PCSE Ensuring data protection — All Questions With Answers

Refer to the exhibit.

```
gcloud kms encrypt \
  --location=global \
  --keyring=my-keyring \
  --key=my-key \
  --plaintext-file=secret.txt \
  --ciphertext-file=secret.enc
```

Refer to the exhibit.

```
{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:alice@example.com",
        "user:bob@example.com"
      ]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": [
        "user:alice@example.com"
      ]
    }
  ]
}
```

Resource: bucket 'my-data-bucket'
  IAM policy:
  - role: roles/storage.objectViewer
    members:
    - user:alice@example.com
    - domain:example.com
  - role: roles/storage.legacyBucketReader
    members:
    - allUsers
  Uniform bucket-level access: disabled
  ACLs:
  - entity: allUsers
    role: READER

IAM policy for project my-project:

bindings:
- members:
  - user:alice@example.com
  - serviceAccount:sa-1@my-project.iam.gserviceaccount.com
  role: roles/storage.objectViewer
  condition:
    expression: resource.name.startsWith("projects/_/buckets/bucket1/objects/reports/")
- members:
  - user:bob@example.com
  role: roles/storage.objectAdmin
- members:
  - user:bob@example.com
  role: roles/compute.admin
- members:
  - serviceAccount:sa-1@my-project.iam.gserviceaccount.com
  role: roles/iam.workloadIdentityUser
- members:
  - serviceAccount:my-project@appspot.gserviceaccount.com
  role: roles/storage.objectAdmin

gsutil iam get gs://my-bucket
Output:
{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:alice@example.com",
        "domain:example.com"
      ]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": [
        "serviceAccount:sa@project.iam.gserviceaccount.com"
      ]
    }
  ],
  "etag": "B=XYZ"
}

{
  "bindings": [
    {
      "role": "roles/bigquery.dataViewer",
      "members": [
        "user:analyst@example.com"
      ]
    },
    {
      "role": "roles/bigquery.dataOwner",
      "members": [
        "group:data-team@example.com"
      ]
    }
  ],
  "etag": "ABC"
}

{
  "bindings": [
    {
      "role": "roles/cloudkms.cryptoKeyEncrypter",
      "members": [
        "serviceAccount:my-sa@project.iam.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/cloudkms.cryptoKeyDecrypter",
      "members": [
        "user:alice@example.com"
      ]
    }
  ]
}

gsutil ls -L gs://my-secure-bucket | grep -E 'Kind|Encryption|Versioning'
{
  "kind": "storage#bucket",
  "encryption": {
    "defaultKmsKeyName": "projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/my-key"
  },
  "versioning": {
    "enabled": true
  }
}

$ gcloud storage buckets describe gs://my-bucket --format="json" | jq .encryption
{
  "defaultKmsKeyName": "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key"
}

{
  "name": "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",
  "primary": {
    "name": "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key/cryptoKeyVersions/2",
    "state": "ENABLED",
    "algorithm": "GOOGLE_SYMMETRIC_ENCRYPTION",
    "protectionLevel": "HSM",
    "attestation": {
      "certChains": [...]
    }
  },
  "versionTemplate": {
    "protectionLevel": "HSM",
    "algorithm": "GOOGLE_SYMMETRIC_ENCRYPTION"
  }
}

{
  "protoPayload": {
    "methodName": "CloudKms.Decrypt",
    "resourceName": "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key/cryptoKeyVersions/3",
    "authenticationInfo": {
      "principalEmail": "service-account@project.iam.gserviceaccount.com"
    },
    "metadata": {
      "key": {
        "key_kms_keypath": "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key"
      },
      "decrypt_result": {
        "success": true
      }
    }
  },
  "resource": {
    "type": "audited_resource",
    "labels": {
      "service": "cloudkms.googleapis.com",
      "method": "Decrypt"
    }
  }
}

Refer to the exhibit.

{
  "bindings": [
    {
      "role": "roles/storage.objectAdmin",
      "members": ["user:alice@example.com"],
      "condition": {
        "title": "restrict_to_uploads",
        "expression": "resource.name.startsWith('projects/_/buckets/my-bucket/objects/uploads/')"
      }
    }
  ]
}