Question

A financial services company uses Customer-Managed Encryption Keys (CMEK) via Cloud KMS to encrypt data in BigQuery and Cloud Storage. A new compliance policy requires that encryption keys be rotated automatically every 90 days, and that the security team retains sole authority to disable or destroy keys while data engineers continue to run pipelines without interruption. What is the most appropriate way to meet these requirements?

Accepted Answer

Configure automatic rotation on the KMS key with a 90-day rotation period, grant the data engineering service accounts the roles/cloudkms.cryptoKeyEncrypterDecrypter role, and reserve roles/cloudkms.admin for the security team.

Answer

Disable automatic rotation and have data engineers manually create a new key version every 90 days, granting them roles/cloudkms.admin so they can manage the key lifecycle themselves.

Answer

Switch from CMEK to Google-managed encryption keys, since Google automatically rotates keys and no manual key administration is required.

Answer

Grant the data engineering service accounts roles/owner on the KMS project so pipelines never fail, and ask the security team to audit key usage after the fact.