A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from http://cloud.google.com/compute/docs/disks/customer-managed-encryption below:

Protect resources by using Cloud KMS keys | Compute Engine Documentation

This document provides information about how to use manually-created Cloud Key Management Service Cloud KMS keys to encrypt disks and other storage-related resources. Keys managed in Cloud KMS are known as customer-managed encryption keys (CMEKs).

You can use CMEKs to encrypt Compute Engine resources, such as disks, machine images, instant snapshots and standard snapshots.

To learn more about using customer-supplied encryption keys (CSEKs) to encrypt disks and other storage resources, see Encrypting disks with customer-supplied encryption keys.

Learn more About disk encryption.

Before you begin Required roles

To ensure that the Compute Engine Service Agent has the necessary permissions to protect resources by using Cloud KMS keys, ask your administrator to grant the Compute Engine Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) IAM role on your project.

Important: You must grant this role to the Compute Engine Service Agent, not to your user account. Failure to grant the role to the correct principal might result in permission errors.

For more information about granting roles, see

Manage access to projects, folders, and organizations

.

Your administrator might also be able to give the Compute Engine Service Agent the required permissions through custom roles or other predefined roles.

The Compute Engine Service Agent has the following form:

service-PROJECT_NUMBER@compute-system.iam.gserviceaccount.com

You can use the Google Cloud CLI to assign the role:

gcloud projects add-iam-policy-binding KMS_PROJECT_ID \
    --member serviceAccount:service-PROJECT_NUMBER@compute-system.iam.gserviceaccount.com \
    --role roles/cloudkms.cryptoKeyEncrypterDecrypter

Replace the following:

Encryption specifications

The Cloud KMS keys used to help protect your data in Compute Engine are AES-256 keys. These keys are key encryption keys, and they encrypt the data encryption keys that encrypt your data, not the data itself.

The data on the disks is encrypted using Google-owned and Google-managed encryption keys. For specifications related to the default encryption in Google Cloud, see Default encryption at rest in the Security documentation.

With Confidential mode for Hyperdisk Balanced and Cloud HSM, the data encryption key (DEK) has additional security properties with hardware-backed enclaves.

Limitations Manual or automated key creation

You can either create Cloud KMS keys manually or use Cloud KMS Autokey. Autokey simplifies creating and managing Cloud KMS keys by automating provisioning and assignment. With Autokey, you don't need to provision key rings, keys, and service accounts ahead of time. Instead, they are generated on demand as part of Compute Engine resource creation. For more information, see the Autokey overview.

Manually create key ring and key

For the Google Cloud project that runs Cloud KMS, create a key ring and a key as described in Creating key rings and keys.

Encrypt a new Persistent Disk with CMEK

You can encrypt a new Persistent Disk by supplying a key during VM or disk creation.

Console
  1. In the Google Cloud console, go to the Disks page.

    Go to Disks

  2. Click Create disk and enter the properties for the new disk.
  3. Under Encryption, select Customer-managed key.
  4. In the drop-down menu, select the Cloud KMS key that you want to use to encrypt this disk.
  5. To create the disk, click Create.
gcloud

Create an encrypted disk by using the gcloud compute disks create command, and specify the key using the --kms-key flag.

gcloud compute disks create DISK_NAME \
  --kms-key projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY

Replace the following:

Note: If you're creating a regional Persistent Disk, you must assign the disk replicas to two different zones by specifying the --replica-zones flag. REST

Construct a POST request to the instances.insert method. To encrypt a disk, use the diskEncryptionKey property with the kmsKeyName property. For example, you can encrypt a new disk during VM creation with your Cloud KMS key by using the following:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances

{
"machineType": "zones/ZONE/machineTypes/MACHINE_TYPE",
"disks": [
 {
  "type": "PERSISTENT",
  "diskEncryptionKey": {
    "kmsKeyName": "projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY"
  },
  "initializeParams": {
   "sourceImage": "SOURCE_IMAGE"
  },
  "boot": true
 }
],
...
}

Replace the following:

Similarly, you can use the disks.insert method to create a new standalone Persistent Disk and encrypt it with your Cloud KMS key:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/disks?sourceImage=SOURCE_IMAGE
{
 "name": "DISK_NAME",
 "diskEncryptionKey": {
   "kmsKeyName": "projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY"
  },
 "type": "projects/PROJECT_ID/zones/ZONE/diskTypes/DISK_TYPE"
}

Replace the following:

Create a Hyperdisk Balanced disk in Confidential mode

You can create a new Hyperdisk Balanced disk in Confidential mode with the Google Cloud console, Google Cloud CLI, or REST. To create a disk that isn't in confidential mode, follow the steps in Create a Persistent Disk from a snapshot encrypted with CMEK.

Console
  1. In the Google Cloud console, go to the Disks page.

    Go to Disks

  2. Click Create disk and enter the properties for the new disk.
  3. In the Disk settings section, choose Hyperdisk Balanced for the disk type.
  4. Optional. Change the default disk Size, Provisioned IOPS, and Provisioned Throughput settings for the disk.
  5. In the Encryption section, select Cloud KMS key.
  6. In the list of keys, select the Cloud HSM key that you want to use to encrypt this disk.
  7. In the Confidential Computing section, select Enable Confidential Computing services.
  8. To create the disk, click Create.
gcloud

Encrypt a new disk with Confidential mode for Hyperdisk Balanced by using the gcloud compute disks create command. Enable Confidential mode with the --confidential-compute flag and specify the key using the --kms-key flag.

gcloud compute disks create DISK_NAME \
  --type=hyperdisk-balanced \
  --kms-key projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY \
  --confidential-compute

Replace the following:

REST

Construct a POST request to the instances.insert method. To encrypt a disk with Confidential mode for Hyperdisk Balanced, use the diskEncryptionKey property with the kmsKeyName property and set the enableConfidentialCompute flag. For example, you can encrypt a new disk during VM creation with your Cloud HSM key by using the following:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances

{
"machineType": "zones/ZONE/machineTypes/MACHINE_TYPE",
"disks": [
 {
  "type": "DISK_TYPE",
  "diskEncryptionKey": {
    "kmsKeyName": "projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY"
  },
  "initializeParams": {
   "sourceImage": "SOURCE_IMAGE",
   "enableConfidentialCompute": true
  },
  "boot": true
 }
],
"networkInterfaces": [
  {
   "network": "global/networks/default"
  }
]
}

Replace the following:

Similarly, you can use the disks.insert method to create a new Confidential mode for Hyperdisk Balanced:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/disks?sourceImage=SOURCE_IMAGE
{
 "name": "DISK_NAME",
 "diskEncryptionKey": {
   "kmsKeyName": "projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY"
  },
 "type": "projects/PROJECT_ID/zones/ZONE/diskTypes/DISK_TYPE",
 "enableConfidentialCompute": true
}

Replace the following:

Create a snapshot from a disk encrypted with CMEK

To help protect a snapshot that you create from a disk encrypted with CMEK, you must use the same encryption key that you used to encrypt the disk.

You can't create a snapshot that uses a CMEK unless the source disk uses CMEK as well. Also, you can't convert CMEK-encrypted disks or snapshots to use Google Cloud default encryption unless you create a completely new disk image and a new persistent disk.

Snapshots from disks encrypted with CMEK are incremental.

Caution: If you try to create a snapshot from a disk and the snapshot creation process fails, you won't be able to delete the original disk volume until you clean up the failed snapshot and capture a clean snapshot. This failsafe helps to prevent the accidental deletion of source data in the event of an unsuccessful backup. Console
  1. In the Google Cloud console, go to the Snapshots page.

    Go to Snapshots

  2. Click Create snapshot.
  3. Under Source disk, choose the source disk for the snapshot. The snapshot is automatically encrypted with the same key used by the source disk.
gcloud

For customer-managed encryption, the Cloud KMS key that was used to encrypt the disk is also used to encrypt the snapshot.

You can create your snapshot in the storage location policy defined by your snapshot settings or using an alternative storage location of your choice. For more information, see Choose your snapshot storage location.

Replace the following:

Note: Google recommends using the gcloud compute snapshots create command instead of the gcloud compute disks snapshot command because it supports more features, such as creating snapshots in a project different from the source disk project. REST

You can create your snapshot in the storage location policy defined by your snapshot settings or using an alternative storage location of your choice. For more information, see Choose your snapshot storage location.

Replace the following:

Note: Google recommends using the snapshots.insert method instead of the disks.createSnapshot method because it supports more features, such as creating snapshots in a project different from the source disk project. Encrypt an imported image with CMEK

You can encrypt a new image when you import a custom image to Compute Engine. Before you can import an image, you must create and compress a disk image file and upload that compressed file to Cloud Storage.

Console
  1. In the Google Cloud console, go to the Images page.

    Go to Images

  2. Click Create image.
  3. For Source disk, select the disk you want to create an image of.
  4. For Encryption, select Customer-managed key.
  5. In the drop-down menu, select the Cloud KMS key that you want to use to encrypt this image.
  6. Continue with the image creation process.
gcloud

To import and encrypt an image, use the gcloud compute images create command. For customer-managed encryption, specify the Cloud KMS key for the image.

gcloud compute images create IMAGE_NAME \
    --source-disk=SOURCE_DISK  \
    --kms-key projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY

Replace the following:

REST

To encrypt an imported image, construct a POST request to the images.insert method. Specify the URI to the compressed file, add the imageEncryptionKey property to the image creation request, and specify the key to encrypt the image in the kmsKeyName property.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/images

{
 "rawDisk": {
  "source": "http://storage.googleapis.com/example-image/example-image.tar.gz"
  },
 "name": "IMAGE_NAME",
 "sourceType": "RAW",
 "imageEncryptionKey": {
   "kmsKeyName": "projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY"
   }
}

Replace the following:

Create a disk from a snapshot encrypted with CMEK

To create a new disk from an encrypted snapshot, do the following:

Console
  1. In the Google Cloud console, go to the Disks page.

    Go to Disks

  2. Click Create disk and enter the properties for the new disk.
  3. For Source type, select the snapshot or image you want to use.

  4. Optional: If you want to specify a new encryption key, for Encryption, specify the type of encryption key to use, and then provide the encryption key information.

    If you want to remove the customer managed or customer supplied encryption key, for Encryption, use the default value Google-managed encryption key.

  5. Continue with the disk creation process.

gcloud

Replace the following:

REST

Replace the following:

Attaching a boot disk encrypted with CMEK to a new VM Console

  1. In the Google Cloud console, go to the Create an instance page.

    Go to Create an instance

  2. Specify the VM details, and in the Boot disk section, click Change. Then, do the following:

    1. Click Existing disks.
    2. In the Disk list, select an existing disk to attach to the VM.
    3. Click Select.

  3. Continue with the VM creation process.

gcloud

To attach an encrypted disk when you create a new VM, use the gcloud compute instances create command. Use the --disk flag to specify the encrypted boot disk, as shown in the following example:

gcloud compute instances create VM_NAME \
  ...
  --disk name=DISK_NAME,boot=yes

Replace the following:

REST

Construct a POST request to the compute.instances.insert method. Use the disks property to specify the encrypted boot disk, as shown in the following example:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances
{
  ...
  "disks": [
    {
      "deviceName": "DISK_ALIAS",
      "source": "projects/PROJECT_ID/zones/ZONE/disks/DISK_NAME"
    }
  ]
}

Replace the following:

Remove your Cloud KMS encryption key from a Persistent Disk

You can decrypt the contents of an encrypted disk and create a new disk that uses Google Cloud default encryption instead. By default, Google Cloud encrypts all data at rest.

  1. Create a snapshot of the encrypted disk.
  2. Use the new encrypted snapshot to create a new persistent disk.

After you create the new Persistent Disk, it uses Google Cloud default encryption to help protect the disk contents. Any snapshots that you create from that disk must also use default encryption.

Rotate your Cloud KMS encryption key for a disk

Rotate the key that is used to encrypt the disk by creating a new disk that uses a new Cloud KMS key version. Rotating keys is a best practice to comply with standardized security practices. To rotate your keys, do the following:

  1. Rotate your Cloud KMS key.
  2. Create a snapshot of the encrypted disk.
  3. Use the new snapshot to create a new disk with the key rotated in the preceding step.
  4. Replace the disk attached to your VM that uses the old encryption key.

When you create the new disk, it uses the new key version for encryption. Any snapshots that you create from that disk use the latest primary key version.

When you rotate a key, data that was encrypted with previous key versions is not automatically re-encrypted. For more information, see Re-encrypting data. Rotating a key does not automatically disable or destroy an existing key version.

Disable or delete a CMEK

If you no longer need a CMEK or want to prevent its use, delete or disable the key. Deleting, disabling, or removing IAM permissions on a key is also referred to as revoking the key.

Note: There is a delay of up to an hour between when you disable or delete the key, during which it is still usable for encrypting and decrypting data. You may disable the Compute Engine Service Agent used to encrypt and decrypt keys in order to apply the effects of disabling or deleting a key more quickly. Note: If a disk was attached to a VM when you revoked the disk's encryption key, the disk is still accessible from the VM until the VM shuts down. To trigger the automatic shutdown of VMs that are attached to such disks, enable VM shutdown on key revocation. Impact of key revocation on encrypted resources

When you revoke an encryption key, resources that the key protects are affected as follows:

If you disable the key, you can reverse the preceding effects by enabling the key. If you delete the key, you cannot reverse the preceding effects.

Configure VM shutdown on Cloud KMS key revocation

You can configure your VM to shutdown automatically when you revoke the Cloud KMS key that is helping to protect a disk attached to the VM. You can revoke a key by disabling or deleting it. With this setting enabled, the VM shuts down within 7 hours of key revocation.

If you enable the key again, you can restart the VM with the attached disk that the key helps to protect. The VM does not automatically restart after you enable the key.

Console

To configure a VM to shutdown when a Cloud KMS key is revoked, do the following:

  1. Begin creating a VM that includes a disk that is protected by a Cloud KMS key.
  2. Open the Networking, disks, security, management, sole-tenancy menu.
  3. Expand the Management section.
  4. Under Customer Managed Encryption Key (CMEK) revocation policy, select Shut down.
gcloud

Use the gcloud compute instances create command to create a VM, and include --key-revocation-action-type=stop.

gcloud compute instances create VM_NAME \
  --image IMAGE \
  --key-revocation-action-type=stop
REST

Use the instances.insert method to create a VM, and set the property "keyRevocationActionType" to "STOP". The following example creates the VM from a public image.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances

{
  "machineType": "zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE",
  "name": "VM_NAME",
  "disks": [
    {
      "initializeParams": {
        "sourceImage": "projects/IMAGE_PROJECT/global/images/IMAGE"
      },
      "boot": true
    }
  ],
  "keyRevocationActionType": "STOP"
}

Alternatively, you can configure an instance template to create VMs that shut down on key revocation by using the Google Cloud CLI or REST.

Console

You can use an instance template to create VMs that shutdown when a Cloud KMS key is revoked.

  1. Begin creating a new instance template that includes a disk that is protected by a Cloud KMS key.
  2. Open the Networking, disks, security, management, sole-tenancy menu.
  3. Expand the Management section.
  4. Under Customer Managed Encryption Key (CMEK) revocation policy, select Shutdown.
gcloud

Create an instance template by using the gcloud compute instance-templates create command, and include --key-revocation-action-type=stop.

gcloud compute instance-templates create INSTANCE_TEMPLATE_NAME \
  --key-revocation-action-type=stop
REST

Construct a POST request to the instanceTemplates.insert method. In the request body, you must explicitly define all of the required configuration fields. If you want VMs created from this template to shut down on key revocation, specify "keyRevocationActionType":"STOP". For example, an instance template with the minimal required fields that will create VMs that shut down on key revocation looks like the following:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instanceTemplates

{
  "name": "example-template",
  "properties": {
  "machineType": "e2-standard-4",
  "networkInterfaces": [
    {
      "network": "global/networks/default",
      "accessConfigs": [
        {
          "name": "external-IP",
          "type": "ONE_TO_ONE_NAT"
        }
      ]
    }
  ],
  "disks":
  [
    {
      "type": "PERSISTENT",
      "boot": true,
      "mode": "READ_WRITE",
      "initializeParams":
      {
        "sourceImage": "projects/debian-cloud/global/images/family/debian-11"
      }
    }
  ],
  "keyRevocationActionType": "STOP"
  }
}

After you create a VM that is configured to shut down on Cloud KMS revocation, create and attach a Persistent Disk encrypted with a Cloud KMS key.

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4