An enterprise is designing a secure data ingestion and analytics pipeline on Google Cloud that must adhere to strict regulatory compliance and data sovereignty constraints: Ingestion Staging (Cloud Storage): Compliance mandates that raw file uploads use encryption where cryptographic key material is held exclusively by the customer, supplied in-memory on each API request, and never stored persistently anywhere on Google Cloud servers. Analytics Warehouse (BigQuery): The data warehouse must use dedicated symmetric keys managed within Google Cloud with customer control over rotation schedules, audit logging of key access, and the capability to perform crypto-shredding on demand. Data Sovereignty Constraint (Regulatory HYOK): Master key material for specific regulatory analytics tables must physically reside within an external on-premises key manager outside of Google Cloud, while still integrating with Google Cloud services for server-side decryption. Which combination of encryption mechanisms should the enterprise implement?

Use Customer-Supplied Encryption Keys (CSEK) for Cloud Storage, Customer-Managed Encryption Keys (CMEK) via Cloud KMS for BigQuery, and CMEK with Cloud External Key Manager (Cloud EKM) for the regulatory BigQuery datasets.: What This Architecture Is This architecture combines Customer-Supplied Encryption Keys (CSEK), Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and Cloud External Key Manager (Cloud EKM) to satisfy multi-tiered security, control, and data sovereignty requirements across distinct pipeline stages. How It Meets Every Requirement Cloud Storage Staging (CSEK): CSEK allows clients to supply their own 256-bit AES cryptographic keys in the headers of individual API requests. Google uses the key transiently in-memory to encrypt or decrypt data and never persistently stores the key material on disk or within Cloud KMS. BigQuery Analytics Warehouse (CMEK with Cloud KMS): CMEK leverages Cloud KMS (software or Cloud HSM) where the customer controls the Key Encryption Key (KEK) lifecycle, configures automated rotation periods, audits access using Cloud Audit Logs, and can instantly revoke or destroy key versions to achieve cryptographic erasure (crypto-shredding). Regulatory HYOK Requirement (Cloud EKM): CMEK with Cloud EKM satisfies "Hold Your Own Key" (HYOK) requirements by maintaining master key material inside a third-party, on-premises external key management system while allowing integrated Google Cloud services to wrap and unwrap data encryption keys over a secure connection. Key Advantages and Capabilities Strict Data Sovereignty: Maintains root keys outside Google Cloud infrastructure via Cloud EKM without losing integration with native managed data services. Ephemeral Key Handling: Guarantees through CSEK that Cloud Storage never retains customer key material at rest. Granular Lifecycle Control: Enables centralized key management, key rotation tracking, and instant crypto-shredding across BigQuery datasets. Separation of Duties: Keeps cryptographic management isolated from data access personas. Why This Is Optimal This configuration aligns precisely with the native capabilities and constraints of each Google Cloud service, correctly applying CSEK where supported and required (Cloud Storage) while using CMEK and Cloud EKM to govern BigQuery analytics workloads.

Csek Cmek Cloud Ekm Pipeline Encryption | Professional Cloud Data Engineer

StudyCerts

Explanations

What This Architecture Is

This architecture combines Customer-Supplied Encryption Keys (CSEK), Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and Cloud External Key Manager (Cloud EKM) to satisfy multi-tiered security, control, and data sovereignty requirements across distinct pipeline stages.

How It Meets Every Requirement

Cloud Storage Staging (CSEK): CSEK allows clients to supply their own 256-bit AES cryptographic keys in the headers of individual API requests. Google uses the key transiently in-memory to encrypt or decrypt data and never persistently stores the key material on disk or within Cloud KMS.
BigQuery Analytics Warehouse (CMEK with Cloud KMS): CMEK leverages Cloud KMS (software or Cloud HSM) where the customer controls the Key Encryption Key (KEK) lifecycle, configures automated rotation periods, audits access using Cloud Audit Logs, and can instantly revoke or destroy key versions to achieve cryptographic erasure (crypto-shredding).
Regulatory HYOK Requirement (Cloud EKM): CMEK with Cloud EKM satisfies "Hold Your Own Key" (HYOK) requirements by maintaining master key material inside a third-party, on-premises external key management system while allowing integrated Google Cloud services to wrap and unwrap data encryption keys over a secure connection.

Key Advantages and Capabilities

Strict Data Sovereignty: Maintains root keys outside Google Cloud infrastructure via Cloud EKM without losing integration with native managed data services.
Ephemeral Key Handling: Guarantees through CSEK that Cloud Storage never retains customer key material at rest.
Granular Lifecycle Control: Enables centralized key management, key rotation tracking, and instant crypto-shredding across BigQuery datasets.
Separation of Duties: Keeps cryptographic management isolated from data access personas.

Why This Is Optimal

This configuration aligns precisely with the native capabilities and constraints of each Google Cloud service, correctly applying CSEK where supported and required (Cloud Storage) while using CMEK and Cloud EKM to govern BigQuery analytics workloads.

View source documentation

Professional Cloud Data Engineer

Csek Cmek Cloud Ekm Pipeline Encryption