Question

A financial services company must comply with a regulation requiring that the cryptographic keys protecting customer data in BigQuery and Cloud Storage be generated on the company's on-premises FIPS 140-2 Level 3 hardware security module and never exist in software form inside Google Cloud. The company still wants to use Cloud KMS to manage the key lifecycle and reference the keys as CMEK on Google Cloud resources. Which approach meets these requirements?

Accepted Answer

Configure Cloud External Key Manager (Cloud EKM) so Cloud KMS references key material that remains in an external key management system, then use it as CMEK.

Answer

Create Cloud HSM keys in Cloud KMS and enable automatic rotation so keys are generated inside Google's HSM.

Answer

Generate the key material on the on-premises HSM and import it into Cloud KMS as an imported key, then reference it as CMEK.

Answer

Use customer-supplied encryption keys (CSEK) by passing the raw key from the on-premises HSM with each Cloud Storage request.