Professional Cloud ArchitectDesign and plan a cloud solution architectureMedium
A multinational corporation is migrating its sensitive human resources (HR) application to Google Cloud. The application stores highly confidential employee data in Cloud Storage. The company has strict compliance requirements that mandate they maintain full control over the encryption keys used for this data. Which encryption option should they choose for their Cloud Storage buckets?
- AGoogle-managed encryption keys (GMEK)
- BClient-side encryption
- CCustomer-managed encryption keys (CMEK)
- DCustomer-supplied encryption keys (CSEK)
Show answer & explanationAnswer & explanation
Correct answer: C. Customer-managed encryption keys (CMEK)
Customer-managed encryption keys (CMEK) allow the customer to generate, store, and manage their encryption keys in Cloud KMS, giving them full control over the key's lifecycle and access policies. This directly addresses the requirement for maintaining full control over encryption keys for compliance.
Why the other options are wrong
- A. Google-managed encryption keys (GMEK) are default and fully managed by Google, which does not meet the requirement for the customer to 'maintain full control'.
- B. Client-side encryption involves encrypting data before it leaves the client, outside of Google Cloud, which is an option but doesn't leverage Google's managed key management service for control and auditing.
- D. Customer-supplied encryption keys (CSEK) require the customer to provide the encryption key with each request, which adds operational complexity and isn't typically the preferred method for 'maintaining full control' over key management in a cloud native way (CMEK using KMS is).
Customer-Managed Encryption Keys (CMEK)
An encryption option in Google Cloud where customers manage their encryption keys using Cloud Key Management Service (KMS), providing full control over key lifecycle and access policies.
- Keys stored and managed in Cloud KMS
- Customer controls key lifecycle and permissions
- Used for various Google Cloud services (Cloud Storage, BigQuery, etc.)
- Meets strict compliance requirements for key control
Memory trick: CMEK: Control My Encryption Keys for Compliance.