Enable Cloud KMS Autokey

This document shows you how to enable and configure Cloud KMS Autokey using the Google Cloud console, the Google Cloud CLI, the Cloud KMS API, or Terraform. You can enable Autokey with dedicated-project key storage for a folder, or you can enable Autokey with same-project key storage for an individual project or for all projects within a folder. For more information about Autokey, see Autokey overview.

This document is intended for administrators.

Autokey configuration inheritance

When you configure Autokey on a folder, child folders and projects within that folder inherit the Autokey configuration of their parent folder. When you configure Autokey on a child folder or project, you decide whether to inherit the configuration from the parent resource or to create a new Autokey configuration for that resource. Autokey configurations applied on child resources override the configuration of the parent folder.

The following table shows supported Autokey configuration use cases:

Resource type Autokey configuration Description
Organization Not applicable Autokey can't be enabled for organizations. Child resources within an organization inherit an empty AutokeyConfig resource. In the Google Cloud console, these resources show an Autokey Status of Not enabled. If you want to restrict Autokey usage within your organization or disable it entirely, you can use organization policies. For more information, see Control Autokey usage.
Folder DEDICATED_KEY_PROJECT Autokey with dedicated-project key storage is enabled for resource projects within the folder. For resource projects that inherit this configuration, Autokey creates keys in the dedicated key project.
Folder RESOURCE_PROJECT Autokey with same-project key storage is enabled for resource projects within the folder. For resource projects that inherit this configuration, Autokey creates keys in the same project as the resources that they protect.
Folder DISABLED Autokey is disabled within the folder, however, child folders and projects can still override this configuration. If you want to restrict Autokey within your folder or disable it entirely, you can use organization policies. For more information, see Control Autokey usage.
Folder KEY_PROJECT_RESOLUTION_MODE_UNSPECIFIED The folder inherits the Autokey configuration from its parent folder or organization.
Project RESOURCE_PROJECT Autokey with same-project key storage is enabled for the resource project. For resources created in this project, Autokey creates keys in the same project.
Project DISABLED Autokey is disabled for the resource project. Developers who create resources in this project must manually create and provision keys if they want to use CMEK for the resources that they create.
Project KEY_PROJECT_RESOLUTION_MODE_UNSPECIFIED The project inherits the Autokey configuration from its parent folder.

Before you begin

Before you can enable Autokey with dedicated-project key storage for a folder, you must have the following:

  • An organization resource that contains a folder where you want to enable Autokey. If you don't have a folder where you want to enable Autokey, you can create a new resource folder. Enabling Autokey on this folder enables Autokey for all resource projects within the folder.

  • If you have resource projects where you want to use Autokey with dedicated-project key storage, but they aren't inside a folder where you will enable Autokey, you can move existing resource projects into new folders.

Before you can enable Autokey with same-project key storage, you must have one of the following:

  • A Google Cloud project where you want to enable Autokey and where the keyHandles.create permission is not blocked by an IAM deny policy.
  • A Google Cloud folder where you want to enable Autokey, which contains at least one project where the keyHandles.create permission is not blocked by an IAM deny policy.

Required roles

To get the permissions that you need to enable and configure Autokey, ask your administrator to grant you the following IAM roles on the folder, project, or a parent resource:

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to enable and configure Autokey. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to enable and configure Autokey: