This page explains how to use Cloud KMS customer-managed encryptionkeys in other Google Cloud services to secure your resources. For moreinformation, seeCustomer-managed encryption keys (CMEK).

When a service supports CMEK, it's said to have aCMEK integration. Some services, such as GKE, have multipleCMEK integrations for protecting different types of data related to the service.For a list of services with CMEK integrations, seeEnable CMEK for supportedservices on this page.

Before you begin

Before you can use Cloud KMS keys in other Google Cloud services,you must have a project resource to contain your Cloud KMS keys. Werecommend using a separate project for your Cloud KMS resources thatdoes not contain any other Google Cloud resources.

CMEK integrations

Prepare to enable CMEK integration

For the exact steps to enable CMEK, see the documentation for the relevantGoogle Cloud service. You can find a link to the CMEK documentation foreach service inEnable CMEK for supported services onthis page. For each service, you can expect to follow steps similar to thefollowing:

1. Create a key ring or select an existing keyring. The key ring should be located as geographically near as possible tothe resources you want to secure.

2. In the selected key ring,create a key or selectan existing key. Ensure that the protection level, purpose, and algorithmfor the key are appropriate for the resources you want to protect. This keyis the CMEK key.

3. Get the resource ID for the CMEKkey.You need this resource ID later.

4. Grant theCryptoKey Encrypter/Decrypter IAMrole(roles/cloudkms.cryptoKeyEncrypterDecrypter) on the CMEK key to theservice account for the service.

   Note: You can grant the Cloud KMS CryptoKey Encrypter/Decrypterrole at the key, key ring, project, folder, or organization level. To followthe principle of least privilege, we recommend granting this role at thelowest level that meets your needs.Caution: As long as your service account has the Cloud KMSCryptoKey Encrypter/Decrypter role, the service can encrypt and decrypt itsdata. If you revoke the role or if you disable or destroy the CMEK key, thedata can no longer be accessed. Leaving your CMEK key inaccessible canaffect your services.

After you have created the key and assigned the required permissions, you cancreate or configure a service to use your CMEK key.

The following steps use Secret Manager as an example. For the exactsteps to use a Cloud KMS CMEK key in a given service, locate thatservice in thelist of CMEK-integrated services.

In Secret Manager, you can use a CMEK to protect data at rest.

1. In the Google Cloud console, go to theSecret Manager page.

   Go to Secret Manager

2. To create a secret, clickCreate Secret.

3. In theEncryption section, selectUse a customer-managed encryptionkey (CMEK).

4. In theEncryption key box do the following:

   1. Optional: To use a key in another project, do the following:

      1. ClickSwitch project.
      2. Enter all or part of the project name in the search bar, then selectthe project.
      3. To view available keys for the selected project, clickSelect.

   2. Optional: To filter available keys by location, key ring, name, orprotection level, enter search terms in thefilter_alt filter bar.

   3. Select a key from the list of available keys in the selected project.You can use the displayed location, key ring, and protection leveldetails to be sure you choose the correct key.

   4. If the key you want to use is not shown in the list, then clickEnterkey manually and enter theresource ID of thekey

5. Finish configuring your secret, and then clickCreate secret.Secret Manager creates the secret and encrypts it using thespecified CMEK key.

Enable CMEK for supported services

To enable CMEK, first locate the desired service in the following table. You canenter search terms in the field to filter the table.All services in this list support software and hardware (HSM) keys.Products that integrate with Cloud KMS when using externalCloud EKM keys are indicated in theEKM supportedcolumn.

Follow the instructions for each service you want to enable CMEK keys for.