A payments pipeline must encrypt a customer dataset in Cloud Storage with keys the company controls, and it needs key rotation and an audit trail of key usage. Which service should hold the keys?
Show answer and explanation
Answer: A
Cloud KMS stores and manages cryptographic keys, supports scheduled rotation, and records key usage in audit logs. Cloud Storage and BigQuery can use customer-managed encryption keys from Cloud KMS, which gives the company control over the key lifecycle. Keys embedded in images, emailed to people, or committed to source files are exposed and cannot be rotated or audited centrally.
Why the other options are wrong
- B. Keys baked into a container image spread to anyone who can pull it and cannot be rotated without rebuilding. It is an exposure, not a control.
- C. Emailing keys creates uncontrolled copies in mailboxes and makes rotation and access auditing impossible. It defeats the purpose of managed encryption keys.
- D. Committed variables files leak keys through repository history and every clone. Source control is not a secrets store, so this fails basic key management.