An organization's policy requires that it control the encryption keys used for a new Cloud Storage bucket rather than relying on Google-managed keys. The engineer has created a key in Cloud KMS in the same region as the bucket. What remaining step lets Cloud Storage use that key to encrypt new objects?
- AGrant the Cloud Storage service agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the key, then set the key as the bucket's default encryption key. Correct
- BGrant the engineer's own user account the Cloud KMS CryptoKey Encrypter/Decrypter role, then set the key as the bucket default.
- CDownload the key material from Cloud KMS and supply it with each upload as a customer-supplied encryption key.
- DEnable uniform bucket-level access, which routes object encryption through the Cloud KMS key automatically.
Why A is correct: The Cloud Storage service agent must hold Encrypter/Decrypter on the CMEK, after which setting the key as the bucket default causes new objects to be encrypted with it.
Why B is wrong: Cloud Storage encrypts objects using its own service agent, not the engineer's identity, so granting the role to a user does not let the service perform envelope encryption.
Why C is wrong: Cloud KMS keys cannot be exported, and supplying raw key bytes per request is the customer-supplied encryption model, which is a different feature from CMEK.
Why D is wrong: Uniform bucket-level access governs how access is authorised and has no role in selecting an encryption key, so it cannot bind the CMEK to the bucket.