Question

A healthcare analytics company stores regulated patient data in BigQuery and Cloud Storage. Their security team is concerned that a compromised service account or a misconfigured IAM binding could allow an insider to copy data to an external Google Cloud project outside the organization. They want a control that prevents data from being moved beyond a defined boundary, even if IAM permissions are inadvertently granted. Which approach best addresses this requirement?

Accepted Answer

Configure a VPC Service Controls perimeter around the BigQuery and Cloud Storage projects to block data movement to resources outside the perimeter

Answer

Apply organization policy constraints to restrict which regions resources can be created in

Answer

Enable Customer-Managed Encryption Keys (CMEK) on all datasets and buckets to control data access

Answer

Grant only the roles/bigquery.dataViewer role to all service accounts to limit their permissions