What's changed: Created Professional Cloud Architect Chapter 5 (Domain 3 "Security and compliance": IAM/least privilege/governance = avoid basic roles/predefined-custom/groups, service accounts/Workload Identity Federation, organization policies/guardrails; data protection and compliance = GMEK/CMEK/CSEK/Cloud KMS/Cloud EKM, Sensitive Data Protection/Cloud DLP, data residency, Assured Workloads/Cloud Audit Logs/VPC Service Controls).
5.2Data protection and compliance
Understand encryption at rest/in transit and key management (GMEK/CMEK/CSEK/Cloud KMS), discovering and protecting sensitive data (Sensitive Data Protection / Cloud DLP), data residency and sovereignty, and regulatory compliance via Assured Workloads and audit logs.
After access control comes protecting the data itself and meeting regulations. Design encryption, key management, sensitive-data protection, and data residency to match requirements.
5.2.1Encryption and key management
| Key | Meaning |
|---|---|
| GMEK | Google-managed (default) keys |
| CMEK | Customer-managed keys via Cloud KMS |
| CSEK | Customer-supplied keys |
Google Cloud encrypts data at rest and in transit by default (default GMEK). To manage keys yourself with rotation/revocation control, choose CMEK (Cloud KMS); to supply the key itself, CSEK; to use an external key-management system, Cloud EKM. Choose by requirements (regulation, key sovereignty). Map "manage keys yourself = CMEK (Cloud KMS)," "external key mgmt = Cloud EKM," "no special need = GMEK."
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.