Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud service
Key Access Justifications
Topic in 2 exam domains
- Key Access Justifications · Service
- Key Access Justifications · Feature
Also called: KAJ
An administrative access control offering that provides visibility and justification for encryption key requests, with controls to approve or deny decryption.
Where this appears on the exam
2 objectives in 1 of 5 domains
Related topics
FoundationsBuilding blocksThis topicWorks alongsideBuilds on theseBuilds on theseAppliedCloud EKMServiceIdentity and Access ManagementServiceKnowledge CatalogServiceAccess ApprovalServiceAssured WorkloadsServiceSpannerService
Key Access JustificationsFeature
Cloud Audit LogsServiceCloud Key Management ServiceServiceCloud KMSServiceCloud External Key ManagerServicecustomer-managed encryption keysFeatureCloud HSMServiceBigQueryServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- Cloud External Key Manager works with Key Access Justifications From the official documentation: “If you [use a Cloud EKM key](/alloydb/docs/cmek#ekm), then you can use Key Access Justifications to view the reason for each Cloud EKM request.”
- Key Access Justifications is part of Cloud External Key Manager From the official documentation: “You can use Key Access Justifications as part of Cloud EKM.”
- Access Approval works with Key Access Justifications From the official documentation: “For workloads with Access Approval enabled with a custom signing key, Key Access Justifications will also apply to processing signed access approval requests.”
- Cloud KMS works with Key Access Justifications From the official documentation: “Key Access Justifications enable control over viewing and approving key access<br>requests in Cloud KMS or [certain external key<br>management partners](/kms/docs/ekm#compatibility).”
- Key Access Justifications depends on Assured Workloads From the official documentation: “You can only use Key Access Justifications with Cloud KMS and Cloud HSM keys in folders enrolled in the Japan Regions control package in Assured Workloads.”
- Key Access Justifications configures Cloud Key Management Service From the official documentation: “[Key Access Justifications](/assured-workloads/key-access-justifications/docs/overview) lets you set a policy on Cloud KMS keys to view, approve, and deny key access requests depending on the provided justification code.”
- Cloud EKM works with Key Access Justifications From the official documentation: “[Key Access Justifications](https://cloud.google.com/blog/products/identity-security/control-access-to-gcp-data-with-key-access-justifications) integrate with Cloud KMS and Cloud EKM.”
- Cloud HSM works with Key Access Justifications From the official documentation: “To configure Key Access Justifications with a Cloud KMS or Cloud HSM key, you can either include the key access policy as a parameter when you create the key, or you can update the key with the policy after the key has been created.”
- Cloud Key Management Service works with Key Access Justifications From the official documentation: “[Key Access Justifications](https://cloud.google.com/blog/products/identity-security/control-access-to-gcp-data-with-key-access-justifications) integrate with Cloud KMS and Cloud EKM.”
- Key Access Justifications is part of Cloud EKM From the official documentation: “You can use Key Access Justifications as part of Cloud EKM.”
- Key Access Justifications configures Cloud KMS From the official documentation: “[Key Access Justifications](https://cloud.google.com/assured-workloads/key-access-justifications/docs/overview) | View logged justifications for each access request to Cloud KMS keys and optionally set a policy to authorize key access requests based on the provided…”
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- BigQuery works with Knowledge Catalog From the official documentation: “Some Knowledge Catalog functionalities trigger job execution using BigQuery.”
- customer-managed encryption keys depends on Cloud KMS From the official documentation: “You must have a symmetric encryption key in Cloud KMS to use for CMEK.”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- BigQuery works with Spanner From the official documentation: “Reverse ETL (BigQuery to Spanner)”
- customer-managed encryption keys secures BigQuery From the official documentation: “You can either create CMEKs manually to protect your BigQuery resources or use Cloud KMS Autokey.”
- BigQuery works with Cloud Audit Logs From the official documentation: “Cloud Audit Logs maintain a record of Google Cloud events, including BigQuery events.”
- Cloud EKM works with customer-managed encryption keys From the official documentation: “You can also use an Cloud EKM key as a CMEK for encryption and decryption.”
- Cloud KMS works with customer-managed encryption keys From the official documentation: “With customer-managed encryption keys (CMEK), volume keys are wrapped using your keys stored in Cloud KMS.”
- Identity and Access Management secures BigQuery From the official documentation: “Access to BigQuery data from AlloyDB is managed through IAM.”
- Assured Workloads works with BigQuery From the official documentation: “After the enablement process is completed, you can use BigQuery in your<br>Assured Workloads folder.”
- BigQuery works with Cloud Key Management Service From the official documentation: “Change the Cloud KMS key for a BigQuery table”
- BigQuery works with Identity and Access Management From the official documentation: “BigQuery uses Identity and Access Management (IAM) for authorization.”
- Cloud Audit Logs works with Cloud Key Management Service From the official documentation: “Cloud Audit Logs for Cloud KMS in the Activity stream read like generic logs, and are not easily read by a human.”
- Cloud EKM works with Cloud Key Management Service From the official documentation: “You can use an [externally managed key](/kms/docs/ekm) with CMEK using the Cloud EKM service to make the key available through Cloud KMS.”
- Cloud HSM is part of Cloud Key Management Service From the official documentation: “You can import into Multi-tenant Cloud HSM keys, Single-tenant Cloud HSM keys, or software keys in Cloud KMS.”
- customer-managed encryption keys is part of Cloud Key Management Service From the official documentation: “The Cloud KMS keys that you create are customer-managed keys.”
- customer-managed encryption keys is part of Cloud KMS From the official documentation: “To protect your agents' data by using encryption keys that you control,<br>you can use [CMEKs](/kms/docs/cmek)<br>that you create and manage in Cloud KMS.”
- customer-managed encryption keys works with Spanner From the official documentation: “This page describes how to use manually-created customer-managed encryption keys (CMEK) for Spanner.”
- Identity and Access Management secures Spanner From the official documentation: “Spanner uses Identity and Access Management (IAM) for authorization.”
- Access Approval works with Assured Workloads From the official documentation: “When used with<br>Assured Workloads, the Access Approval request<br>conditions are secondary to the applied Assured Workloads<br>personnel access assurances.”
- Access Approval depends on Identity and Access Management From the official documentation: “Access Approval uses Identity and Access Management (IAM) for authorization.”
- BigQuery works with Cloud KMS From the official documentation: “# Enable the BigQuery service account to encrypt/decrypt Cloud KMS keys”
- Cloud Key Management Service secures BigQuery From the official documentation: “You can encrypt data at the dataset or project level with the default customer-managed Cloud Key Management Service keys in BigQuery.”
- Cloud Key Management Service is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Identity and Access Management secures Knowledge Catalog From the official documentation: “IAM controls access to your Knowledge Catalog resources at the Google Cloud resource level.”
- Assured Workloads works with Cloud Audit Logs From the official documentation: “This document describes audit logging for Assured Workloads. Google Cloud services generate audit logs that record administrative and access activities within your Google Cloud resources. For more information about Cloud Audit Logs, see the following:”
- Assured Workloads works with Cloud External Key Manager From the official documentation: “Assured Workloads supports Cloud EKM.”
- Assured Workloads works with Cloud Key Management Service From the official documentation: “Assured Workloads supports Cloud KMS.”
- Assured Workloads works with customer-managed encryption keys From the official documentation: “Assured Workloads supports CMEK for control packages such as IL4, for which CMEK is optional.”
- Assured Workloads depends on Identity and Access Management From the official documentation: “Assured Workloads uses Identity and Access Management (IAM) for authorization.”
- Assured Workloads works with Identity and Access Management From the official documentation: “This page provides information about supporting compliance with customer personnel restrictions using Identity and Access Management (IAM) in combination with Assured Workloads.”
- Assured Workloads works with Spanner From the official documentation: “Spanner also supports Assured Workloads, which lets you apply controls to specific folders in your Google organization that support regulatory, regional, or sovereign requirements.”
- Cloud Audit Logs works with Cloud KMS From the official documentation: “To access the justification, you first need to enable Cloud Audit Logs with Cloud KMS on the project containing the key used for encryption.”
- Cloud Audit Logs works with Knowledge Catalog From the official documentation: “This document describes audit logging for Knowledge Catalog. Google Cloud services generate audit logs that record administrative and access activities within your Google Cloud resources.”
- Cloud EKM works with Cloud KMS From the official documentation: “To learn how to use external keys with Cloud Key Management Service, see [Cloud External Key Manager](/kms/docs/ekm).”
- Cloud EKM works with Knowledge Catalog From the official documentation: “Knowledge Catalog supports Cloud KMS keys, Cloud HSM keys, and Cloud External Key Manager keys.”
- Cloud External Key Manager is part of Cloud Key Management Service From the official documentation: “In addition to these features, the Assured Workloads control package you choose will also determine which of the following Cloud KMS key types are available: - [Cloud EKM keys](/kms/docs/ekm#overview)”
- Cloud External Key Manager works with Cloud Key Management Service From the official documentation: “You can use an externally managed key with CMEK using the Cloud External Key Manager service to [make the key available](/kms/docs/ekm) through Cloud KMS.”
- Cloud External Key Manager is an alternative to Cloud Key Management Service From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud External Key Manager is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud External Key Manager works with Knowledge Catalog From the official documentation: “In addition, Knowledge Catalog supports Cloud External Key Manager (Cloud EKM), which lets you store your keys in an external key manager outside of Google Cloud.”
- Cloud External Key Manager works with Spanner From the official documentation: “In addition, Spanner supports Cloud External Key Manager (Cloud EKM), which lets you store your keys in an external key manager outside of Google Cloud.”
- Cloud HSM depends on Cloud Key Management Service From the official documentation: “Because Cloud HSM uses Cloud KMS as its front end, you can leverage all the conveniences and features that Cloud KMS provides.”
- Cloud HSM works with Cloud Key Management Service From the official documentation: “Creates a new key in Cloud KMS backed by Cloud HSM.”
- Cloud HSM works with Cloud KMS From the official documentation: “Creates a new key in Cloud KMS backed by Cloud HSM.”
- Cloud HSM works with Knowledge Catalog From the official documentation: “Knowledge Catalog supports Cloud KMS keys, Cloud HSM keys, and Cloud External Key Manager keys.”
- Cloud Key Management Service depends on Identity and Access Management From the official documentation: “Whatever the mechanism, Cloud KMS resolves the provided credential to identify the principal (the entity which is authenticated and is authorizing the request), and calls IAM to see whether the principal is authorized to make the request and whether an audit log is written.”
- Cloud Key Management Service works with Identity and Access Management From the official documentation: “The Cloud KMS platform is integrated with [IAM](/iam/docs/overview) and [Cloud Audit Logs](/logging/docs/audit) so that you can manage permissions on individual keys and audit how they are used.”
How learners score on this topic
Last updated