Create protected resources using Cloud KMS Autokey

This page shows you how to create protected resources using keys created by Cloud KMS Autokey for encryption. For more information about Autokey, see Autokey overview.

Before you begin

Before you can create protected resources using Autokey, you must complete the following steps to prepare:

  1. If you don't already have a project where Autokey is enabled, then you must first complete the setup steps in Enable Cloud KMS Autokey, and then return to this document.
  2. You need permissions to create resources in the chosen project. To find the specific roles required for each resource, see the service-specific documentation. You can find this documentation by locating the service in the CMEK integrations table and visiting the link for the type of resource that you want to create. No additional permissions are required to use Autokey to request keys on demand.

Using Autokey with Compute Engine resources

Autokey creates a new key for each disk, image, and machine image in the same location as the resource that is being created.

Autokey doesn't create new keys for snapshots. Snapshots should use the same key used to encrypt the disk. If you create a snapshot using the Google Cloud console, the encryption key used by the disk is automatically applied to the snapshot. If you create a snapshot using the gcloud CLI, Terraform, or the Compute Engine API, you must identify the key used to encrypt the disk and use that key to encrypt the snapshot.

For more information about using CMEK with snapshots, see Create a snapshot from a disk encrypted with CMEK.

Create a protected Compute Engine resource

Console

To create a disk, complete the following steps:

  1. In the Google Cloud console, go to the Disks page.

    Go to Disks

  2. Click Create disk and enter the properties for the new disk.

  3. Under Encryption, select Cloud KMS key.

  4. For Key type, select Cloud KMS with Autokey, and then click Request a new key. A message indicates when your key has been successfully created and is ready for use.

  5. To finish creating the disk, click Create.

You can follow a similar process to create protected VM instance, image, and machine image resources.

Terraform

The following Terraform sample creates a key handle and uses the returned key to protect a new persistent disk resource:

resource "google_kms_key_handle" "my_key_handle" {
  provider               = google-beta
  project                = "RESOURCE_PROJECT_ID"
  name                   = "KEY_HANDLE"
  location               = "LOCATION"
  resource_type_selector