A financial enterprise is designing a secure storage and compute architecture on Google Cloud for sensitive workload data across Cloud Storage and Compute Engine persistent disks. The enterprise has established the following security and compliance requirements: The security team must maintain direct administrative authority over key lifecycle management, including rotation schedules, key disablement, and destruction. All cryptographic operations and key usage must be captured in centralized audit logs for compliance reviews. Cloud workloads and automated backend data pipelines must access encrypted storage and compute resources natively without requiring engineers or applications to pass raw cryptographic key material in every API request. Security administrators must be able to enforce organization policies to restrict which projects can host encryption keys. Which encryption strategy should the organization implement?

Customer-Managed Encryption Keys (CMEK) using Cloud Key Management Service (Cloud KMS): ### What Customer-Managed Encryption Keys (CMEK) Are **Customer-Managed Encryption Keys (CMEK)** allow organizations to protect data at rest in Google Cloud services while retaining full administrative control over the cryptographic keys. Through **Cloud Key Management Service (Cloud KMS)** or **Cloud HSM**, organizations create, manage, rotate, disable, and destroy the **Key Encryption Keys (KEKs)** that protect service-level data encryption keys (DEKs). ### How CMEK Meets the Scenario Requirements - **Administrative Control and Key Lifecycle**: Cloud KMS provides complete management over cryptographic keys, including automated rotation policies, key versioning, state modification (disabling or enabling keys), and scheduled key destruction. - **Centralized Audit Logging**: All administrative operations and cryptographic access requests (such as key wrap and unwrap operations) are automatically recorded in **Cloud Audit Logs**, providing clear visibility into who accessed which key and when. - **Native Service Integration**: CMEK integrates directly with Google Cloud services like **Cloud Storage** and **Compute Engine**. Services act on behalf of authorized principals using service identities, meaning automated backend pipelines do not need to transmit raw encryption key material with each API call. - **Organization Policy Enforcement**: Administrators can enforce constraints like `constraints/gcp.restrictCmekCryptoKeyProjects` to restrict which Google Cloud projects are permitted to supply CMEK keys across the organization. ### Key Advantages - **Seamless Workload Automation**: Integrates natively with managed cloud services without client-side cryptographic code or transmission of sensitive raw keys. - **Granular Access Control**: Fine-grained **IAM roles** (such as Cloud KMS CryptoKey Encrypter/Decrypter) decouple data storage administration from key administration. - **Hardware Backing Options**: Allows keys to be backed by software, multi-tenant Cloud HSM, or single-tenant Cloud HSM partitions (FIPS 140-2 Level 3). - **Instant Revocation**: Disabling a key version immediately halts access to the encrypted data across all associated storage buckets and compute disks. ### Why This Is Optimal CMEK strikes the optimal balance between granular administrative governance and seamless cloud native operational efficiency. Unlike default encryption, it provides user control over key lifecycles and compliance audits. Unlike CSEK or client-side encryption, it avoids the burden of managing and injecting raw key strings during service API interactions.