Your organization handles sensitive customer data stored in Google Cloud Storage buckets. You need to secure these buckets to meet the following requirements:

Multiple teams require different levels of access (e.g., read-only, read-write).

Data must be protected both in transit and at rest.

It is critical to log and audit all file access and changes for compliance.

The organization must retain full control over the data encryption keys for compliance.

What should you do?

Exam-Like

Create IAM groups for each team and manage permissions at the group level. Employ server-side encryption and Object Versioning by Google Cloud Storage. Configure cloud monitoring tools to alert on anomalous data access patterns.

Set individual permissions for each team and apply access control lists (ACLs) to each bucket and file. Enforce TLS encryption for file transfers. Enable Object Versioning and Cloud Audit Logs for the storage buckets.

Use predefined IAM roles tailored to each team's access needs, such as Storage Object Viewer and Storage Object User. Utilize customer-supplied encryption keys (CSEK) and enforce TLS encryption. Turn on both Object Versioning and Cloud Audit Logs for the storage buckets.

Assign IAM permissions for all teams at the object level. Implement third-party software to encrypt data at rest. Track data access by using network logs.

Google Professional Cloud Security Engineer

Get started today

Comments