Question

A financial services company uses Cloud KMS to protect customer records. The security team requires that the engineers who manage the lifecycle of encryption keys (creating, rotating, and disabling keys) must NOT be able to use those keys to decrypt any data, enforcing separation of duties. The application service account only needs to perform cryptographic operations. How should you configure IAM to meet this requirement?

Accepted Answer

Grant the key administrators roles/cloudkms.admin on the key ring and grant the application service account roles/cloudkms.cryptoKeyEncrypterDecrypter on the keys.

Answer

Grant both the key administrators and the application service account roles/cloudkms.admin, and rely on audit logs to detect misuse of decryption.

Answer

Grant the key administrators roles/owner on the project and grant the application service account roles/cloudkms.cryptoKeyEncrypterDecrypter on the keys.

Answer

Grant the key administrators roles/cloudkms.cryptoKeyEncrypterDecrypter and grant the application service account roles/cloudkms.admin to allow it to manage its own keys.