Question

A data engineering team at a healthcare analytics company must de-identify a customer email address column before loading data into BigQuery for analysts. Requirements: (1) the same email must always produce the same token so analysts can perform GROUP BY joins across tables, (2) the wrapped cryptographic key used for tokenization must never be embedded in the Sensitive Data Protection (DLP) template or stored in plaintext, and (3) the security team must be able to rotate the key material centrally. Which configuration satisfies all requirements?

Accepted Answer

Use a cryptoDeterministicConfig transformation with a KMS-wrapped crypto key (kmsWrapped), storing only the ciphertext key reference and the Cloud KMS resource name in the de-identify template.

Answer

Use a cryptoReplaceFfxFpeConfig transformation with an unwrapped transient crypto key generated per job so no key persists anywhere.

Answer

Use a cryptoDeterministicConfig transformation with an unwrapped raw key value placed directly in the de-identify template for reproducibility.

Answer

Use a replaceWithInfoTypeConfig transformation and rely on Cloud KMS to encrypt the resulting BigQuery table at rest.