Question

A financial services company is migrating a customer-records application to Google Cloud. Their regulator requires that the company retain sole control over the encryption keys protecting customer data at rest, including the ability to revoke Google's access to decrypt the data at any time, while still using Google-managed storage services. The security team also wants to avoid operating and patching their own on-premises key infrastructure. Which encryption key management approach best satisfies these requirements?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS, and use IAM and key state controls to manage and revoke access.

Answer

Rely on Google's default encryption at rest, which automatically encrypts all data with Google-managed keys.

Answer

Store the encryption keys in a self-hosted HashiCorp Vault cluster running on Compute Engine VMs and reference them from storage services.

Answer

Use customer-supplied encryption keys (CSEK) generated and stored on the company's on-premises hardware security modules for all services.