A financial enterprise is deploying sensitive workloads to Google Cloud and must satisfy strict data sovereignty and jurisdictional isolation regulations. The enterprise security policy requires that the root-of-trust encryption keys reside exclusively within on-premises Hardware Security Modules (HSMs) outside Google Cloud. Furthermore, all cryptographic communication between Google Cloud services and the on-premises key management systems must traverse private network paths without traversing the public internet, while supporting automated failover between dual on-premises data centers. Which Cloud External Key Manager (Cloud EKM) architecture should the organization implement?

Configure Cloud EKM over a VPC network using an internal passthrough Network Load Balancer and regional Cloud KMS key rings.: What Cloud EKM over a VPC Network Is Cloud External Key Manager (Cloud EKM) over a VPC network enables Google Cloud services to protect data at rest using encryption keys maintained directly inside a customer's external, on-premises key management infrastructure. Instead of sending requests across the public internet, cryptographic requests travel over private hybrid connectivity such as Cloud Interconnect or HA VPN. How It Meets the Requirements External Root-of-Trust Custody: The master encryption keys remain entirely within the organization's on-premises HSMs, satisfying stringent data sovereignty and jurisdictional regulatory mandates. Private Network Communication: Utilizing an internal passthrough Network Load Balancer allows Cloud EKM to route cryptographic operations through private RFC 1918 VPC address space without ever exposing traffic to the public internet. Automated Failover: The internal passthrough Network Load Balancer health-checks backend data center endpoints and automatically routes requests to a secondary on-premises facility if the primary site experiences an outage. Regional Cloud KMS Alignment: Cloud EKM accessed via VPC networking requires a regional location in Cloud KMS, aligning directly with localized data residency and jurisdictional isolation requirements. Key Advantages and Capabilities Granular Network Isolation: Cryptographic payloads are isolated from public routing, enhancing transport layer security. Seamless CMEK Integration: Integrates natively with customer-managed encryption key (CMEK) workflows across BigQuery, Compute Engine, and Cloud Storage. High Resiliency: Combines health checking with automated failover across redundant on-premises data centers. Auditing and Governance: Enables integration with Key Access Justifications (KAJ) to validate justifications prior to external decryption. Why This Is Optimal This architecture satisfies both sovereign key custody outside Google Cloud and strict network perimeter requirements by pairing private hybrid connectivity with an internal load balancer in a regional configuration.