Encrypt workstation resources using CMEK

By default, Cloud Workstations encrypts customer content at rest. Cloud Workstations handles encryption for you without any additional actions on your part. This option is called Google default encryption.

If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in Cloud KMS with CMEK-integrated services including Cloud Workstations. Using Cloud KMS keys gives you control over their protection level, location, rotation schedule, usage and access permissions, and cryptographic boundaries. Using Cloud KMS also lets you track key usage, view audit logs, and control key lifecycles. Instead of Google owning and managing the symmetric key encryption keys (KEKs) that protect your data, you control and manage these keys in Cloud KMS.

After you set up your resources with CMEKs, the experience of accessing your Cloud Workstations resources is similar to using Google default encryption. For more information about your encryption options, see Customer-managed encryption keys (CMEK).

By default, Cloud Workstations uses a Google-owned and Google-managed encryption key to encrypt workstation resources such as VMs and persistent disks when data is at rest. If you have specific compliance or regulatory requirements related to the keys that protect your data, you can use customer-managed encryption keys (CMEK) using Cloud Key Management Service (Cloud KMS).

For more information about CMEK in general, including when and why to enable it, see the Cloud KMS documentation.

Before you begin

Create your projects

  1. In the Google Cloud console, on the project selector page, select or create the following Google Cloud projects:

    • A key project contains your Cloud KMS resources, including a key ring and a symmetric encryption key.

    • A workstations project contains workstations that are encrypted with a CMEK key.

    You can use the same project for your key project and workstations project, but as a best practice, we recommend that you use two projects for separation of duties.

  2. Make sure that billing is enabled for your Cloud project. For more information, see Verify the billing status of your projects.

  3. Enable the required APIs in each project.

  4. Install and initialize the gcloud CLI:

    1. To install the gcloud CLI, see Install the gcloud CLI CLI and follow the instructions for your operating system.