEK)** allow organizations to use **Cloud Key Management Service (Cloud KMS)** to control the **Key Encryption Keys (KEKs)** that protect data at rest. Under Google Cloud's **envelope encryption** model, services generate a local, unique **Data Encryption Key (DEK)** to encrypt the actual resource payload (such as a secret version, storage object, or container layer), and the DEK is subsequently encrypted using the KEK residing in Cloud KMS. ### How it Meets the Architecture Requirements - **Regional Key Alignment**: Cloud KMS keys must match the exact geographical locations of the encrypted resources. Creating regional keys in `us-central1` and `us-east1` satisfies the location constraints for all target services. - **Secret Manager User-Managed Replication**: When Secret Manager is configured with user-managed replication across `us-central1` and `us-east1`, separate CMEK keys matching each replica region must be provisioned. The Secret Manager service identity (`service-@gcp-sa-secretmanager.iam.gserviceaccount.com`) must have `roles/cloudkms.cryptoKeyEncrypterDecrypter` on both regional keys to encrypt and decrypt the DEKs for secret versions in those regions. - **Cloud Storage & Artifact Registry Integration**: The Cloud Storage service agent (`service-@gs-project-accounts.iam.gserviceaccount.com`) and the Artifact Registry service agent (`service-@gcp-sa-artifactregistry.iam.gserviceaccount.com`) must be granted `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the `us-central1` KMS key. ### Key Advantages - **Strict Separation of Duties**: Storing cryptographic keys in a separate project (`proj-kms-sec`) isolates key lifecycle management from application workloads. - **Least Privilege Access**: Direct build runners and end users do not require decryption permissions on the KMS keys; only Google-managed service identities perform envelope encryption/decryption operations on their behalf. - **Granular Auditability**: All cryptographic wrap and unwrap operations generate Cloud Audit Logs in the KMS project.

Cmek Envelope Encryption Secret Manager Cicd | Professional Cloud DevOps Engineer

Cmek Envelope Encryption Secret Manager Cicd

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise DevOps team is architecting a continuous integration and continuous deployment (CI/CD) pipeline on Google Cloud. The architecture spans a dedicated security project for key management (proj-kms-sec) and a pipeline project (proj-cicd-prod).

The pipeline requires Customer-Managed Encryption Keys (CMEK) to protect the following components:

Deployment credentials stored in Google Cloud Secret Manager with a user-managed replication policy targeting us-central1 and us-east1
Build artifacts stored in a regional Cloud Storage bucket in us-central1
Container images stored in an Artifact Registry repository located in us-central1

How should you configure the Cloud KMS keys and IAM permissions to support envelope encryption across these CI/CD pipeline resources?

Create regional symmetric KMS keys in us-central1 and us-east1 within proj-cicd-prod. Grant the roles/cloudkms.admin role on the key rings to the CI/CD pipeline service account.

Create regional symmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the us-central1 key to the Cloud Storage and Artifact Registry service agents, and grant the role on both regional keys to the Secret Manager service identity.

Create a single global symmetric KMS key in proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on this global key to the Cloud Build service account used by the CI/CD pipeline.

Create regional asymmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.signerVerifier role to the Secret Manager, Cloud Storage, and Artifact Registry service agents.

Professional Cloud DevOps Engineer

Cmek Envelope Encryption Secret Manager Cicd

Related questions