Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by orhan

To ensure least-privilege access and provide necessary permissions to the DevOps team only during a deployment issue, follow these steps:

Create a Service Account:

In your Google Cloud project, create a new service account specifically for the DevOps team.

Assign Limited Permissions:

Grant the service account permissions with only the necessary list/view roles. For instance, you can create a custom IAM role with compute.instances.list and compute.instances.get permissions.

Grant Service Account User Role:

Assign the Service Account User role to the DevOps team members for the created service account. This allows them to act as the service account and use its permissions.

Access Control During Incidents:

During a deployment issue, the DevOps team can temporarily use the service account to access the resources. This ensures they have the least-privilege access required to investigate and resolve the issue.

Automation and Monitoring:

Implement automation to enable and disable the service account access as needed and monitor the usage to ensure compliance with the least-privilege principle.

Benefits:

Security: Limits access to only what is necessary, reducing the risk of unauthorized changes.

Flexibility: Provides necessary access during incidents without granting permanent elevated permissions.

References

Creating and Managing Service Accounts

Service Account User Role

When you use a customer-managed encryption key (CMEK) to secure a Cloud Storage bucket, the key and the bucket must be located in the same region. In this case, the key is in europe-west3 and the bucket is in europe-west1, which is why you’re unable to access the key.

This approach allows you to control network traffic at the folder level. By attaching external IP addresses to the VMs in scope, you can ensure that the VMs have a unique, routable IP address for outbound connections. Then, by defining and applying a hierarchical firewall policy at the folder level, you can enforce that egress connections are limited to the specified IP range and only from the specified VPC network.

Comprehensive and Detailed Explanation From Exact Extract:

The requirement to ensure the master encryption key material never leaves the on-premises hardware (HSM) and retaining the unilateral ability to revoke access are the defining features of Cloud External Key Manager (Cloud EKM).

Key Residency: Cloud EKM allows you to use encryption keys stored and managed in a supported external key management system, such as an on-premises HSM, for encrypting data in Google Cloud services like BigQuery and Cloud Storage. This ensures the key material remains in your accredited hardware.

Unilateral Control: Since Google Cloud must request the key from the external system for every encryption/decryption operation, revoking access (by disabling the key or revoking Google's access) in the external system immediately renders the data in Google Cloud inaccessible, granting the customer unilateral control.

Extracts:

"Cloud External Key Manager (Cloud EKM) is a cloud service that lets you encrypt data in Google Cloud with keys you manage outside of Google Cloud." (Source 6.1)

"The key material is stored on an external system, such as a Cloud EKM partner or an on-premises HSM, and never leaves that system." (Source 6.1)

"The customer can unilaterally revoke access to the key at the EKM system, making the encrypted data in Google Cloud inaccessible, which is a key requirement for highly regulated industries." (Source 6.2)