A financial services organization is implementing customer-managed encryption keys (CMEK) using Cloud Key Management Service (Cloud KMS) to protect data across several Cloud Storage buckets. The compliance team requires a strict separation of duties and the enforcement of least privilege across cryptographic assets: Key administrators must create, rotate, and manage keys and permissions, but must be prevented from encrypting or decrypting data payloads. The Cloud Storage service agent must be capable of encrypting and decrypting data using the cryptographic keys, but must have no administrative privileges over key configurations. Access should be scoped to the minimal necessary resource level. Which IAM role configuration should you implement to satisfy these requirements?

Assign the Cloud KMS Admin (`roles/cloudkms.admin`) role to the key administrators on the KeyRing or project, and assign the Cloud KMS CryptoKey Encrypter/Decrypter (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) role to the Cloud Storage service agent on the specific CryptoKey.: What this configuration is This configuration establishes a strict separation of duties and implements the principle of least privilege by assigning distinct predefined Cloud KMS roles to human administrators and service identities at the appropriate resource hierarchy levels. How it meets the requirements Administrative Isolation: The Cloud KMS Admin (roles/cloudkms.admin) role allows key administrators to create, update, and manage the lifecycle of KeyRings and CryptoKeys, as well as set IAM policies. Crucially, this role does not grant cloudkms.cryptoKeyVersions.useToEncrypt or cloudkms.cryptoKeyVersions.useToDecrypt permissions, preventing administrators from encrypting or decrypting data. Service-Level Cryptography: The Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role provides the Cloud Storage service agent (service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com) the exact permissions required to encrypt and decrypt object data during read and write operations. Granular Scope: Granting the encrypter/decrypter role directly on the specific CryptoKey ensures access is restricted to the smallest required resource boundary. Key advantages and capabilities No Direct Data Decryption: Prevents key managers from abusing key administrative rights to view sensitive underlying data. Least Privilege Compliance: Adheres to Google Cloud security standards by scoping service agent access to the target CryptoKey rather than an entire project. Audit Alignment: Simplifies compliance audits by clearly separating key governance from cryptographic data operations. Predefined Role Safety: Leverages purpose-built predefined roles rather than overly broad basic roles. Why this is optimal Predefined Cloud KMS roles are inherently engineered to separate key administration from data plane cryptographic operations. Applying these bindings at the CryptoKey level ensures that both least privilege and organizational duty separation are strictly enforced.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Kms Iam Separation Of Duties Cmek

Section: Managing customer-managed encryption keys with Cloud Key Management Service (Cloud KMS)

A financial services organization is implementing customer-managed encryption keys (CMEK) using Cloud Key Management Service (Cloud KMS) to protect data across several Cloud Storage buckets. The compliance team requires a strict separation of duties and the enforcement of least privilege across cryptographic assets:

Key administrators must create, rotate, and manage keys and permissions, but must be prevented from encrypting or decrypting data payloads.
The Cloud Storage service agent must be capable of encrypting and decrypting data using the cryptographic keys, but must have no administrative privileges over key configurations.
Access should be scoped to the minimal necessary resource level.

Which IAM role configuration should you implement to satisfy these requirements?

Assign the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to both the key administrators and the Cloud Storage service agent at the project level.

Assign the Cloud KMS Admin (roles/cloudkms.admin) role to the key administrators, and assign the Storage Admin (roles/storage.admin) role to the Cloud Storage service agent on the target Cloud Storage bucket.

Assign the Project Owner (roles/owner) role to the key administrators at the project level, and assign the Cloud KMS Admin (roles/cloudkms.admin) role to the Cloud Storage service agent on the KMS KeyRing.

Assign the Cloud KMS Admin (roles/cloudkms.admin) role to the key administrators on the KeyRing or project, and assign the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to the Cloud Storage service agent on the specific CryptoKey.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Kms Iam Separation Of Duties Cmek

Section: Managing customer-managed encryption keys with Cloud Key Management Service (Cloud KMS)

Key administrators must create, rotate, and manage keys and permissions, but must be prevented from encrypting or decrypting data payloads.
The Cloud Storage service agent must be capable of encrypting and decrypting data using the cryptographic keys, but must have no administrative privileges over key configurations.
Access should be scoped to the minimal necessary resource level.

Which IAM role configuration should you implement to satisfy these requirements?

Assign the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to both the key administrators and the Cloud Storage service agent at the project level.

Explanations

What this configuration is

This configuration establishes a strict separation of duties and implements the principle of least privilege by assigning distinct predefined Cloud KMS roles to human administrators and service identities at the appropriate resource hierarchy levels.

How it meets the requirements

Administrative Isolation: The Cloud KMS Admin (roles/cloudkms.admin) role allows key administrators to create, update, and manage the lifecycle of KeyRings and CryptoKeys, as well as set IAM policies. Crucially, this role does not grant cloudkms.cryptoKeyVersions.useToEncrypt or cloudkms.cryptoKeyVersions.useToDecrypt permissions, preventing administrators from encrypting or decrypting data.
Service-Level Cryptography: The Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role provides the Cloud Storage service agent (service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com) the exact permissions required to encrypt and decrypt object data during read and write operations.
Granular Scope: Granting the encrypter/decrypter role directly on the specific CryptoKey ensures access is restricted to the smallest required resource boundary.

Key advantages and capabilities

No Direct Data Decryption: Prevents key managers from abusing key administrative rights to view sensitive underlying data.
Least Privilege Compliance: Adheres to Google Cloud security standards by scoping service agent access to the target CryptoKey rather than an entire project.
Audit Alignment: Simplifies compliance audits by clearly separating key governance from cryptographic data operations.
Predefined Role Safety: Leverages purpose-built predefined roles rather than overly broad basic roles.

Why this is optimal

Predefined Cloud KMS roles are inherently engineered to separate key administration from data plane cryptographic operations. Applying these bindings at the CryptoKey level ensures that both least privilege and organizational duty separation are strictly enforced.

View source documentation

Professional Cloud Architect

Cloud Kms Iam Separation Of Duties Cmek

Professional Cloud Architect

Cloud Kms Iam Separation Of Duties Cmek

What this configuration is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Cloud Spanner Germany Dual-Region Configuration

Cloud Identity SAML Federation with Microsoft Entra ID

Professional Cloud Architect

Cloud Kms Iam Separation Of Duties Cmek

Professional Cloud Architect

Cloud Kms Iam Separation Of Duties Cmek

What this configuration is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions

Cloud Spanner Germany Dual-Region Configuration

Cloud Identity SAML Federation with Microsoft Entra ID