Question

A development team needs to encrypt large volumes of application data (multi-gigabyte objects) at the application layer before storing them in Cloud Storage. Cloud KMS has a payload size limit of 64 KiB per encrypt/decrypt request, so calling the KMS API directly on each large object is not feasible. The security team requires that the encryption approach still centralize key control in Cloud KMS and support key rotation. What is the recommended technique?

Accepted Answer

Use envelope encryption: generate a local data encryption key (DEK), encrypt the data with the DEK, then call Cloud KMS to encrypt (wrap) the DEK with a key encryption key (KEK) and store the wrapped DEK alongside the data

Answer

Split each large object into 64 KiB chunks and call the Cloud KMS encrypt API sequentially on each chunk, then reassemble the ciphertext

Answer

Enable customer-managed encryption keys (CMEK) on the Cloud Storage bucket and let the application upload data unencrypted, relying on Google to encrypt at rest

Answer

Export the Cloud KMS key material to the application so it can encrypt objects locally without the payload size limit