Question

A retail company stores customer PII in a Cloud Storage bucket within a project named 'data-prod'. Their security policy requires that all objects be encrypted with a Cloud KMS key managed in a separate, dedicated project named 'kms-central' to enforce separation of duties. When engineers upload objects to the bucket, encryption fails with a permission error. What must be configured so that objects are automatically encrypted using the CMEK from the other project?

Accepted Answer

Grant the Cloud Storage service agent of the 'data-prod' project the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the KMS key in 'kms-central', and set the key as the bucket's default encryption key.

Answer

Grant the user accounts uploading objects the roles/cloudkms.admin role in 'kms-central' and re-run the uploads.

Answer

Enable customer-supplied encryption keys (CSEK) on the bucket and pass the KMS key material with each upload request.

Answer

Copy the KMS key into the 'data-prod' project and configure it as the bucket default encryption key, since CMEK keys cannot be used across projects.