Onboard to Cloud HSM for Google Workspace

This page describes how to onboard Cloud HSM for Google Workspace (CHGWS), the encryption key service for Google Workspace offered by Cloud Key Management Service (Cloud KMS). Cloud HSM for Google Workspace provides enhanced privacy controls for Google Workspace, helping you achieve regulatory standards such as DISA IL5 and elevate data security. Cloud HSM is a standards-aligned, highly available, and fully managed key management service operated at cloud scale with hardware-backed keys stored in FIPS 140-2 Level 3 compliant HSMs (hardware security modules).

CHGWS is compatible with both Multi-tenant Cloud HSM and Single-tenant Cloud HSM keys.

For more information, see Cloud HSM for Google Workspace.

Before you begin

Before you onboard Cloud HSM for Google Workspace, complete the following prerequisites:

  • Set up a Google Workspace.
  • Enable Google Workspace Client-side Encryption (CSE) in your Google Workspace.
  • Configure your Identity Provider (IdP) in Google Workspace CSE. Note the Client ID for your IdP. If you use Google Identity Platform, find the Client ID in your Google Cloud project.
  • Optional: If you allow access to CSE-encrypted content on platform applications other than web (such as mobile or desktop), add the client IDs for those platforms in your IdP settings in the Google Workspace Admin Console. Note all client IDs for this IdP. If you use Google Identity Platform, find these client IDs in your Google Cloud project. For other Identity Providers, create these client IDs separately.

Compatible locations

You can store your Cloud KMS keys in any regional or multi-regional location within the US or Europe geographic areas. Cloud HSM for Google Workspace supports both Multi-tenant Cloud HSM and Single-tenant Cloud HSM keys. To find a specific location, visit Cloud KMS Locations and filter by your HSM type.

Cloud HSM for Google Workspace automatically provides the endpoint in one of the following multi-regions closest to your key location:

  • us
  • eur3

Set up a Google Cloud project for Cloud KMS

Cloud HSM for Google Workspace endpoints rely on Cloud KMS keys for cryptographic operations. Set up a new Google Cloud project to host the Cloud KMS keys.

  1. Create a Google Cloud project. This is your key project. Make note of the project ID and project number; you need these to complete the setup.

  2. Enable billing on the project that you created.

  3. Enable the Cloud KMS API in your Google Cloud key project.

    Enable the API

  4. In the Google Cloud console, click terminal Activate Cloud Shell.

  5. Verify that you are in the correct project by comparing your project ID with the project ID in the Cloud Shell prompt.

  6. Using Cloud Shell, create the Cloud HSM for Google Workspace service account:

    gcloud beta services identity create \
    --service=cloudkmskacls-pa.googleapis.com

    Note the service identity created by this command. You need the service identity name in the next step.

  7. Grant the CHGWS key Service Agent role to the service account that you created:

    gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=serviceAccount:service-PROJECT_NUMBER@gcp-sa-cloudkmskacls.iam.gserviceaccount.com \
    --role=roles/cloudkmskacls.serviceAgent

    Replace the following:

    • PROJECT_ID: The project ID of your key project.
    • PROJECT_NUMBER: The project number of your key project.

Manage CHGWS service endpoint

The following sections show you how to set up and manage your CHGWS endpoints.

Set up Cloud KMS keys

Set up the Cloud KMS resources for your CHGWS key service endpoint.

  1. Create a key ring in one of the supported regions:

    gcloud kms keyrings create KEY_RING --location LOCATION
    • Replace KEY_RING with the name that you want to use for your CHGWS key ring—for example, CHGWS_KEY_RING.
    • Replace LOCATION with the location where you want to create your key ring—for example, us.

  2. Create a Cloud HSM key.

    Multi-tenant Cloud HSM

    To create a key with the hsm protection level:

    gcloud kms keys create KEY_NAME \
    --protection-level "hsm" \
    --keyring KEY_RING \
    --location LOCATION \
    --purpose "encryption" \
    --rotation-period ROTATION_PERIOD \
    --next-rotation-time NEXT_ROTATION_TIME

    Replace the following:

    • KEY_NAME: The name that you want to use for your key—for example, CHGWS_KEY.
    • KEY_RING: The name of your key ring—for example, CHGWS_KEY_RING.
    • LOCATION: The location where you created your key ring—for example, us.
    • ROTATION_PERIOD: The frequency at which you want to rotate your keys—for example, 7d.
    • NEXT_ROTATION_TIME: The date and time when the next key rotation occurs—for example, 2024-03-20T01:00:00.

    Single-tenant Cloud HSM

    To create a key with the hsm_single_tenant protection level, you must first have a Single-tenant Cloud HSM instance provisioned in the same location.

    1. Create and provision a Single-tenant Cloud HSM instance: Follow the instructions in the Create and manage a Single-tenant Cloud HSM instance guide. Make note of the provisioned Instance ID. You use it in the next step.

    2. Create a key:

      gcloud kms keys create KEY_NAME \
    --protection-level "hsm_single_tenant" \
    --keyring KEY_RING \
    --location LOCATION \
    --purpose "encryption" \
    --crypto-key-backend "projects/PROJECT_ID/locations/LOCATION/singleTenantHsmInstances/INSTANCE_NAME" \
    --rotation-period ROTATION_PERIOD \
    --next-rotation-time NEXT_ROTATION_TIME

      Replace the following:

      • KEY_NAME: The name that you want to use for your key—for example, CHGWS_KEY.
      • KEY_RING: The name of your key ring—for example, CHGWS_KEY_RING.
      • LOCATION: The location where you created your key ring—for example, us.
      • PROJECT_ID: The project ID of your key project.
      • INSTANCE_NAME: The name of the Single-tenant Cloud HSM instance where you want to create the key.
      • ROTATION_PERIOD: The frequency at which you want to rotate your keys—for example, 7d.
      • NEXT_ROTATION_TIME: The date and time when the next key rotation occurs—for example, 2024-03-20T01:00:00.

    For more details on key creation options, see Creating keys.

Request onboarding and endpoint creation

To request onboarding and endpoint creation, contact your account representative for assistance with submitting an endpoint onboarding request. In the request, include the following information: