Explanation:
For CMEK on Cloud Storage, the Google-managed service agent (service-xxx@gs-project-accounts.iam.gserviceaccount.com) needs the cryptoKeyEncrypterDecrypter role on the KMS key. Not the user or disable.
Ultimate access to all questions.
After enabling CMEK on a bucket, uploads fail with a KMS permission error. Fix?
A
Disable CMEK
B
Grant the Cloud Storage service agent roles/cloudkms.cryptoKeyEncrypterDecrypter on the key
C
Grant the uploader user KMS Admin
D
Move the key to another region
No comments yet.