How should you configure a Cloud SQL for PostgreSQL instance in us-central1 to use a customer-managed encryption key from a Cloud KMS key ring in us-central1 with key rotation every 30 days?

Question

Options

• AEnable CMEK on the Cloud SQL instance without attaching a key
• BCreate a Cloud KMS key ring and key in us-central1 then enable CMEK on the Cloud SQL
• CUse Google managed encryption
• DCreate the KMS key ring and key in us-east1 and select it for the instance

• A
  12% (3)
• B
  81% (21)
• C
  4% (1)
• D
  4% (1)

Explanation

Cloud SQL CMEK requires that the Cloud KMS key ring and key reside in the same region as the Cloud SQL instance. You create the key ring and key in us-central1, configure automatic rotation to 30 days on the key, grant the Cloud SQL service account the Cloud KMS CryptoKey Encrypter/Decrypter role, and then enable CMEK on the instance pointing to that key. Option A is invalid-you must attach a specific key to enable CMEK. Option C uses Google-managed keys, which gives no customer control. Option D places the key in us-east1, a different region, which Cloud SQL does not permit for CMEK.

No community discussion yet for this question.