Question

A financial services company must comply with a regulation that requires the encryption keys protecting their BigQuery datasets to be generated and stored outside of Google Cloud, entirely under the control of the organization's on-premises third-party key management system. The security team must ensure Google never has access to the raw key material, while still enabling BigQuery to use Google's managed infrastructure. Which encryption approach should they implement?

Accepted Answer

Configure Cloud External Key Manager (Cloud EKM) so BigQuery uses CMEK backed by a key hosted in the external key management partner system

Answer

Use Cloud HSM to generate FIPS 140-2 Level 3 keys within Google Cloud and grant BigQuery access to them

Answer

Enable customer-supplied encryption keys (CSEK) and supply the raw key material to BigQuery with each query

Answer

Import the external key into Cloud KMS as a key import job and rotate it manually from on-premises