Key IAM permissions
When considering key permissions, think about the hierarchy in which the key exists. A key exists in a key ring, a project, a folder in another folder, or under “Cloud Organization”.
Recall that there are two fundamental security principles IAM enforces:
- Principle of separation of duties
- Principle of least privilege
A primary role a principal can play is the Cloud KMS CryptoKey Encrypter/Decrypter role at various levels of the hierarchy. There are several other roles Cloud KMS has based on how you structure it. Please refer to the Google Cloud KMS documentation for the list of other IAM roles: https://packt.link/RyY17.
We have looked at various IAM roles and permissions for Cloud KMS; let us now look at some best practices on how to manage access:
- Key management roles can be granted based on the culture and process of your enterprises. Traditionally, this role is played by the IT security team.
- For a large or complex...
