Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK), but has recently updated the internal policy to require Customer Managed Encryption Keys…

Question

Options

• AReupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.
• BEncrypt the files locally, and then use gsutil to upload the files to a new bucket.
• CCopy the files to a new bucket with CMEK enabled in a secondary region.
• DChange the encryption type on the bucket to CMEK, and rewrite the objects.

• A
  11% (2)
• B
  6% (1)
• C
  6% (1)
• D
  78% (14)

Explanation

The most efficient and cost-effective approach is to update the bucket's default encryption key to CMEK and then use the Cloud Storage rewrite operation (gsutil rewrite -k or the JSON API's rewrite method) to re-encrypt all existing objects in place. This rewrites objects server-side without downloading or uploading data, minimizing egress costs and time. Option A (reupload via gsutil) requires downloading and re-uploading, incurring egress costs. Option B (encrypt locally) requires downloading all data and adds operational complexity. Option C (copy to a new bucket in a secondary region) introduces unnecessary replication costs and regional complexity.

No community discussion yet for this question.