Use customer-managed encryption keys

By default, Cloud Tasks encrypts customer content at rest. Cloud Tasks handles encryption for you without any additional actions on your part. This option is called Google default encryption.

If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in Cloud KMS with CMEK-integrated services including Cloud Tasks. Using Cloud KMS keys gives you control over their protection level, location, rotation schedule, usage and access permissions, and cryptographic boundaries. Using Cloud KMS also lets you view audit logs and control key lifecycles. Instead of Google owning and managing the symmetric key encryption keys (KEKs) that protect your data, you control and manage these keys in Cloud KMS.

After you set up your resources with CMEKs, the experience of accessing your Cloud Tasks resources is similar to using Google default encryption. For more information about your encryption options, see Customer-managed encryption keys (CMEK).

What is protected with CMEK

When you enable CMEK in Cloud Tasks, you enable it for a region. When enabled, the body and header of tasks created in that region are protected with your key when at rest. If a task was created while CMEK was enabled, and the key is later made inactive (by disabling or deleting the key, or by disabling CMEK) the task is encrypted with your key but cannot be executed.

Tasks are not protected with CMEK in the following cases:

  • Task was created before enabling CMEK
  • Task is not in the region for which CMEK is enabled
  • Task is affected by a compatibility limitation

Compatibility limitations

The Cloud Tasks integration with CMEK does not support the following:

  • google-gax versions below 4.0.0: The NPM package google-gax for Node.js has limited support at versions earlier than 4.0.0. For these versions, CMEK is only supported in the region us-central1. Even if you only have tasks in that region, it is recommended that you upgrade to version 4.0.0 or later.

  • App Engine built-in Taskqueue service: Tasks created using the App Engine built-in Taskqueue service are not protected by CMEK, even if they are in a region for which it is enabled. Enabling CMEK does not prevent the creation or operation (for example, execution or deletion) of these tasks.

  • Pull queues: If you enable CMEK, you can create and execute tasks on pull queues, but these tasks are not protected by CMEK. Pull queues are uncommon. To check if your queue is a pull queue, run the following gcloud CLI command in your terminal:

    gcloud tasks queues describe QUEUE_NAME

    Replace QUEUE_NAME with the name of your queue.

    If the type listed is pull, your queue is a pull queue. If the type listed is push, this limitation does not affect tasks on your queue.

  • Queue-level routing: When CMEK is enabled, you cannot apply queue-level routing. And if queue-level routing is enabled, you cannot enable CMEK. To check if you have queue-level routing enabled, do the following:

    1. Run the following gcloud CLI command in your terminal: 

      gcloud tasks queues describe QUEUE_NAME
       Replace QUEUE_NAME with the name of your queue.

    2. In the output, look for the field httpTarget and check if the uriOverride has been set. If a host is specified, your queue has queue-level routing enabled and is not compatible with CMEK. To remove queue-level routing, see Update or remove queue-level routing. If the output does not show uriOverride with a host specified, your queue does not use queue-level routing.

  • Task TTL: When CMEK is enabled, you cannot set task_ttl to greater than 60 days. And if you have a task_ttl set to greater than 60 days, you cannot enable CMEK.

Before you begin

Before using CMEK in Cloud Tasks, complete the following steps:

  1. Enable the APIs.

    Console

    1. Enable the Cloud KMS and Cloud Tasks APIs.

      Roles required to enable APIs

      To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

      Enable the APIs

    gcloud

    1. In the Google Cloud console, activate Cloud Shell.

      Activate Cloud Shell

      At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

    2. Set your default project. This should be the project that contains the Cloud Tasks resources that you want to protect with CMEK. If you need to run a command in a different project, such as the project containing your Cloud KMS resources, this page will include the --project flag in the gcloud CLI command and tell you which project to specify.

      gcloud config set project PROJECT_ID

      Replace PROJECT_ID with the ID of the project that contains your Cloud Tasks resources.

    3. Update gcloud components. 

      gcloud components update

    4. Enable the Cloud KMS and Cloud Tasks APIs for the project that will store your encryption keys. 

      gcloud services enable cloudkms.googleapis.com cloudtasks.googleapis.com \
    --project=PROJECT_ID

      Replace PROJECT_ID with the ID of the project that will store your encryption keys. This could be the same project as your Cloud Tasks resources, but to limit access to your Cloud KMS keys, consider Setting up Cloud KMS in a separate project.

  2. Cloud KMS produces Cloud Audit Logs when keys are enabled, disabled, or used by Cloud Tasks resources to encrypt and decrypt data. Make sure that logging is enabled for the Cloud KMS API in your project, and that you have decided which logging-specific permissions and roles apply to your use case. For more information, see Cloud KMS audit logging information.

  3. Get Identity and Access Management roles.

    To get the permissions that you need to use CMEK with Cloud Tasks, ask your administrator to grant you the following IAM roles on your project:

    • Enable or disable CMEK: roles/cloudtasks.admin
    • View the key in use: roles/cloudtasks.viewer

    For more information about granting roles, see Manage access to projects, folders, and organizations.

    You might also be able to get the required permissions through custom roles or other predefined roles.

Create a Cloud KMS key ring and key

If you already have a key ring in the same region as your Cloud Tasks resources and you want to use that key and key ring, skip this section. If not, use these instructions to create your Cloud KMS key and key ring.

  1. Create a key ring.

  2. Create a key for a specified key ring.

Retrieve the ID for a Cloud KMS key

The resource ID for a Cloud KMS key is required when you enable CMEK for Cloud Tasks.

Console

  1. In the Google Cloud console, go to the Key management page and select the Key inventory tab.

    Go to Key inventory

  2. For the key whose resource ID you are retrieving, click Actions.

  3. Click Copy resource name.

    The resource ID for the key is copied to your clipboard. Its format is similar to the following: