Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud service
Cloud Key Management Service
Topic in 14 exam domains
Also called: Cloud Key Management Service (KMS) API, Cloud Key Management Service API, Cloud Key Management Service integration, Cloud KMS, Cloud KMS API, cloudkms.googleapis.com, gcloud kms, Key Management service, KMS, Storky
A Google Cloud service used to manage encryption keys and perform cryptographic operations.
Where this appears on the exam
10 objectives in 4 of 5 domains
~22% of exam
~25% of exam
Domain 3
Storing the data~20% of exam
~18% of exam
Related topics
FoundationsThis topicWorks alongsideBuilds on theseAppliedApplication Default CredentialsFeatureIdentity and Access ManagementServiceKey Access JustificationsFeatureKnowledge CatalogServiceCloud RunService
Cloud Key Management ServiceService
Cloud KMSServiceCloud SQLServiceCloud LoggingServiceCloud Audit LogsServiceCloud EKMServiceBigQueryServicecustomer-managed encryption keysFeatureCloud HSMServiceCloud External Key ManagerServiceCloud KMS AutokeyFeatureEventarcServiceSpannerServiceCloud StorageServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- customer-managed encryption keys depends on Cloud Key Management Service From the official documentation: “These keys are created and managed using Cloud KMS.”
- Cloud Key Management Service works with customer-managed encryption keys From the official documentation: “With CMEK, Cloud Key Management Service wraps your stored volume keys.”
- Application Default Credentials works with Cloud Key Management Service From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- BigQuery works with Cloud Key Management Service From the official documentation: “Change the Cloud KMS key for a BigQuery table”
- Cloud Audit Logs works with Cloud Key Management Service From the official documentation: “Cloud Audit Logs for Cloud KMS in the Activity stream read like generic logs, and are not easily read by a human.”
- Cloud EKM works with Cloud Key Management Service From the official documentation: “You can use an [externally managed key](/kms/docs/ekm) with CMEK using the Cloud EKM service to make the key available through Cloud KMS.”
- Cloud HSM is part of Cloud Key Management Service From the official documentation: “You can import into Multi-tenant Cloud HSM keys, Single-tenant Cloud HSM keys, or software keys in Cloud KMS.”
- Cloud Key Management Service works with Cloud SQL From the official documentation: “Cloud KMS integrates with Cloud SQL.”
- customer-managed encryption keys is part of Cloud Key Management Service From the official documentation: “The Cloud KMS keys that you create are customer-managed keys.”
- Cloud Key Management Service depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Key Management Service secures BigQuery From the official documentation: “You can encrypt data at the dataset or project level with the default customer-managed Cloud Key Management Service keys in BigQuery.”
- Cloud Key Management Service is an alternative to customer-managed encryption keys From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud Key Management Service works with Eventarc From the official documentation: “The following table describes different CMEK issues and how to resolve them when using Cloud KMS with Eventarc.”
- Cloud KMS Autokey is part of Cloud Key Management Service From the official documentation: “Autokey simplifies creating and managing Cloud KMS keys by automating provisioning and assignment.”
- Key Access Justifications configures Cloud Key Management Service From the official documentation: “[Key Access Justifications](/assured-workloads/key-access-justifications/docs/overview) lets you set a policy on Cloud KMS keys to view, approve, and deny key access requests depending on the provided justification code.”
- Cloud External Key Manager is part of Cloud Key Management Service From the official documentation: “In addition to these features, the Assured Workloads control package you choose will also determine which of the following Cloud KMS key types are available: - [Cloud EKM keys](/kms/docs/ekm#overview)”
- Cloud External Key Manager works with Cloud Key Management Service From the official documentation: “You can use an externally managed key with CMEK using the Cloud External Key Manager service to [make the key available](/kms/docs/ekm) through Cloud KMS.”
- Cloud External Key Manager is an alternative to Cloud Key Management Service From the official documentation: “Unless your control package mandates a certain encryption key strategy, you can use any Google key management service, including Cloud Key Management Service, Cloud External Key Manager, or CMEK.”
- Cloud HSM depends on Cloud Key Management Service From the official documentation: “Because Cloud HSM uses Cloud KMS as its front end, you can leverage all the conveniences and features that Cloud KMS provides.”
- Cloud HSM works with Cloud Key Management Service From the official documentation: “Creates a new key in Cloud KMS backed by Cloud HSM.”
- Cloud Key Management Service works with Cloud KMS Autokey From the official documentation: “Create an encryption management strategy using Cloud Key Management Service (Cloud KMS) with Autokey, Cloud External Key Manager (Cloud EKM), or both.”
- Cloud Key Management Service works with Cloud Logging From the official documentation: “If you [enable audit logging for Cloud KMS](https://cloud.google.com/logging/docs/audit/configure-data-access#config-console-enable), all the operations on the key are logged and viewable in Cloud Logging.”
- Cloud Key Management Service depends on Identity and Access Management From the official documentation: “Whatever the mechanism, Cloud KMS resolves the provided credential to identify the principal (the entity which is authenticated and is authorizing the request), and calls IAM to see whether the principal is authorized to make the request and whether an audit log is written.”
- Cloud Key Management Service works with Identity and Access Management From the official documentation: “The Cloud KMS platform is integrated with [IAM](/iam/docs/overview) and [Cloud Audit Logs](/logging/docs/audit) so that you can manage permissions on individual keys and audit how they are used.”
- Cloud Key Management Service works with Key Access Justifications From the official documentation: “[Key Access Justifications](https://cloud.google.com/blog/products/identity-security/control-access-to-gcp-data-with-key-access-justifications) integrate with Cloud KMS and Cloud EKM.”
- Cloud Key Management Service depends on Spanner From the official documentation: “Cloud KMS stores all of its data and metadata in Spanner databases which provide high data durability and availability with synchronous replication.”
- Cloud Key Management Service works with Spanner From the official documentation: “After the database is created, Spanner calls Cloud KMS about every five minutes to make sure that the key is still valid.”
- Cloud Key Management Service secures Spanner From the official documentation: “For Spanner databases in [custom, dual-region, or multi-region instance configurations](/spanner/docs/instance-configurations#configuration), you can use multiple regional (single-region) Cloud KMS keys to protect your database.”
- Eventarc depends on Cloud Key Management Service From the official documentation: “When Eventarc cannot access Cloud KMS keys, event publishing with channels fails with `FAILED_PRECONDITION` errors and event delivery stops.”
- Identity and Access Management secures Cloud Key Management Service From the official documentation: “If you need to prevent a user from using a Cloud KMS resource during the time needed for propagation of an eventually consistent operation, remove the Identity and Access Management (IAM) permission for the resource.”
- Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- BigQuery works with Cloud SQL From the official documentation: “Add credentials to connect BigQuery to Cloud SQL.”
- Cloud Run works with Cloud SQL From the official documentation: “Learn how to connect to Cloud SQL from Cloud Run”
- Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials secures Spanner From the official documentation: “To authenticate to Spanner, set up Application Default Credentials.”
- Knowledge Catalog depends on Application Default Credentials From the official documentation: “To authenticate to Knowledge Catalog, set up Application Default Credentials.”
- Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials works with Spanner From the official documentation: “To authenticate to Spanner, set up Application Default Credentials.”
- BigQuery works with Knowledge Catalog From the official documentation: “Some Knowledge Catalog functionalities trigger job execution using BigQuery.”
- Cloud Logging works with customer-managed encryption keys From the official documentation: “To use Cloud Logging with Customer-managed encryption keys (CMEK), you must complete the steps in the [Enable CMEK for an organization](/logging/docs/routing/managed-encryption#enable) page in the Cloud Logging documentation.”
- Cloud SQL works with Cloud Storage From the official documentation: “When ingesting data from Cloud SQL, data is first staged to a Cloud Storage bucket.”
- customer-managed encryption keys depends on Cloud KMS From the official documentation: “You must have a symmetric encryption key in Cloud KMS to use for CMEK.”
- Spanner depends on Application Default Credentials From the official documentation: “To authenticate to Spanner, set up Application Default Credentials.”
- Cloud Run works with Eventarc From the official documentation: “Route Eventarc events to Cloud Run”
- Application Default Credentials works with Cloud KMS From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- Cloud Run works with Cloud Storage From the official documentation: “Route Cloud Storage events to Cloud Run”
- Cloud KMS depends on Application Default Credentials From the official documentation: “To authenticate to Cloud KMS, set up Application Default Credentials.”
- BigQuery works with Spanner From the official documentation: “Reverse ETL (BigQuery to Spanner)”
- Cloud SQL works with Identity and Access Management From the official documentation: “This page describes how Cloud SQL is integrated with IAM .”
- Cloud SQL works with Knowledge Catalog From the official documentation: “You can use Knowledge Catalog to organize and enrich the metadata of Cloud SQL resources.”
- customer-managed encryption keys secures Cloud Storage From the official documentation: “CMEKs encrypt data at rest in Cloud SQL, Cloud Storage, and within GKE clusters.”
- Cloud External Key Manager works with Key Access Justifications From the official documentation: “If you [use a Cloud EKM key](/alloydb/docs/cmek#ekm), then you can use Key Access Justifications to view the reason for each Cloud EKM request.”
- Cloud Logging works with Cloud SQL From the official documentation: “Cloud SQL uses Cloud Logging.”
- Cloud Run depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
How learners score on this topic
Last updated