Question

A data engineering team creates a BigQuery dataset in the US multi-region and configures it to use a customer-managed encryption key (CMEK). They created their Cloud KMS key ring in the us-central1 region. When they try to associate the key with the dataset, the operation fails. What is the most likely cause and the correct remediation?

Accepted Answer

The Cloud KMS key and the BigQuery dataset must be in compatible locations; recreate the key in the US multi-region (or a supported location) so the key location matches the dataset location.

Answer

BigQuery does not support CMEK; the team must use CSEK by supplying the key material with each query and load job.

Answer

The BigQuery service account lacks the roles/owner role on the project; grant Owner to the BigQuery service agent to allow key association.

Answer

CMEK keys must always be stored in Cloud HSM; migrate the key to a Cloud HSM protection level and retry the association.