This document provides an overview of using Cloud Key Management Service (Cloud KMS) for customer-managed encryption keys (CMEK). Using Cloud KMS CMEK gives you ownership and control of the keys that protect your data at rest in Google Cloud.
Comparison of CMEK and Google-owned and Google-managed encryption keys
The Cloud KMS keys that you create are customer-managed keys. Google Cloud services that use your keys are said to have a CMEK integration. You can manage these CMEKs directly, or through Cloud KMS Autokey. The following factors differentiate Google Cloud's default encryption at rest from customer-managed keys:
| Type of key | Cloud KMS Autokey | Cloud KMS customer-managed (manual) | Google-owned and Google-managed encryption key (Google default encryption) |
|---|---|---|---|
Can view key metadata |
Yes |
Yes |
No |
Ownership of keys1 |
Customer |
Customer |
|
Key creation and assignment is automated. Customer manual control is fully supported. |
Customer, manual control only |
||
Supports regulatory requirements for customer-managed keys |
Yes |
Yes |
No |
Key sharing |
Unique to a customer |
Unique to a customer |
Data from multiple customers is typically protected by shared key encryption keys (KEKs). |
Control of key rotation |
Yes |
Yes |
|
Yes |
Yes |
No | |
Yes |
Yes |
No |
|
Logical data separation through encryption |
Yes |
Yes |
|
Pricing |
Varies |