Question

A financial services company stores all encryption keys in a dedicated 'security-keys' project managed by the central security team. An application team's project runs Compute Engine VMs whose persistent disks must be encrypted with a customer-managed encryption key (CMEK) from a key ring in the security-keys project. When the application team tries to create a disk referencing the key, disk creation fails with a permission error. What is the correct way to resolve this while maintaining centralized key management?

Accepted Answer

Grant the Compute Engine service agent of the application project the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key or key ring in the security-keys project.

Answer

Copy the CMEK material from the security-keys project into the application project's own key ring so the service agent can access it locally.

Answer

Grant the application team's users the Cloud KMS Admin role on the security-keys project so they can manage the key during disk creation.

Answer

Disable CMEK for the disks and rely on Google-managed default encryption, then re-enable CMEK once IAM propagates.