Professional Cloud Security EngineerEnsuring data protectionMedium
A company is migrating an on-premises application that uses a custom key management system (KMS) to Google Cloud. They have a strong policy that all encryption keys for data in Cloud Storage and Cloud SQL must remain under the exclusive control of their on-premises KMS and never be exposed to Google Cloud directly. The application needs to continue using these existing keys for encryption and decryption operations. Which Google Cloud service allows this integration?
- ACloud HSM
- BCloud Key Management Service (KMS)
- CCloud External Key Manager (EKM)
- DCustomer-Supplied Encryption Keys (CSEK)
Show answer & explanationAnswer & explanation
Correct answer: C. Cloud External Key Manager (EKM)
Cloud External Key Manager (EKM) allows Google Cloud services to encrypt and decrypt data using encryption keys that are stored and managed entirely within an external, customer-controlled key management system. This ensures the keys remain under exclusive customer control and are never exposed to Google Cloud, meeting the strict policy requirement.
Why the other options are wrong
- A. Cloud HSM is a service within Cloud KMS that uses FIPS-certified hardware modules managed by Google, not the customer's on-premises KMS.
- B. Cloud KMS stores keys within Google Cloud's infrastructure, which violates the 'never exposed to Google Cloud directly' policy.
- D. CSEK requires the customer to provide the key material to Google Cloud for each operation, which exposes the key to Google Cloud and doesn't integrate with an on-premises KMS.
Cloud External Key Manager (EKM)
A Google Cloud service that enables customers to use encryption keys stored in an external, third-party key management system for cryptographic operations within Google Cloud, without the keys ever leaving the external system.
- Provides full key sovereignty to the customer.
- Integrates with supported external KMS providers.
- Keys remain outside Google's direct control.
Memory trick: EKM lets your keys stay home, while Cloud uses them remotely.