Your enterprise DevOps team is architecting a continuous integration and continuous deployment (CI/CD) pipeline on Google Cloud. The architecture spans a dedicated security project for key management (proj-kms-sec) and a pipeline project (proj-cicd-prod). The pipeline requires Customer-Managed Encryption Keys (CMEK) to protect the following components: Deployment credentials stored in Google Cloud Secret Manager with a user-managed replication policy targeting us-central1 and us-east1 Build artifacts stored in a regional Cloud Storage bucket in us-central1 Container images stored in an Artifact Registry repository located in us-central1 How should you configure the Cloud KMS keys and IAM permissions to support envelope encryption across these CI/CD pipeline resources?

Create regional symmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the us-central1 key to the Cloud Storage and Artifact Registry service agents, and grant the role on both regional keys to the Secret Manager service identity.: What Customer-Managed Encryption Keys (CMEK) and Service Agent Roles Are Customer-Managed Encryption Keys (CMEK) allow organizations to use Cloud Key Management Service (Cloud KMS) to control the Key Encryption Keys (KEKs) that protect data at rest. Under Google Cloud's envelope encryption model, services generate a local, unique Data Encryption Key (DEK) to encrypt the actual resource payload (such as a secret version, storage object, or container layer), and the DEK is subsequently encrypted using the KEK residing in Cloud KMS. How it Meets the Architecture Requirements Regional Key Alignment: Cloud KMS keys must match the exact geographical locations of the encrypted resources. Creating regional keys in us-central1 and us-east1 satisfies the location constraints for all target services. Secret Manager User-Managed Replication: When Secret Manager is configured with user-managed replication across us-central1 and us-east1, separate CMEK keys matching each replica region must be provisioned. The Secret Manager service identity (service-@gcp-sa-secretmanager.iam.gserviceaccount.com) must have roles/cloudkms.cryptoKeyEncrypterDecrypter on both regional keys to encrypt and decrypt the DEKs for secret versions in those regions. Cloud Storage & Artifact Registry Integration: The Cloud Storage service agent (service-@gs-project-accounts.iam.gserviceaccount.com) and the Artifact Registry service agent (service-@gcp-sa-artifactregistry.iam.gserviceaccount.com) must be granted roles/cloudkms.cryptoKeyEncrypterDecrypter on the us-central1 KMS key. Key Advantages Strict Separation of Duties: Storing cryptographic keys in a separate project (proj-kms-sec) isolates key lifecycle management from application workloads. Least Privilege Access: Direct build runners and end users do not require decryption permissions on the KMS keys; only Google-managed service identities perform envelope encryption/decryption operations on their behalf. Granular Auditability: All cryptographic wrap and unwrap operations generate Cloud Audit Logs in the KMS project.

StudyCerts

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cmek Envelope Encryption Secret Manager Cicd

Section: Key management (e.g., Cloud Key Management Service)

Your enterprise DevOps team is architecting a continuous integration and continuous deployment (CI/CD) pipeline on Google Cloud. The architecture spans a dedicated security project for key management (proj-kms-sec) and a pipeline project (proj-cicd-prod).

The pipeline requires Customer-Managed Encryption Keys (CMEK) to protect the following components:

Deployment credentials stored in Google Cloud Secret Manager with a user-managed replication policy targeting us-central1 and us-east1
Build artifacts stored in a regional Cloud Storage bucket in us-central1
Container images stored in an Artifact Registry repository located in us-central1

How should you configure the Cloud KMS keys and IAM permissions to support envelope encryption across these CI/CD pipeline resources?

Create regional asymmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.signerVerifier role to the Secret Manager, Cloud Storage, and Artifact Registry service agents.

Create regional symmetric KMS keys in us-central1 and us-east1 within proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the us-central1 key to the Cloud Storage and Artifact Registry service agents, and grant the role on both regional keys to the Secret Manager service identity.

Create regional symmetric KMS keys in us-central1 and us-east1 within proj-cicd-prod. Grant the roles/cloudkms.admin role on the key rings to the CI/CD pipeline service account.

Create a single global symmetric KMS key in proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on this global key to the Cloud Build service account used by the CI/CD pipeline.

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cmek Envelope Encryption Secret Manager Cicd

Section: Key management (e.g., Cloud Key Management Service)

The pipeline requires Customer-Managed Encryption Keys (CMEK) to protect the following components:

Deployment credentials stored in Google Cloud Secret Manager with a user-managed replication policy targeting us-central1 and us-east1
Build artifacts stored in a regional Cloud Storage bucket in us-central1
Container images stored in an Artifact Registry repository located in us-central1

How should you configure the Cloud KMS keys and IAM permissions to support envelope encryption across these CI/CD pipeline resources?

Create regional symmetric KMS keys in us-central1 and us-east1 within proj-cicd-prod. Grant the roles/cloudkms.admin role on the key rings to the CI/CD pipeline service account.

Create a single global symmetric KMS key in proj-kms-sec. Grant the roles/cloudkms.cryptoKeyEncrypterDecrypter role on this global key to the Cloud Build service account used by the CI/CD pipeline.

Explanations

What Customer-Managed Encryption Keys (CMEK) and Service Agent Roles Are

Customer-Managed Encryption Keys (CMEK) allow organizations to use Cloud Key Management Service (Cloud KMS) to control the Key Encryption Keys (KEKs) that protect data at rest. Under Google Cloud's envelope encryption model, services generate a local, unique Data Encryption Key (DEK) to encrypt the actual resource payload (such as a secret version, storage object, or container layer), and the DEK is subsequently encrypted using the KEK residing in Cloud KMS.

How it Meets the Architecture Requirements

Regional Key Alignment: Cloud KMS keys must match the exact geographical locations of the encrypted resources. Creating regional keys in us-central1 and us-east1 satisfies the location constraints for all target services.
Secret Manager User-Managed Replication: When Secret Manager is configured with user-managed replication across us-central1 and us-east1, separate CMEK keys matching each replica region must be provisioned. The Secret Manager service identity (service-@gcp-sa-secretmanager.iam.gserviceaccount.com) must have roles/cloudkms.cryptoKeyEncrypterDecrypter on both regional keys to encrypt and decrypt the DEKs for secret versions in those regions.
Cloud Storage & Artifact Registry Integration: The Cloud Storage service agent (service-@gs-project-accounts.iam.gserviceaccount.com) and the Artifact Registry service agent (service-@gcp-sa-artifactregistry.iam.gserviceaccount.com) must be granted roles/cloudkms.cryptoKeyEncrypterDecrypter on the us-central1 KMS key.

Key Advantages

Strict Separation of Duties: Storing cryptographic keys in a separate project (proj-kms-sec) isolates key lifecycle management from application workloads.
Least Privilege Access: Direct build runners and end users do not require decryption permissions on the KMS keys; only Google-managed service identities perform envelope encryption/decryption operations on their behalf.
Granular Auditability: All cryptographic wrap and unwrap operations generate Cloud Audit Logs in the KMS project.

View source documentation

Professional Cloud DevOps Engineer

Cmek Envelope Encryption Secret Manager Cicd

Professional Cloud DevOps Engineer

Cmek Envelope Encryption Secret Manager Cicd

What Customer-Managed Encryption Keys (CMEK) and Service Agent Roles Are

How it Meets the Architecture Requirements

Key Advantages

Related questions