Question

A financial services company has a strict compliance requirement that Google must never have the ability to independently decrypt data stored on Compute Engine persistent disks. The security team wants to supply and manage the raw encryption key material themselves, storing keys entirely outside of Google Cloud in their on-premises HSM. They must provide the key each time a disk is created, attached, or a VM is started. Which encryption approach meets these requirements?

Accepted Answer

Use Customer-Supplied Encryption Keys (CSEK), passing the raw key material with each Compute Engine API request

Answer

Use Customer-Managed Encryption Keys (CMEK) with a key stored in Cloud KMS and disable Google-managed rotation

Answer

Use Cloud HSM to generate the key and grant the Compute Engine service agent the Cloud KMS CryptoKey Encrypter/Decrypter role

Answer

Use Cloud External Key Manager (EKM) to reference the on-premises key over an internet connection