Cloud Key Management Service (Cloud KMS) lets you create and manage cryptographic keysfor use in compatible Google Cloud services and in your ownapplications. Using Cloud KMS, you can do the following:

• Generate software or hardware keys, import existing keys into Cloud KMS, or link external keys in yourcompatible external key management (EKM) system.
• Generate Multi-tenant Cloud HSM keys and use them withCloud HSM for Google Workspace to enable client-side encryption (CSE) in Google Workspace.
• Create and maintain Single-tenant Cloud HSM instances, and create or import and then use Single-tenant Cloud HSM keys.
• Use customer-managed encryption keys (CMEKs) in Google Cloud products withCMEK integration. CMEK integrations use your Cloud KMS keys to encrypt or "wrap" your data encryption keys (DEKs). Wrapping DEKs with key encryption keys (KEKs) is calledenvelope encryption.
• UseCloud KMS Autokey to automate provisioning and assignment. With Autokey, you don't need to provision key rings, keys, and service accounts ahead of time. Instead, they are generated on demand as part of resource creation.
• Use Cloud KMS keys for encryption and decryption operations. For example, you can use the Cloud KMS API or client libraries to use your Cloud KMS keys forclient-side encryption.
• Use Cloud KMS keys to create or verifydigital signatures ormessage authentication code (MAC) signatures.
• Use Cloud KMS keys to establish shared secrets usingkey encapsulation mechanisms.

Choose the right encryption for your needs

You can use the following table to identify which type of encryption meets yourneeds for each use case. The best solution for your needs might includea mix of encryption approaches.For example, you might use software keys for your least sensitive data andhardware or external keys for your most sensitive data.For additional information about the encryption options described in thissection, seeProtecting data in Google Cloud onthis page.For more information about theservice level agreement (SLA) that applies when using Cloud KMS,Cloud HSM, and Cloud EKM keys, seeService Level Agreement.

Protecting data in Google Cloud

Google-owned and Google-managed encryption keys (Google Cloud default encryption)

By default, data at rest in Google Cloud is protected by keys inKeystore, Google Cloud's internal key management service. Keys inKeystore are managed automatically by Google Cloud, with noconfiguration required on your part. Most services automatically rotate keys foryou. Keystore supports a primary key version and a limited number of older keyversions. The primary key version is used to encrypt new data encryption keys.Older key versions can still be used to decrypt existing data encryption keys.You can't view or manage these keys or review key usage logs. Data from multiplecustomers might use the same key encryption key.

This default encryption uses cryptographic modules that are validated to beFIPS 140-2 Level 1 compliant.

Note: Google Cloud default encryption is not a feature ofCloud Key Management Service.For more information about Google Cloud defaultencryption, seeDefault encryption at rest.

Customer-managed encryption keys (CMEKs)

Cloud KMS keys that are used to protect your resources inCMEK-integrated services are customer-managed encryption keys (CMEKs).You can own and control CMEKs, while delegating key creation and assignmenttasks to Cloud KMS Autokey. To learn more about automating provisioning forCMEKs, seeCloud Key Management Service with Autokey.

You can use your Cloud KMS keys incompatible services to help you meet the following goals:

• Own your encryption keys.

• Control and manage your encryption keys, including choice of location,protection level, creation, access control, rotation, use, and destruction.

• Selectively delete data protected by your keys in the case of off-boarding orto remediate security events (crypto-shredding).

• Create dedicated, single-tenant keys that establish a cryptographic boundaryaround your data.

• Log administrative and data access to encryption keys.

• Meet current or future regulation that requires any of these goals.

When you use Cloud KMS keys withCMEK-integrated services, you can useorganization policies to ensure that CMEKs are used as specified in thepolicies. For example, you can set an organization policy that ensures that yourcompatible Google Cloud resources use your Cloud KMSkeys for encryption. Organization policies can also specify which project thekey resources must reside in.

The features and level of protection provided depend on the protection level ofthe key:

• Software keys - You can generate software keys in Cloud KMS anduse them in all Google Cloud locations. You can createsymmetric keys withautomatic rotation or asymmetric keyswith manual rotation. Customer-managed software keys useFIPS 140-2 Level1 validated software cryptography modules. You also have control overthe rotation period, Identity and Access Management (IAM) roles and permissions, andorganization policies that govern your keys. You can use your software keyswith manycompatible Google Cloudresources.

• Imported software keys - You can import software keys that you createdelsewhere for use in Cloud KMS. You can import new key versions tomanually rotate imported keys. You can use IAM roles andpermissions and organization policies to govern usage of your importedkeys.

• Hardware keys with Multi-tenant Cloud HSM - You can generate hardware keys ina cluster ofFIPS 140-2 Level 3 Hardware Security Modules (HSMs).You have control over the rotation period, IAM roles andpermissions, and organization policies that govern your keys. When youcreate HSM keys using Cloud HSM, Google Cloudmanages the HSM clusters so you don't have to. You can use your HSM keyswith manycompatible Google Cloudresources—the same services that supportsoftware keys. For the highest level of security compliance, use hardwarekeys.

• Hardware keys with Single-tenant Cloud HSM - You can generate hardwarekeys in a cluster of dedicated partitions inFIPS 140-2 Level 3Hardware Security Modules (HSMs) that you control. You have control over therotation period, IAM roles and permissions, and organizationpolicies that govern your keys. When you create a Single-tenant Cloud HSMinstance, Google Cloud hosts the HSM clusters so you don'thave to, but you control access to the instance and maintain it with aquorum of designated administrators. Instance operations require two-factorauthentication using security keys that you own outside ofGoogle Cloud. You can use your single-tenant HSM keys with manycompatible Google Cloudresources—the same services that supportsoftware keys. For the highest level of security compliance withcryptographic isolation, use hardware keys.

• External keys and Cloud EKM - You can use keys that reside inan external key manager (EKM). Cloud EKM lets you use keys held inasupported key manager to secure yourGoogle Cloud resources.You can connect to your EKMover the internet or over aVirtual Private Cloud (VPC).Some Google Cloud services that support Cloud KMSkeys don't support Cloud EKM keys.

To learn more about which Cloud KMS locations support which protectionlevels, seeCloud KMS locations.

Cloud KMS keys

You can use your Cloud KMS keys in custom applications using theCloud KMS client libraries orCloud KMS API. The client librariesand API let you encrypt and decrypt data, sign data, and validate signatures.

Multi-tenant Cloud HSM for Google Workspace

You can use your Multi-tenant Cloud HSM keys in Cloud HSM for Google Workspace to managethe keys used for client-side encryption (CSE) in Google Workspace. You canOnboard to Cloud HSM for Google Workspace.

Customer-supplied encryption keys (CSEKs)

Cloud Storage andCompute Engine can usecustomer-supplied encryption keys (CSEKs).With customer-supplied encryption keys, you store the key material and provideit to Cloud Storage or Compute Engine when needed.Google Cloud does not store your CSEKs in any way.

Note: CSEK support is not a feature of Cloud Key Management Service.For more information about CSEK, seeCloud Storage Customer-supplied encryption keys orCompute Engine Customer-supplied encryption keys.

Confidential Computing

You can use the Confidential Computing platform to encrypt your data-in-use.Confidential Computing ensures that your data stays private and encrypted evenwhile it's being processed.

Note: Confidential Computing is not a feature of Cloud KMS. For moreinformation about Confidential Computing, seeConfidential Computing.