A financial enterprise is deploying sensitive workloads to Google Cloud and must satisfy strict data sovereignty and jurisdictional isolation regulations. The enterprise security policy requires that the root-of-trust encryption keys reside exclusively within on-premises Hardware Security Modules (HSMs) outside Google Cloud. Furthermore, all cryptographic communication between Google Cloud services and the on-premises key management systems must traverse private network paths without traversing the public internet, while supporting automated failover between dual on-premises data centers. Which Cloud External Key Manager (Cloud EKM) architecture should the organization implement?

Configure Cloud EKM over a VPC network using an internal passthrough Network Load Balancer and regional Cloud KMS key rings.: ### What Cloud EKM over a VPC Network Is **Cloud External Key Manager (Cloud EKM)** over a **VPC network** enables Google Cloud services to protect data at rest using encryption keys maintained directly inside a customer's external, on-premises key management infrastructure. Instead of sending requests across the public internet, cryptographic requests travel over private hybrid connectivity such as **Cloud Interconnect** or **HA VPN**. ### How It Meets the Requirements - **External Root-of-Trust Custody:** The master encryption keys remain entirely within the organization's on-premises HSMs, satisfying stringent data sovereignty and jurisdictional regulatory mandates. - **Private Network Communication:** Utilizing an **internal passthrough Network Load Balancer** allows Cloud EKM to route cryptographic operations through private RFC 1918 VPC address space without ever exposing traffic to the public internet. - **Automated Failover:** The internal passthrough Network Load Balancer health-checks backend data center endpoints and automatically routes requests to a secondary on-premises facility if the primary site experiences an outage. - **Regional Cloud KMS Alignment:** Cloud EKM accessed via VPC networking requires a **regional location** in Cloud KMS, aligning directly with localized data residency and jurisdictional isolation requirements. ### Key Advantages and Capabilities - **Granular Network Isolation:** Cryptographic payloads are isolated from public routing, enhancing transport layer security. - **Seamless CMEK Integration:** Integrates natively with customer-managed encryption key (**CMEK**) workflows across BigQuery, Compute Engine, and Cloud Storage. - **High Resiliency:** Combines health checking with automated failover across redundant on-premises data centers. - **Auditing and Governance:** Enables integration with **Key Access Justifications (KAJ)** to validate justifications prior to external decryption. ### Why This Is Optimal This architecture satisfies both sovereign key custody outside Google Cloud and strict network perimeter requirements by pairing private hybrid connectivity with an internal load balancer in a regional configuration.