CMEK organization policies

Google Cloud offers two organization policy constraints to help ensure CMEKusage across an organization:

  • constraints/gcp.restrictNonCmekServices is used to require CMEKprotection.
  • constraints/gcp.restrictCmekCryptoKeyProjects is used to limit whichCloud KMS keys are used for CMEK protection.

CMEK organization policies only apply to newly created resources withinsupported Google Cloud services.

Required roles

To ensure that each user has the necessary permissions to check organization policies when creating resources, ask your administrator to grant each user theOrganization Policy Viewer (roles/orgpolicy.policyViewer) IAM role on your organization. For more information about granting roles, seeManage access to projects, folders, and organizations.

This predefined role contains the permissions required to check organization policies when creating resources. To see the exact permissions that are required, expand theRequired permissions section:

Required permissions

The following permissions are required to check organization policies when creating resources:

  • To view full organization policy details:orgpolicy.policy.get
  • To check organization policy when creating resources:orgpolicy.policies.check

Your administrator might also be able to give each user these permissions withcustom roles or otherpredefined roles.

When organization policies are active, theorgpolicy.policies.check permissionis required for Google Cloud console users who create resources that areprotected by CMEK keys. Users without this permission can create CMEK-protectedresources using the Google Cloud console, but they can select a CMEK key thatisn't allowed by therestrictCmekCryptoKeyProjects constraint. When a key thatdoes not meet this constraint is selected, resource creation eventually fails.

Note: Theorgpolicy.policies.check permission is not visible in theGoogle Cloud console but has been added to all predefined roles that includetheorgpolicy.policy.get permission. If your organization uses custom rolesand CMEK organization policies, use gcloud CLI to add theorgpolicy.policies.check permission to each role that can create resources.For more information, seeEditing an existing customrole.

Require CMEK protection

To require CMEK protection for your organization, configure theconstraints/gcp.restrictNonCmekServices organization policy.

As a list constraint, the accepted values for this constraint are Google Cloudservice names (for example,bigquery.googleapis.com). Use this constraint byproviding a list of Google Cloud service names and setting the constraint toDeny. This configuration blocks the creation of resources in theseservices if the resource is not protected by CMEK. Inother words, requests to create a resource in the service don't succeed withoutspecifying a Cloud KMS key. Additionally, this constraint blocksthe removal of CMEK protection from resources in these services. This constraintcan only be applied tosupported services.

Caution: The creation of some Google Cloud resource types can trigger thecreation of a resource type from a different service. Use caution whenconfiguring this constraint in an environment with services that don't supportCMEK. Requiring CMEK protection for a service that is CMEK-aware may prevent aCMEK-unaware service from creating resources and disrupt normal functioning.

Limit the use of Cloud KMS keys for CMEK

To limit which Cloud KMS keys are used for CMEK protection,configure theconstraints/gcp.restrictCmekCryptoKeyProjects constraint.

As a list constraint, the accepted values are resource hierarchy indicators (forexample,projects/PROJECT_ID,under:folders/FOLDER_ID, andunder:organizations/ORGANIZATION_ID). Use this constraint byconfiguring a list of resource hierarchy indicators and setting the constrainttoAllow. This configuration restricts supported services so that CMEK keyscan be chosen only from the listed projects, folders, and organizations.Requests to create CMEK-protected resources in configured services don't succeedwithout a Cloud KMSkey from one of the allowed resources. Where configured, this constraint appliesto allsupported services.

Note: This constraint by itself does not necessarily guarantee the use ofcustomer-managed encryption keys from allowed projects within the specifiedservices, because other methods of encryption might be available. To enforce theuse of customer-managed encryption keys from allowed projects, you must applyboth this constraint and theconstraints/gcp.restrictNonCmekServicesconstraint.

Supported services

ServiceConstraint value when requiring CMEK
Agent Assistdialogflow.googleapis.com
AlloyDB for PostgreSQLalloydb.googleapis.com
Apigeeapigee.googleapis.com
Application Integrationintegrations.googleapis.com
Artifact Registryartifactregistry.googleapis.com
Backup for GKEgkebackup.googleapis.com
BigQuerybigquery.googleapis.com
Bigtablebigtable.googleapis.com
Cloud Composercomposer.googleapis.com
Cloud Data Fusiondatafusion.googleapis.com
Cloud Logginglogging.googleapis.com
Cloud Runrun.googleapis.com
Cloud Run functionscloudfunctions.googleapis.com
Cloud SQLsqladmin.googleapis.com
Cloud Storagestorage.googleapis.com
Cloud Taskscloudtasks.googleapis.com
Cloud Workstationsworkstations.googleapis.com
Colab Enterpriseaiplatform.googleapis.com
Compute Enginecompute.googleapis.com
Customer Experience Insightscontactcenterinsights.googleapis.com
Dataflowdataflow.googleapis.com
Dataformdataform.googleapis.com
Dataplex Universal Catalogdataplex.googleapis.com
Dataprocdataproc.googleapis.com
Dialogflow CXdialogflow.googleapis.com
Document AIdocumentai.googleapis.com
Eventarc Advanced (Preview)eventarc.googleapis.com
Eventarc Standardeventarc.googleapis.com
Filestorefile.googleapis.com
Firestorefirestore.googleapis.com
Gemini Enterprise Enterprisediscoveryengine.googleapis.com
Google Cloud NetApp Volumesnetapp.googleapis.com
Google Kubernetes Engine (Preview)container.googleapis.com
Looker (Google Cloud core)looker.googleapis.com
Memorystore for Redisredis.googleapis.com
Memorystore for Redis Clusterredis.googleapis.com
Memorystore for Valkeymemorystore.googleapis.com
Pub/Subpubsub.googleapis.com
Secret Managersecretmanager.googleapis.com
Secure Source Managersecuresourcemanager.googleapis.com
Security Command Centersecuritycenter.googleapis.com
Spannerspanner.googleapis.com
Speech-to-Textspeech.googleapis.com
Vertex AIaiplatform.googleapis.com
Vertex AI Searchdiscoveryengine.googleapis.com
Vertex AI Workbench instancesnotebooks.googleapis.com

CMEK organization policies and Storage Transfer Service

Storage Transfer Service doesn't have a CMEK integration but can be used with CMEKorganization policies. If you use Storage Transfer Service and want to use CMEK tohelp protect the database credentials stored in Secret Manager, youmust add bothstoragetransfer.googleapis.com andsecretmanager.googleapis.com to theconstraints/gcp.restrictNonCmekServicesconstraint. For more information, see theStorage Transfer Service CMEKdocumentation.

Caution: If you addstoragetransfer.googleapis.com to this constraint but notsecretmanager.googleapis.com, then the organization policy won't function asintended.

Enforcement exceptions by resource type

CMEK organization policy constraints are enforced when creating a new resourceor when changing (where supported) the Cloud KMS key on an existingresource. Generally, they are enforced on all of a service's resource types thatsupport CMEK and based solely on the resource's configuration. Some notableexceptions are summarized here:

Resource typeEnforcement exception
bigquery.googleapis.com/Dataset Partially enforced on dataset default Cloud KMS key (gcp.restrictCmekCryptoKeyProjects only)
bigquery.googleapis.com/Job Query jobs only: enforced on Cloud KMS key provided with queryor default from billing project; see also separateconfiguration of projectdefault Cloud KMS key
bigquerydatatransfer.googleapis.com/TransferConfig Transfer configs use the service name of the Data Transfer Service(bigquerydatatransfer.googleapis.com) for CMEK organization policy constraints.
container.googleapis.com/Cluster(Preview) Enforced on the Cloud KMS key for node bootdisk only; not enforced on secrets at the application layer
logging.googleapis.com/LogBucket Enforced on explicitly created log buckets; see also separateconfigurationrequired to ensure compliance of built-in log buckets
storage.googleapis.com/Bucket Enforced on bucket default Cloud KMS key
storage.googleapis.com/Object Enforced independently of bucket; see also separateconfiguration of bucket default Cloud KMS key

Configuration examples

In the configuration examples, assume the sample organization has the followingresource hierarchy:

A diagram of an organization resource hierarchy

Note: CMEK organization policies only apply to newly created resources withinsupported services.

Require CMEK and limit keys for a project

Suppose you want to require CMEK protection for all Cloud Storage resourcesunderprojects/5 and ensure that only keys coming fromprojects/4 can beused.

To require CMEK protection for all new Cloud Storage resources, use thefollowing organization policy setting:

  • Organization policy:constraints/gcp.restrictNonCmekServices
  • Binding at:projects/5
  • Policy type:Deny
  • Policy value:storage.googleapis.com

To ensure only keys fromprojects/4 are used, use the following configuration:

  • Organization policy:constraints/gcp.restrictCmekCryptoKeyProjects
  • Binding at:projects/5
  • Policy type:Allow
  • Policy value:projects/4

Require CMEK and limit keys to within a folder

Alternatively, suppose you're expecting to add additional Cloud KMSprojects underfolders/2 in the future and want to require CMEK more broadlywithinfolders/3. For this scenario, you need slightly differentconfigurations.

To require additional CMEK protection for new Cloud SQL and Cloud Storageresources anywhere underfolders/3:

  • Organization policy:constraints/gcp.restrictNonCmekServices
  • Binding at:folders/3
  • Policy type:Deny
  • Policy values:sqladmin.googleapis.com,storage.googleapis.com

To ensure only keys from Cloud KMS projects underfolders/2 areused:

  • Organization policy:constraints/gcp.restrictCmekCryptoKeyProjects
  • Binding at:folders/3
  • Policy type:Allow
  • Policy value:under:folders/2

Require CMEK for an organization

To require CMEK everywhere in the organization (in supported services),configure theconstraints/gcp.restrictNonCmekServices constraint with thefollowing setting:

  • Organization policy:constraints/gcp.restrictNonCmekServices
  • Binding at:organizations/1
  • Policy type:Deny
  • Policy values: (allsupported services)

Limitations

If you use Google Cloud console to create a resource, you might notice thatyou can't use any encryption options other than CMEK whenconstraints/gcp.restrictNonCmekServices is configured for a project andservice. The CMEK organization policy restriction is only visible when thecustomer account has been granted theorgpolicy.policy.get IAMpermission on the project.

What's next

SeeIntroduction to the Organization PolicyServiceto learn more about the benefits and common use cases for organization policies.

For more examples on creating an organization policy with particularconstraints, seeUsingconstraints.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.