Ensuring data protection · Topic 3 of 5
Cloud KMS, CMEK, Cloud HSM and Cloud EKM
Choose Google default encryption, CMEK, Cloud HSM or Cloud EKM, and create, rotate, disable, destroy and import Cloud KMS keys with separation of duties.
- 6 min
- Includes a diagram
- Default encryption is always on; CMEK, HSM and EKM change who controls the key.
- CSEK works only for Cloud Storage and Compute Engine.
- The service agent needs Encrypter/Decrypter on the key, and the key location must match the data.
What it is
All data stored in Google Cloud is encrypted at rest by default. The security decision is who controls the key and where it lives: Google, you in Cloud KMS (customer-managed encryption keys, CMEK), you in a hardware module (Cloud HSM), or you in a key manager outside Google (Cloud External Key Manager, Cloud EKM).
How it works
Envelope encryption
Services encrypt data with data encryption keys (DEKs), and those DEKs are wrapped by a key encryption key (KEK). With CMEK, the KEK is your Cloud KMS key. Disable it, and the service can no longer unwrap DEKs, so the data becomes unreadable.
Choosing the key option
| Option | Key material | Choose it when |
|---|---|---|
| Google default encryption | Google-managed, AES-256 | No requirement about key control |
| CMEK, software key | Cloud KMS, protection level SOFTWARE | You must own rotation, disable or revoke access, and audit key use |
| CMEK, Cloud HSM key | Cloud KMS keys with protection level HSM, in FIPS 140-2 Level 3 validated HSMs | Regulations require hardware-protected keys |
| Cloud EKM | A supported external key manager, reached over the internet or a VPC | Keys must stay outside Google, under your or a partner's control |
| CSEK | You send the key with each request; Google does not store it | Cloud Storage and Compute Engine only, when you must supply raw keys |
"Hardware" in the requirement means Cloud HSM. "Keys must never be stored in Google Cloud" means Cloud EKM. "Control rotation and revocation" alone means CMEK with a software key.
With Cloud EKM, Google never has your key material. If the external manager is unavailable, the data cannot be decrypted. Key Access Justifications shows the reason for each request to the external key, and your policy can refuse it.
Cloud KMS resources
| Resource | Notes |
|---|---|
| Key ring | Groups keys in one location; cannot be deleted |
| Key | Has a purpose (symmetric encryption, asymmetric signing or decryption, MAC), a protection level and a rotation period; can be deleted only in limited cases, and its name cannot be reused |
| Key version | The actual key material; enabled, disabled, scheduled for destruction or destroyed |
The key's location must match the data's location rules: a regional bucket in europe-west1 needs a key ring in europe-west1, and a bucket in a multi-region or dual-region needs a key ring with the matching location code.
gcloud kms keyrings create data-ring --location=europe-west1
gcloud kms keys create bq-key --keyring=data-ring --location=europe-west1 \
--purpose=encryption --protection-level=hsm \
--rotation-period=90d --next-rotation-time=2026-12-01T00:00:00ZUsing CMEK with a service
Each service accesses the key as its service agent, which needs Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the key. Then set the key on the resource, such as a bucket's default key, a BigQuery dataset's default key or a disk.
Cloud KMS Autokey can create key rings and keys on demand when resources are created, so teams get CMEK without managing keys by hand. Organization policies enforce the rules:
| Constraint | Effect |
|---|---|
gcp.restrictNonCmekServices | Listed services must use CMEK for new resources |
gcp.restrictCmekCryptoKeyProjects | CMEK keys must come from approved key projects |
Rotation, revocation and import
| Task | Behaviour |
|---|---|
| Automatic rotation | For symmetric keys: a new primary version on a schedule; old versions still decrypt old data |
| Manual rotation | Create a new version and make it primary; re-encrypt data yourself if required |
| Disable a version | Reversible; data encrypted with it cannot be decrypted until re-enabled |
| Destroy a version | Scheduled first (30 days by default), then permanent; data under it is lost |
| Import | Create an import job, wrap your key material with its public key, and import it as a new version |
Rotation does not re-encrypt existing data. Asymmetric keys do not rotate automatically.
Separation of duties
Keep keys in a dedicated key project managed by the security team. Grant Cloud KMS Admin to key administrators, who cannot use keys, and Encrypter/Decrypter only to service agents and workloads, which cannot manage keys.
A worked example
A payments company must use hardware-protected keys for BigQuery and Cloud Storage, rotate them yearly, and be able to cut off access quickly. The engineer creates HSM keys in a key project per region with a 365-day rotation period.
The service agents for BigQuery and Cloud Storage get Encrypter/Decrypter on their keys only, and gcp.restrictNonCmekServices forces CMEK on both services. In an incident, disabling the key versions blocks reads once the change propagates, while keeping the option to re-enable them.
How the exam asks about this
- "The company must be able to make its BigQuery data unreadable at any moment by revoking a key it controls." CMEK in Cloud KMS; disable or destroy the key version.
- "Encryption keys must be stored and managed outside Google Cloud." Cloud EKM.
- "Encryption keys must be generated in hardware and never leave a validated HSM." Cloud HSM keys used as CMEK.
What to remember for the exam
- Default encryption is always on; CMEK, HSM and EKM change who controls the key.
- CSEK works only for Cloud Storage and Compute Engine.
- The service agent needs Encrypter/Decrypter on the key, and the key location must match the data.
- Rotation creates new versions but does not re-encrypt old data; disable is reversible, destroy is not.
- Separate key admins from key users, and keep keys in a dedicated project.
Destroying a key version permanently loses all data encrypted only with it once the scheduled period ends. Disable first when you need to cut off access but may need the data again.
Common mistakes
Choosing CSEK for BigQuery. BigQuery supports CMEK, not customer-supplied keys.
Expecting rotation to re-encrypt everything. Old data stays under old versions, which must remain enabled to read it.
Giving the security team Encrypter/Decrypter as well as Admin. One person can then both manage and use keys. Split the roles.
Check yourself
What happens to data when its CMEK key version is disabled?
The service can no longer decrypt it, so reads fail until the version is re-enabled.
Which identity must be granted Encrypter/Decrypter for CMEK on a Cloud Storage bucket?
The Cloud Storage service agent for the project that owns the bucket.
When should you choose Cloud EKM over Cloud HSM?
When keys must be held outside Google Cloud in an external key manager you or a partner control.
Topic 3 of 5 in Ensuring data protection
Test yourself on Ensuring data protection
The full Google Cloud Professional Cloud Security Engineer question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.