Question

A financial services company must comply with a regulation requiring that the team managing encryption keys be different from the team that operates the applications consuming those keys. Application workloads run on Compute Engine and store data in Cloud Storage encrypted with Cloud KMS. Security auditors require proof that developers cannot administer or destroy keys, while applications can still perform encrypt/decrypt operations. Which IAM design best satisfies these separation-of-duties requirements?

Accepted Answer

Grant the security team the Cloud KMS Admin role on the key ring and grant the application service accounts the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific keys.

Answer

Grant both the security team and the application service accounts the Cloud KMS Admin role, and rely on audit logs to detect misuse after the fact.

Answer

Grant developers the Owner role on the project so they can manage keys and applications together, and enable Cloud Audit Logs for key operations.

Answer

Grant the application service accounts the Cloud KMS Admin role and grant the security team the Cloud KMS CryptoKey Encrypter/Decrypter role for oversight.