* Customer-Managed Encryption Keys (CMEK):
* CMEK allows you to manage encryption keys using Cloud Key Management Service (KMS).
This gives you control over the lifecycle of the keys, including rotation, destruction, and auditing.
* Set up a Cloud KMS key ring and create encryption keys that will be used to protect your data in BigQuery, Cloud SQL, and Cloud Storage.
* Configure the services to use CMEK for encrypting data at rest, ensuring compliance with your organization's security policies.
* Cloud External Key Manager (EKM):
* Cloud EKM allows you to use keys managed by an external key management provider to encrypt data in Google Cloud services.
* Integrate your external key management system with Google Cloud using supported protocols and APIs.
* Configure your data warehouse services to use the external keys for encryption, ensuring that key management is handled outside of the Google Cloud environment.
* Key Access Justifications:
* Enable Key Access Justifications to provide visibility into why encryption keys are being accessed. This helps in monitoring and auditing key usage to ensure compliance and security.
* Set up policies and logging to capture and review key access requests, providing insights into how and why keys are used.
* Access Transparency and Approval:
* Implement Access Transparency to gain visibility into Google's access to your data and encryption keys.
* Configure Access Approval to require explicit approval for Google support or engineering access to your data, adding an additional layer of security and control.
References:
Customer-Managed Encryption Keys (CMEK)
Cloud External Key Manager (EKM)
Key Access Justifications
Access Transparency
Access Approval