By default, Memorystore for Redis encrypts customer content at rest. Memorystore for Redis handles encryption for you without any additional actions on your part. This option is calledGoogle default encryption.

If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) inCloud KMS with CMEK-integrated services including Memorystore for Redis. Using Cloud KMS keys gives you control over their protection level, location, rotation schedule, usage and access permissions, and cryptographic boundaries. Using Cloud KMS also letsyou view audit logs and control key lifecycles. Instead of Google owning and managing the symmetrickey encryption keys (KEKs) that protect your data, you control and manage these keys in Cloud KMS.

After you set up your resources with CMEKs, the experience of accessing your Memorystore for Redis resources is similar to using Google default encryption. For more information about your encryption options, seeCustomer-managed encryption keys (CMEK).

Who should use CMEK?

CMEK is intended for organizations that have sensitive or regulated data thatmust be encrypted. For more information about whether to use CMEK to encryptthis data, seeDecide whether to use CMEK.

Google-managed encryption versus customer-managed encryption

The CMEK feature lets you use your own cryptographic keys for data at rest inMemorystore for Redis. For CMEK-enabled Memorystore for Redis instances,Google uses your keys to access all data at rest.

Memorystore uses Google-managed data encryption keys (DEK) and keyencryption keys (KEK) to encrypt data in Memorystore for Redis.There are two levels of encryption:

• DEK encryption: Memorystore uses DEKs to encrypt data inMemorystore for Redis.
• KEK encryption: Memorystore uses KEKs to encrypt DEKs.

The Memorystore for Redis instance stores the encrypted DEK alongside theencrypted data on the persistent disk and Google manages the Google KEK. TheCMEK is the KEK that wraps the DEK. CMEK lets youcreate,disable or destroy, andenable or restore the KEK.

You manage CMEK by using theCloud Key Management Service API.

The following diagrams show how data-at-rest encryption works inside aMemorystore for Redis instance when using default Google-managed encryptionversus CMEK.

When decrypting data wrapped with CMEK, Memorystore uses the KEKfrom Cloud Key Management Service to decrypt the DEK and the unencrypted DEK to decrypt data atrest.

Pricing

Memorystore for Redis bills for a CMEK-enabled instance just like any otherinstance; there are no additional costs. For more information, seeMemorystore for Redis pricing.

You use theCloud KMS API to manage CMEK.When you create a Memorystore for Redis instance with CMEK, Memorystoreuses the key periodically to encrypt data.

You're billed by Cloud KMS for the cost of the key and for encryptionand decryption operations when Memorystore for Redis uses thekey. For more information, seeCloud KMS pricing.

When does Memorystore interact with CMEK?

Which data is encrypted using CMEK?

CMEK encrypts the following types of data:

• Customer data stored in persistent storage.
• Metadata related to security features likeAUTHandin-transit encryption.

About service accounts

When creating an instance with CMEK, you must grant thecloudkms.cryptoKeyEncrypterDecrypter role to the Memorystore for Redisservice account that has the following format:

  service-PROJECT_NUMBER@cloud-redis.iam.gserviceaccount.com

Granting this permission allows the service account to request key access fromCloud KMS.

For instructions on granting this permission to the service account, seeGrant the Memorystore for Redis service account access to the key.

About keys

In Cloud KMS, you need to create a key ring with a cryptographic keythat uses asymmetric encryption algorithm.When you create a Memorystore for Redis instance, you select this key toencrypt the instance. You can create one project for both your keys andinstances, or different projects for each of them.

CMEK is available in all Memorystore for Redis instance locations. You mustcreate the key ring and key in the same region where you want to create theinstance. A key for a multi-region or global region doesn't work. If the regionsor locations don't match, then a request for creating the instance fails.

For the resource ID of the key, CMEK uses the following format:

projects/CMEK_ENABLED_PROJECT/locations/REGION/keyRings/KEY_RING_NAME/cryptoKeys/KEY_NAME

If Memorystore for Redis can't access any key version being used (for example,you disable all key versions), then Memorystore for Redis shuts down theinstance. In the Google Cloud console, a suspended instance shows a redexclamation mark tooltip on theInstances page. If you hover over the tooltip,then aNo state status appears. After the key becomes accessible,Memorystore for Redis resumes the instance automatically.

You can useCloud External Key Manager (Cloud EKM) to encrypt data withinGoogle Cloud using external keys that you manage.

When you use a Cloud EKM key, Google has no control over theavailability of your externally managed key. If the key isn't available when youcreate your instance, then the instance isn't created.

For more considerations when using external keys, seeCloud External Key Manager.

How do you make CMEK-encrypted data inaccessible permanently?

You might have situations where you want to make data that's encrypted with CMEKinaccessible permanently. To do this, you destroy the key version. For moreinformation about destroying versions of the key, seeDestroy and restore key versions.

How do you import or export data for a CMEK-enabled instance?

If you want your data to remain encrypted with a CMEK when youexport data, then you must set a CMEK on theCloud Storage bucket before you export data to it.

If your data is stored on a CMEK-enabled instance, then there are no specialrequirements or restrictions forimporting datainto a new instance.

Behavior of a CMEK key version

This section provides information about what happens when you disable, destroy,rotate, enable, and restore a key version.

Disable or destroy a CMEK key version

If you want to ensure no data access to your instance, then disable the primarykey version of your CMEK. This shuts down your instance. Also, if any CMEKthat's in use is disabled or destroyed, then Memorystore for Redis shuts downthe instance. This includes any older key version that the instance uses.

To see if Memorystore for Redis suspends your instance, use one of thefollowing interfaces:

• Google Cloud console: in theInstances page, a red exclamation marktooltip appears next to your instance. If you hover over the tooltip, then aNo state status appears.
• gcloud CLI: use thegcloud redis instances describe command. Verify that you don't seestate: READY,state: REPAIRING, or any other state in the instance metadata.

Enable or restore the primary CMEK key version

If youenable or restore the primary keyversion of your CMEK, then Memorystore for Redis no longer hides your instance.

Limitations

The following limitations apply when using CMEK with Memorystore for Redis:

• You can't enable CMEK on an existing Memorystore for Redis instance.
• The key, key ring, and instance must be located in the same region.
• You must use thesymmetric encryption algorithmfor your key.
• Cloud KMS encryption and decryption rates are subject to aquota.

About CMEK organization policy constraints

Memorystore for Redis supportsorganization policy constraints for CMEK. By using these constraints, you can enforceCMEK protection for your instances and limit which Cloud KMS keys youcan use for this protection.

You can configure the following organization policy constraints:

• constraints/gcp.restrictNonCmekServices: use this constraint to enforceCMEK protection for your instances. If theMemorystore for Redis APIis in theDeny policy list of services for this constraint, then you can'tcreate non-CMEK-protected instances.
• constraints/gcp.restrictCmekCryptoKeyProjects: use this constraint to limitwhich Cloud KMS keys you can use for CMEK protection. If youconfigure this constraint, then the instances that use CMEK encryption must usea key from an allowed project, folder, or organization.