Question

A large enterprise is standardizing CMEK across hundreds of new BigQuery datasets, Cloud Storage buckets, and Compute Engine disks created by many teams. Security wants each protected resource to use its own dedicated, purpose-built Cloud KMS key that is automatically generated in the correct region and follows a consistent naming and IAM convention, without developers manually creating key rings and keys for every resource. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Enable Cloud KMS Autokey so that CMEK keys are provisioned on demand per resource, in the matching location, following a managed folder-scoped configuration.

Answer

Create a single organization-wide KMS key in the multi-region and require every team to reference it as the CMEK for all resource types.

Answer

Write a Terraform module that each team must copy and run to create key rings and keys before provisioning any protected resource.

Answer

Use Cloud External Key Manager (EKM) to import externally managed keys and assign them to each new resource as it is created.