Encrypt data with customer-managed encryption keys

By default, Secure Source Manager encrypts customer content at rest. Secure Source Manager handles encryption for you without any additional actions on your part. This option is called Google default encryption.

If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in Cloud KMS with CMEK-integrated services including Secure Source Manager. Using Cloud KMS keys gives you control over their protection level, location, rotation schedule, usage and access permissions, and cryptographic boundaries. Using Cloud KMS also lets you track key usage, view audit logs, and control key lifecycles. Instead of Google owning and managing the symmetric key encryption keys (KEKs) that protect your data, you control and manage these keys in Cloud KMS.

After you set up your resources with CMEKs, the experience of accessing your Secure Source Manager resources is similar to using Google default encryption. For more information about your encryption options, see Customer-managed encryption keys (CMEK).

Cloud KMS can run in a separate project where you centrally manage keys for multiple projects, or the same Google Cloud project as Secure Source Manager. To support separation of duties and greater control over access to keys, we recommend that you create and manage keys in a separate project that doesn't include other Google Cloud resources.

You assign a Cloud KMS key when you create an instance. You can't change the encryption mechanism of an existing instance. If you have a CMEK-encrypted instance, you can't change the encryption mechanism to Google default encryption or assign a different Cloud Key Management Service key for encryption.

The instance must be created in the same location as the Cloud KMS key.

CMEK with Cloud KMS Autokey

You can either create CMEKs manually to protect your Secure Source Manager resources or use Cloud KMS Autokey. With Autokey, key rings and keys are generated on demand to support resource creation in Secure Source Manager. Service agents that use the keys for encrypt and decrypt operations are created if they don't already exist and are granted the required Identity and Access Management (IAM) roles. For more information, see Autokey overview.

Cloud KMS quotas and Secure Source Manager

When you use CMEK in Secure Source Manager, your projects can consume Cloud KMS cryptographic requests quotas. CMEK-encrypted instances consume these quotas at creation time. Encryption and decryption operations using CMEK keys affect Cloud KMS quotas only if you use hardware (Cloud HSM) or external (Cloud EKM) keys. For more information, see Cloud KMS quotas.

Create a CMEK key and grant permissions

The following instructions explain how to create a key and grant the Secure Source Manager service account permissions on the key.

  1. Create a Cloud KMS key:

    Manually

    1. In the Google Cloud project where you want to manage your keys:

      1. Enable the Cloud KMS API.

      2. Create a key ring and a key using one of the following options:

      The Cloud KMS key location must match the location of the project where you want to create the Secure Source Manager instance.

    Using Autokey

    1. If you haven't already done so, enable Cloud KMS Autokey.

    2. Create a new Cloud KMS Autokey KeyHandle:

      curl -H "Content-Type: application/json" \
    -H "X-Goog-User-Project: PROJECT" \
    -H "Authorization: Bearer $(gcloud auth print-access-token)" \
    -X POST https://cloudkms.googleapis.com/v1/projects/PROJECT/locations/LOCATION/keyHandles \
    -d '{"resource_type_selector": "securesourcemanager.googleapis.com/Instance"}'

      Replace the following:

      • PROJECT: the project ID of the project where Cloud KMS Autokey is enabled and where you want to deploy a Secure Source Manager instance
      • LOCATION: the KeyHandle location. It must match the location where you want to deploy a Secure Source Manager instance

      The output is similar to the following:

      {
  "name": "projects/PROJECT/locations/LOCATION/operations/OPERATION",
  "metadata": {
    "@type": "type.googleapis.com/google.cloud.kms.v1.CreateKeyHandleMetadata"
  }
}

      Make note of the OPERATION from the output. You need this value to get the resource ID of the created key.

    3. Find the Cloud KMS key associated with the key handle:

      curl -H "X-Goog-User-Project: PROJECT" \
    -H "Authorization: Bearer $(gcloud auth print-access-token)" \
    -X GET https://cloudkms.googleapis.com/v1/projects/PROJECT/locations/LOCATION/operations/OPERATION

      Replace the following:

      • PROJECT: the project ID of the project where Cloud KMS Autokey is enabled and where you want to deploy a Secure Source Manager instance
      • LOCATION: the KeyHandle location. It must match the location where you want to deploy a Secure Source Manager instance
      • OPERATION: The identifier of the key handle request operation from the output of the previous step

      The output is similar to the following:

      {
  "name": "projects/PROJECT/locations/LOCATION/operations/OPERATION",
  "done": true,
  "response": {
    "@type": "type.googleapis.com/google.cloud.kms.v1.KeyHandle",
    "name": "projects/PROJECT/locations/LOCATION/keyHandles/KEY_HANDLE",
    "kmsKey": "projects/PROJECT/locations/LOCATION/keyRings/autokey/cryptoKeys/KEY_NAME"