We tried customer managed encryption keys (CMEK) service in Google Cloud. But how to generate customer management keys with python and attach to a Cloud Storage bucket? Does anyone know the procedure?
1 Answers
You can use your own encryption keys. This is called "Customer Supplied Encryption Key". However, you cannot attach a customer key to a storage bucket. Instead you must supply the key for each storage operation. This means each upload, download, etc. operation will require the encryption key.
This also means that you must manage the security of your encryption keys and manage key rotation yourself. Also note that not all Google Cloud services support customer encryption keys. Google Storage does, but Cloud Dataflow, Dataproc, Google Storage Transfer service do not.
The management infrastructure to manage your encryption keys, which if done correctly, is very complicated. Think Master Keys, Data Encryption Keys, Key Rotation, Policies, Procedures, Recovery, and lastly Auditing and Compliance. There is also the risk of a key being lost or compromised.
Consider a managed key service which will reduce the management and expense headaches.
This article discusses in detail how to use customer encryption keys with example code in Python as well as other languages.
Related