When you enable Cloud Key Management Service (Cloud KMS) with Cloud External Key Manager (Cloud EKM), you can use keys that you manage with an external key management partner to help protect data in Google Cloud. This document describes architectures for Google Cloud customers who want to deploy a highly available external key manager (EKM) service with Cloud KMS and Cloud EKM.
Using Cloud EKM with your EKM service involves an explicit risk tradeoff between cloud workload reliability and data protection controls. Encrypting data-at-rest in the cloud with off-cloud encryption keys adds new failure risks that might result in Google Cloud services data becoming inaccessible. To address these risks, you must incorporate high availability and fault tolerance into the Cloud EKM architecture.
Overview
Cloud EKM lets you use key material
that remains outside of Google Cloud to control access to your data that
is stored in supported Google Cloud
services. Cloud EKM
keys are customer-managed encryption keys (CMEKs).
Cloud EKM lets you create and manage Cloud KMS key resources
using the EXTERNAL and EXTERNAL_VPC protection levels. When you enable
Cloud EKM, every cryptographic operation request results in a
cryptographic operation on the external key. The success of the initial request
operation critically depends on the result of the cryptographic operation on the
external key.