Your organization has sensitive data stored in BigQuery and Cloud Storage. You need to design a solution that provides granular and flexible control authorization to read data. What should you do?

De-identification with Sensitive Data Protection modifies the data itself to reduce sensitivity, rather than providing an authorization mechanism to control who can read the original sensitive data.

Cloud External Key Manager (Cloud EKM) manages encryption keys for data at rest, which protects data, but it is not the primary mechanism for granular authorization over who can access and read the data.

Google Cloud Identity and Access Management (IAM) is the foundational service for controlling who can do what on Google Cloud resources, allowing for granular and flexible authorization to read data in BigQuery and Cloud Storage by assigning specific roles and permissions to principals.

Enabling server-side encryption protects data at rest from unauthorized physical access but does not provide granular authorization controls over who can logically access and read the decrypted data.