Use customer-managed encryption keys

By default, Workflows encrypts customer content at rest. Workflows handles encryption for you without any additional actions on your part. This option is called Google default encryption.

If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in Cloud KMS with CMEK-integrated services including Workflows. Using Cloud KMS keys gives you control over their protection level, location, rotation schedule, usage and access permissions, and cryptographic boundaries. Using Cloud KMS also lets you track key usage, view audit logs, and control key lifecycles. Instead of Google owning and managing the symmetric key encryption keys (KEKs) that protect your data, you control and manage these keys in Cloud KMS.

After you set up your resources with CMEKs, the experience of accessing your Workflows resources is similar to using Google default encryption. For more information about your encryption options, see Customer-managed encryption keys (CMEK).

You can protect your workflow and associated data at rest using an encryption key that only you can access, and that you can control and manage using Cloud KMS.

What is protected with CMEK

When deploying a workflow, you can specify a Cloud KMS key. This key is used to encrypt the workflow and its executions:

  • A workflow requires a source file that contains a valid workflow definition. This source file is encrypted using the key.

  • A workflow execution runs the current workflow definition (a specific workflow revision). Using the key associated with the workflow revision at the time of its deployment, the compiled workflow, as well as any stored execution input, output, and runtime data is encrypted. This includes execution arguments, results, errors, and exceptions; delivered Eventarc events; and callback and HTTP requests and responses.

Before you begin

Before using CMEK in Workflows, complete the following steps:

  1. Enable the APIs.

    Console

    1. Enable the Cloud KMS and Workflows APIs.

      Roles required to enable APIs

      To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

      Enable the APIs

    gcloud

    1. In the Google Cloud console, activate Cloud Shell.

      Activate Cloud Shell

      At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

    2. Update gcloud components. 
      gcloud components update
    3. Enable the Cloud KMS and Workflows APIs for the project that will store your encryption keys. 
      gcloud services enable cloudkms.googleapis.com workflows.googleapis.com

  2. Cloud KMS produces Cloud Audit Logs when keys are enabled, disabled, or used by Workflows resources to encrypt and decrypt data. Make sure that logging is enabled for the Cloud KMS API in your project, and that you have decided which logging-specific permissions and roles apply to your use case. For more information, see Cloud KMS audit logging information.

Create a Cloud KMS key ring and key

You can create a new key ring or use an existing one. Within the key ring, you can add a new key or use an existing key.

  1. Create a key ring.

  2. Create a key for a specified key ring.

Retrieve the resource ID for a Cloud KMS key

The resource ID for a Cloud KMS key is required when you enable CMEK for a workflow. In this document, see Enable CMEK for a workflow.

Console

  1. In the Google Cloud console, go to the Key management page.

    Go to Key management

  2. Click the key ring that contains the key.

  3. For the key whose resource ID you are retrieving, click More.

  4. Click Copy resource name.

    The resource ID for the key is copied to your clipboard. Its format is similar to the following:

    projects/PROJECT_NAME/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME

  5. A key contains zero or more key versions. The resource ID for a key version is the key ID, plus a slash (/), plus the version ID. To list all versions for a key:

    1. Click the key's name.
    2. For a specific version, click More.
    3. Click Copy resource name.

gcloud

  1. List all keys on a given key ring:

    gcloud kms keys list --keyring RING_NAME --location LOCATION

    Replace the following:

    • RING_NAME: the name of the key ring
    • LOCATION: the region of the key ring

    The output includes the resource ID for each key. For example:

    NAME: projects/PROJECT_NAME/locations/LOCATION/keyRings/RING_NAME/cryptoKeys/KEY_NAME

  2. A key has zero or more key versions. The resource ID for a key version is the key ID, plus a slash (/), plus the version ID. List all versions for a key: