Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A financial services organization is implementing customer-managed encryption keys (CMEK) using Cloud Key Management Service (Cloud KMS) to protect data across several Cloud Storage buckets. The compliance team requires a strict separation of duties and the enforcement of least privilege across cryptographic assets:
Which IAM role configuration should you implement to satisfy these requirements?
Assign the Cloud KMS Admin (roles/cloudkms.admin) role to the key administrators on the KeyRing or project, and assign the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to the Cloud Storage service agent on the specific CryptoKey.
Assign the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to both the key administrators and the Cloud Storage service agent at the project level.
Assign the Cloud KMS Admin (roles/cloudkms.admin) role to the key administrators, and assign the Storage Admin (roles/storage.admin) role to the Cloud Storage service agent on the target Cloud Storage bucket.
Assign the Project Owner (roles/owner) role to the key administrators at the project level, and assign the Cloud KMS Admin (roles/cloudkms.admin) role to the Cloud Storage service agent on the KMS KeyRing.
Assign the Cloud KMS Admin (roles/cloudkms.admin) role to the key administrators on the KeyRing or project, and assign the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to the Cloud Storage service agent on the specific CryptoKey.
This configuration establishes a strict separation of duties and implements the principle of least privilege by assigning distinct predefined Cloud KMS roles to human administrators and service identities at the appropriate resource hierarchy levels.
StudyCerts
StudyCertsroles/cloudkms.admin) role allows key administrators to create, update, and manage the lifecycle of KeyRings and CryptoKeys, as well as set IAM policies. Crucially, this role does not grant cloudkms.cryptoKeyVersions.useToEncrypt or cloudkms.cryptoKeyVersions.useToDecrypt permissions, preventing administrators from encrypting or decrypting data.roles/cloudkms.cryptoKeyEncrypterDecrypter) role provides the Cloud Storage service agent (service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com) the exact permissions required to encrypt and decrypt object data during read and write operations.Predefined Cloud KMS roles are inherently engineered to separate key administration from data plane cryptographic operations. Applying these bindings at the CryptoKey level ensures that both least privilege and organizational duty separation are strictly enforced.
Assign the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) role to both the key administrators and the Cloud Storage service agent at the project level.
Assign the Cloud KMS Admin (roles/cloudkms.admin) role to the key administrators, and assign the Storage Admin (roles/storage.admin) role to the Cloud Storage service agent on the target Cloud Storage bucket.
Assign the Project Owner (roles/owner) role to the key administrators at the project level, and assign the Cloud KMS Admin (roles/cloudkms.admin) role to the Cloud Storage service agent on the KMS KeyRing.