4.2.3. Cost Estimation, Database Center, and CMEK
💡 First Principle: Managing data solutions responsibly means being able to answer "what will this cost" before committing to a configuration, "is our database fleet healthy" without checking each instance individually, and "who controls our encryption keys" as a matter of compliance — three separate operational concerns that Google Cloud addresses with three separate tools.
Estimating costs of data storage resources typically uses the Google Cloud Pricing Calculator or the billing reports' forecasting views, letting teams model expected spend before provisioning at scale. Database Center provides a centralized, fleet-wide view across all of an organization's managed database instances — surfacing health, security, and configuration issues across many instances at once rather than requiring a database-by-database check. Customer-managed encryption keys (CMEK) let you supply and control the encryption key used to protect data at rest in a given service, with the ability to rotate or revoke that key on your own schedule, rather than relying solely on Google's default encryption key management.
⚠️ Exam Trap: Customer-managed encryption keys (CMEK) remove Google's operational access to the data entirely — that's an easy but incorrect inference from the name. CMEK gives the customer control over the key's lifecycle (rotation and revocation), which governs key management, not a wholesale removal of the managed service's operational role in running the underlying service.
Reflection Question: A compliance requirement states that the company must be able to permanently and immediately deny all future access to a dataset by revoking a key it controls. Which feature satisfies that specific requirement, and what exactly does it give the customer control over?
