Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Gauge your current knowledge
Gauge your current knowledge
Customer-Managed Encryption Keys (CMEK) give you control over your own encryption keys in Google Cloud, which is important for meeting security and compliance rules. You organize these keys into key rings, which are logical groups created in a specific region. Before a Google Cloud service like BigQuery or Cloud Storage can use your keys, you must grant the correct Cloud KMS CryptoKey Encrypter/Decrypter role to that service's service agent. This setup allows the service to encrypt and decrypt your data without giving human users direct access to the keys.
A key security practice is key rotation, which means creating a new primary version of a key. You can set up an automatic rotation schedule or rotate keys manually. When you rotate a key, Cloud KMS keeps the old versions so you can still decrypt your existing data, but only the newest version is used for encrypting new data. This limits the risk if a key version is ever compromised.
Keys exist in different states that you manage. A key can be enabled for normal use, disabled to immediately block access to the data it protects, or scheduled for destruction to be permanently deleted after a waiting period. To improve security, you should store your keys in a different Google Cloud project than the resources (like databases or storage buckets) they protect. This creates a separation of duties. You can also use Cloud Audit Logs to monitor key activity and use project liens to prevent accidental deletion of your key management project.
The principle of least privilege means you should give users and services only the exact permissions they need. For Cloud KMS, this means granting the CryptoKey Encrypter/Decrypter role at the level of a specific key or key ring, not for the entire project. This limits who can use which cryptographic resources.
A key part of this design is separation of duties. This security concept means the people who manage the keys (key administrators) should not be the same people who use the data. A practical way to enforce this is to put your keys in a separate Google Cloud project from your data resources. This way, a compromise in one area doesn't automatically grant access to the other.
When a service like Compute Engine needs to encrypt a disk, it uses a service agent. This is a Google-managed service account that you grant the encrypt/decrypt role to. The service agent acts on behalf of the service, so the human users or the application itself do not need direct key access. Key administrators have different jobs: they create keys, set rotation schedules, and monitor usage through audit logs.
If you need to stop access to data in an emergency, you have two main options. You can disable the key in Cloud KMS, which immediately blocks the service agent from using it. Alternatively, you can revoke the IAM role from the service agent. Both actions will make the encrypted data inaccessible, so they must be used carefully.
Using CMEK with services like Cloud Storage, BigQuery, and Compute Engine lets you control the encryption keys for your data at rest. The first step is to create a key ring in the same region as your resources. Then, you grant the CryptoKey Encrypter/Decrypter role to the service's service agent. This allows the service to protect your data using your key.
For Cloud Storage, CMEK encrypts the actual object data and its checksums, though some metadata remains unencrypted. In Compute Engine, CMEK is used to encrypt the persistent disks and snapshots for your virtual machines. BigQuery uses CMEK to protect the data stored in its tables. A critical rule is that the key and the resource it protects must be in the same geographic region.
The person or application requesting data does not need direct access to the CMEK; the service agent handles the cryptography. However, if a key administrator disables or destroys a key, the data encrypted with it becomes permanently unreachable. This creates a significant operational risk, so key lifecycle management must be done carefully.
You can enforce the use of CMEK across your entire organization using Organization Policy Constraints. These policies can require that certain resources, like Cloud Storage buckets, must use customer-managed keys. The policies can also control which specific keys are used, their protection levels (software vs. hardware), and their locations. You can track which resources are protected by which keys using key usage dashboards.
StudyCerts
StudyCerts