You are deploying an application that needs to access sensitive information. You need to ensure that this information is encrypted and the risk of exposure is minimal if a breach occurs. What should…

Cloud Key Management Service (KMS) is a highly secure and managed service for cryptographic keys. Storing encryption keys in KMS ensures they are protected by Google's infrastructure, are auditable, and allows for automatic or manual rotation. Regular key rotation limits the amount of data encrypted by a single key, reducing the impact if a key is ever compromised, thus minimizing the risk of exposure during a breach.

While injecting secrets at instance creation via an encrypted configuration management system is a valid pattern, KMS provides a dedicated, managed service for secure key storage and lifecycle management, including rotation, offering a higher level of security specifically for encryption keys.

Integrating with an SSO system manages user authentication and authorization but does not directly address the encryption of sensitive data accessed by the application itself or the secure storage of its encryption keys.

A continuous build pipeline producing 'multiple versions of the secret' is not a standard or secure practice for managing sensitive data and doesn't inherently ensure encryption or minimize exposure in the way a KMS does for encryption keys.