A financial enterprise is subject to strict regulatory compliance mandates governing data residency, cryptographic boundary isolation, and access governance. The security team needs to enforce the following controls across their Google Cloud environment: Ensure that data analytics and storage services cannot provision unencrypted or default-encrypted resources. Restrict all Customer-Managed Encryption Keys (CMEK) to originate strictly from key rings located in authorized regulatory regions within a dedicated KMS host project. Maintain least privilege access by granting encryption/decryption capabilities only to the necessary Google-managed service identities. Which combination of controls and Organization Policies should the enterprise implement?

Apply the `constraints/gcp.restrictNonCmekServices` and `constraints/gcp.restrictCmekCryptoKeyProjects` organization policies, create regional symmetric Cloud KMS keys in the dedicated project, and grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the respective service agents on the specific keys.: ### What the CMEK Governance and IAM Solution Is This architecture combines native **Google Cloud Organization Policy constraints** with granular **Identity and Access Management (IAM)** permissions on regional **Cloud KMS CryptoKeys** to establish strict cryptographic boundary isolation, automated compliance enforcement, and least privilege access governance. ### How It Meets Regulatory Requirements - **Mandatory CMEK enforcement**: Applying the `constraints/gcp.restrictNonCmekServices` organization policy constraint blocks the creation of resources using Google default encryption across specified supported services, ensuring that data is encrypted using customer-managed keys. - **Cryptographic key isolation and residency**: The `constraints/gcp.restrictCmekCryptoKeyProjects` constraint restricts the resource hierarchy locations from which CMEK keys can be selected, ensuring keys only come from the approved, dedicated Cloud KMS project and valid regional locations. - **Least privilege access governance**: Granting the `roles/cloudkms.cryptoKeyEncrypterDecrypter` role directly on individual crypto keys to the specific Google-managed service agents (such as `service-PROJECT_NUMBER@gcp-sa-...iam.gserviceaccount.com`) ensures that only authorized workload identities can perform cryptographic operations without over-granting key administrative permissions. ### Key Advantages and Capabilities - **Preventative Guardrails**: Prevents accidental provisioning of non-compliant resources before deployment completes. - **Centralized Key Management**: Allows separation of duties between Cloud KMS key administrators in the security host project and workload administrators in application projects. - **Regional Data Residency**: Guarantees that the key rings and the protected data services remain co-located in the designated compliance region. - **Granular IAM Scoping**: Binds cryptographic permissions to specific key resources rather than granting broad project-level permissions. ### Why This Is Optimal This solution uses native organization policies to automatically enforce compliance guardrails without requiring custom post-deployment remediation scripts. It perfectly balances preventative security controls with least-privilege identity access management.

Enforce Cmek Org Policies Least Privilege | Professional Cloud Security Engineer

Enforce Cmek Org Policies Least Privilege

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is subject to strict regulatory compliance mandates governing data residency, cryptographic boundary isolation, and access governance. The security team needs to enforce the following controls across their Google Cloud environment:

Ensure that data analytics and storage services cannot provision unencrypted or default-encrypted resources.
Restrict all Customer-Managed Encryption Keys (CMEK) to originate strictly from key rings located in authorized regulatory regions within a dedicated KMS host project.
Maintain least privilege access by granting encryption/decryption capabilities only to the necessary Google-managed service identities.

Which combination of controls and Organization Policies should the enterprise implement?

Enable Data Access audit logs with DATA_READ for all services, disable default service account creation, and assign roles/cloudkms.cryptoKeyViewer to all workload identities on the KMS key ring.

Apply the constraints/gcp.resourceLocations organization policy constraint, configure Cloud KMS with asymmetrical signing keys in a multi-region location, and grant roles/cloudkms.admin to the default Compute Engine service account.

Deploy VPC Service Controls around all service projects, configure Cloud KMS Autokey at the folder level, and grant roles/owner to the workload service accounts on the host project.

Apply the constraints/gcp.restrictNonCmekServices and constraints/gcp.restrictCmekCryptoKeyProjects organization policies, create regional symmetric Cloud KMS keys in the dedicated project, and grant roles/cloudkms.cryptoKeyEncrypterDecrypter to the respective service agents on the specific keys.

Professional Cloud Security Engineer

Enforce Cmek Org Policies Least Privilege

Related questions