Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud feature
Cloud KMS Autokey
Topic in 4 exam domains
Also called: Autokey, Cloud KMS with Autokey
A Cloud KMS capability that generates key rings, keys, and service agents on demand to support resource creation in services like Bigtable.
Where this appears on the exam
3 objectives in 2 of 5 domains
Related topics
FoundationsThis topicWorks alongsideBuilds on theseBuilds on theseAppliedCloud Key Management ServiceServiceCloud HSMServiceCompute EngineServiceIdentity and Access ManagementServiceVPC Service ControlsService
Cloud KMS AutokeyFeature
AlloyDB for PostgreSQLServiceCloud LoggingServiceBigtableServiceCloud Asset InventoryServicecustomer-managed encryption keysFeatureSecret ManagerServiceArtifact RegistryServiceCloud SQLServiceCloud StorageServicePub/SubServiceBigQueryServiceCloud RunServiceCloud Run functionsServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- Cloud KMS Autokey is part of Cloud Key Management Service From the official documentation: “Autokey simplifies creating and managing Cloud KMS keys by automating provisioning and assignment.”
- Cloud KMS Autokey works with Cloud Storage From the official documentation: “Using Autokey with Cloud Storage resources”
- Cloud KMS Autokey configures customer-managed encryption keys From the official documentation: “Cloud KMS Autokey lets you automate the provisioning and assignment of CMEKs.”
- Cloud KMS Autokey works with Secret Manager From the official documentation: “Secret Manager is only compatible with Cloud KMS Autokey when creating resources using Terraform or the REST API.”
- AlloyDB for PostgreSQL works with Cloud KMS Autokey From the official documentation: “AlloyDB is only compatible with Cloud KMS Autokey when creating resources using Terraform or the REST API.”
- Artifact Registry works with Cloud KMS Autokey From the official documentation: “With Autokey, key rings and keys are generated on demand to support resource creation in Artifact Registry.”
- BigQuery works with Cloud KMS Autokey From the official documentation: “With Autokey, key rings and keys are generated on demand to support resource creation in BigQuery.”
- Bigtable works with Cloud KMS Autokey From the official documentation: “Autokey creates a default key when you create Bigtable clusters.”
- Cloud Asset Inventory works with Cloud KMS Autokey From the official documentation: “You can use a SQL query with Cloud Asset Inventory to evaluate the effective Autokey configuration for all projects within a folder or an organization.”
- Cloud Key Management Service works with Cloud KMS Autokey From the official documentation: “Create an encryption management strategy using Cloud Key Management Service (Cloud KMS) with Autokey, Cloud External Key Manager (Cloud EKM), or both.”
- Cloud KMS Autokey depends on Cloud HSM From the official documentation: “Cloud HSM is required if you want to use Autokey to provision Cloud KMS keys.”
- Cloud KMS Autokey works with Cloud Logging From the official documentation: “Every key generated, permission assigned, and policy adjusted by Autokey is recorded in Cloud Logging. This provides auditors with a continuous, automated audit trail to verify compliance.”
- Cloud KMS Autokey works with Cloud Run From the official documentation: “With Autokey, key rings and keys are generated on demand to support resource creation in Cloud Run.”
- Cloud KMS Autokey works with Compute Engine From the official documentation: “Using Autokey with Compute Engine resources”
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Cloud Run works with Cloud SQL From the official documentation: “Learn how to connect to Cloud SQL from Cloud Run”
- VPC Service Controls secures BigQuery From the official documentation: “BigQuery data is protected with VPC Service Controls”
- Cloud Logging works with customer-managed encryption keys From the official documentation: “To use Cloud Logging with Customer-managed encryption keys (CMEK), you must complete the steps in the [Enable CMEK for an organization](/logging/docs/routing/managed-encryption#enable) page in the Cloud Logging documentation.”
- Cloud SQL works with Cloud Storage From the official documentation: “When ingesting data from Cloud SQL, data is first staged to a Cloud Storage bucket.”
- BigQuery works with Bigtable From the official documentation: “External BigQuery data source backed by Bigtable”
- Cloud Run works with Pub/Sub From the official documentation: “Route Cloud Pub/Sub events to Cloud Run”
- Cloud SQL works with Compute Engine From the official documentation: “Create a Compute Engine VM Instance to host a sample web app that connects to Cloud SQL.”
- BigQuery works with Cloud Asset Inventory From the official documentation: “You can also use Cloud Asset Inventory to transfer this data into BigQuery.”
- Cloud Run works with Cloud Storage From the official documentation: “Route Cloud Storage events to Cloud Run”
- Cloud Run works with Secret Manager From the official documentation: “You can integrate Secret Manager with other Google Cloud products such as Cloud Run.”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- Pub/Sub works with Secret Manager From the official documentation: “Receive notifications via Pub/Sub when Secret Manager resources change.”
- BigQuery is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- Cloud Run functions works with Cloud Storage From the official documentation: “Set up functions in response to events in Cloud Storage:”
- BigQuery works with Cloud Run functions From the official documentation: “BigQuery supports external function calls through Cloud Run functions.”
- Cloud Run depends on Pub/Sub From the official documentation: “Create a Pub/Sub topic that Cloud Scheduler will publish to and the Cloud Run function will subscribe to.”
- Cloud Run functions works with Pub/Sub From the official documentation: “Use Cloud Run functions to publish messages on Pub/Sub.”
- Cloud SQL works with Identity and Access Management From the official documentation: “This page describes how Cloud SQL is integrated with IAM .”
- Compute Engine works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
- customer-managed encryption keys secures Cloud Storage From the official documentation: “CMEKs encrypt data at rest in Cloud SQL, Cloud Storage, and within GKE clusters.”
- BigQuery works with Pub/Sub From the official documentation: “createBigQuerySubscription creates a Pub/Sub subscription that exports messages to BigQuery.”
- Cloud Logging works with Cloud SQL From the official documentation: “Cloud SQL uses Cloud Logging.”
- Cloud Run functions depends on Pub/Sub From the official documentation: “The Pub/Sub message triggers Cloud Run functions.”
- Cloud SQL depends on Compute Engine From the official documentation: “Cloud SQL uses Compute Engine virtual machines (VMs) with persistent storage disks.”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
- customer-managed encryption keys secures Cloud SQL From the official documentation: “Enable CMEK for Cloud SQL Databases”
- customer-managed encryption keys secures Pub/Sub From the official documentation: “Encrypt Pub/Sub topic with CMEK”
- Cloud SQL works with Secret Manager From the official documentation: “Secret Manager attempts to update the credentials in your Cloud SQL instance.”
- Cloud Storage works with customer-managed encryption keys From the official documentation: “Cloud Storage supports CMEK for routing logs.”
- Cloud Storage works with Identity and Access Management From the official documentation: “To learn how to use IAM with Cloud Storage, see [Using IAM Permissions](/storage/docs/access-control/using-iam-permissions).”
- Cloud Storage works with Pub/Sub From the official documentation: “| **Google Cloud** | Cloud Storage | Pub/Sub |”
- Cloud Storage is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- customer-managed encryption keys secures Secret Manager From the official documentation: “In Secret Manager, you can use a CMEK to protect data at rest.”
- Identity and Access Management secures Secret Manager From the official documentation: “Secret Manager uses Identity and Access Management (IAM) for authorization.”
- VPC Service Controls secures Cloud Storage From the official documentation: “Storage Transfer Service supports transfers to Cloud Storage buckets protected by VPC Service Controls.”
- Artifact Registry works with Cloud Run From the official documentation: “Cloud Run recommends using Artifact Registry.”
- Cloud Logging works with Cloud Storage From the official documentation: “Cloud Storage writes various log entries to Cloud Logging in the Google Cloud console.”
- Cloud Logging works with Pub/Sub From the official documentation: “Pub/Sub writes various log entries to Cloud Logging in the Google Cloud console.”
- Cloud Run is an alternative to Cloud Run functions From the official documentation: “To create remote functions, you must [grant required roles](/bigquery/docs/remote-functions#grant_permission_on_function) to Cloud Run functions or Cloud Run.”
- customer-managed encryption keys secures Artifact Registry From the official documentation: “Artifact Registry also supports [organization policy constraints](/artifact-registry/docs/cmek#org-policy) that can require CMEK to protect resources.”
- Identity and Access Management secures BigQuery From the official documentation: “Access to BigQuery data from AlloyDB is managed through IAM.”
How learners score on this topic
Last updated