Professional Cloud Security EngineerEnsuring data protectionMedium
A global e-commerce company uses Cloud SQL for PostgreSQL to store customer order data. They need to ensure that all data in the database is encrypted at rest and that the encryption keys are stored in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Cloud SQL encryption option should they choose?
- ACustomer-supplied encryption keys (CSEK)
- BDatabase-level encryption with a third-party key manager
- CGoogle-managed encryption keys (GMEK)
- DCustomer-managed encryption keys (CMEK) with Cloud KMS
Show answer & explanationAnswer & explanation
Correct answer: D. Customer-managed encryption keys (CMEK) with Cloud KMS
Cloud SQL supports Customer-managed encryption keys (CMEK) via Cloud Key Management Service (KMS). Cloud KMS offers various key types, including those backed by Cloud HSM, which is FIPS 140-2 Level 3 validated. This allows the company to meet their specific compliance requirement for key storage.
Why the other options are wrong
- A. CSEK requires the customer to provide and manage the encryption keys themselves, which is not integrated with Cloud HSM for key storage in the same way as CMEK.
- B. While possible, Cloud SQL's native CMEK integration with Cloud KMS and Cloud HSM is the most straightforward and supported method to achieve this without complex third-party integrations.
- C. GMEK uses Google's keys, which are not directly managed by the customer and don't allow specifying FIPS 140-2 Level 3 HSMs for key storage.
Cloud SQL CMEK with Cloud HSM
Using Customer-managed encryption keys (CMEK) for Cloud SQL, where the keys themselves are protected by Google Cloud's FIPS 140-2 Level 3 validated Hardware Security Module (HSM) via Cloud KMS.
- Provides enhanced control over encryption keys.
- Meets strict compliance requirements like FIPS 140-2 Level 3.
- Keys are stored and operations performed within an HSM.
Memory trick: SQL's data is safe, with CMEK and HSM's FIPS-grade embrace.