Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://cloud.google.com/sql/docs/postgres/configure-cmek below:

Use customer-managed encryption keys (CMEK) | Cloud SQL for PostgreSQL

This page describes how to set up a service account and keys for customer-managed encryption keys, and how to create an instance that uses a manually-created customer-managed encryption key. To learn more about using customer-managed encryption keys with Cloud SQL, see Overview of customer-managed encryption keys.

1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

3. Make sure that billing is enabled for your Google Cloud project.

4. Install the gcloud CLI.

5. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

6. To initialize the gcloud CLI, run the following command:

   gcloud init

7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

8. Make sure that billing is enabled for your Google Cloud project.

9. Install the gcloud CLI.

10. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

11. To initialize the gcloud CLI, run the following command:

    gcloud init

12. Make sure you have the Cloud SQL Admin role on your user account.

    Go to the IAM page

13. Enable the Cloud Key Management Service API.

    Enable the API

14. Enable the Cloud SQL Admin API.

    Enable the API

1. gcloud and API users only: Create a service account for each project that requires customer-managed encryption keys.
2. Create a keyring and key, and set the location for each key. The location is the Google Cloud region.
3. gcloud and API users only: Grant the service account access to the key.
4. Make a note of the key ID (KMS_KEY_ID), key location (GCP_REGION), and keyring ID (KMS_KEYRING_ID).
5. Go to a project and create a Cloud SQL instance with the following options:
   1. The same location as the customer-managed encryption key
   2. The customer-managed key configuration
   3. The customer-managed encryption key ID

Your Cloud SQL instance is now enabled with CMEK.

You need to create a service account for each project that requires customer-managed encryption keys.

To allow a user to manage service accounts, grant one of the following roles:

• Service Account User (roles/iam.serviceAccountUser): Includes permissions to list service accounts, get details about a service account, and impersonate a service account.
• Service Account Admin (roles/iam.serviceAccountAdmin): Includes permissions to list service accounts and get details about a service account. Also includes permissions to create, update, and delete service accounts, and to view or change the Cloud SQL for PostgreSQL policy on a service account.

Currently, you can only use gcloud CLI commands to create the type of service account you need for customer-managed encryption keys. If you are using the Console, Cloud SQL automatically creates this service account for you.

gcloud beta services identity create \
--service=sqladmin.googleapis.com \
--project=PROJECT_ID

To create a service account, use a Terraform resource.

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

1. Launch Cloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Each Terraform configuration file must have its own directory (also called a root module).

1. In Cloud Shell, create a directory and a new file within that directory. The filename must have the .tf extension—for example main.tf. In this tutorial, the file is referred to as main.tf.

   mkdir DIRECTORY && cd DIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly created main.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the -upgrade option:

   terraform init -upgrade

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

The previous command returns a service account name. You use this service account name during the procedure in Granting the service account access to the key.

You can create the key in the same Google Cloud project as the Cloud SQL instance or in a separate user project. The Cloud KMS key ring location must match the region where you want to create Cloud SQL instance. A multi-region or global region key will not work. The Cloud SQL instance create request fails if the regions don't match.

To create a Cloud KMS key:

1. In the Google Cloud console, go to the Key management page.

   Go to Key management

2. Click Create key ring.
3. Add a Key ring name. Note this name because you need it when granting the service account access to the key.
4. Add a Key ring location.
5. Click Create. The Create key page opens.
6. Add a Key name.
7. For Purpose, select Symmetric encrypt/decrypt.
8. Select a Rotation period and Starting on date.
9. Click Create.
10. On the Keys table, click the three dots in the last column, and select Copy Resource ID or write it down. This is the KMS_KEY_ID. You need the KMS_KEY_ID when granting the key access to the service account.

1. Create a new key ring.

   gcloud kms keyrings create KMS_KEYRING_ID \
   --location=GCP_REGION
     

   Write down this name because you need it when granting the key access to the service account.
2. Create a key on the key ring.

   gcloud kms keys create KMS_KEY_ID \
   --location=GCP_REGION \
   --keyring=KMS_KEYRING_ID \
   --purpose=encryption
     

   Write down this name because you need it when granting the key access to the service account.

To create a keyring, use a Terraform resource.

To create a key, use a Terraform resource.

Apply the Terraform configuration:

terraform apply

When creating the Cloud SQL instance with CMEK, you only need to perform this procedure if you are using gcloud or the API. You can perform this procedure if you run into permission issues after the instance is created.

To grant the service account access:

1. In the Google Cloud console, go to the Key management page.

   Go to Key management

2. To select the project hosting the key, use the project selector.
3. Click the name of the key ring.
4. Click the name of the key.
5. Click the Permissions tab.
6. To open the panel, click Grant access.
7. Enter the service account as the principal and select "Cloud KMS CryptoKey Encrypter/Decrypter" as the role.
8. Click Save.

Alternatively, you can also grant it in the project IAM page.

GO TO THE PROJECT IAM PAGE

gcloud kms keys add-iam-policy-binding KMS_KEY_ID \
--location=GCP_REGION \
--keyring=KMS_KEYRING_ID \
--member=serviceAccount:service-PROJECT_NUMBER@gcp-sa-cloud-sql.iam.gserviceaccount.com \
--role=roles/cloudkms.cryptoKeyEncrypterDecrypter

To grant access to the key, use a Terraform resource.

Apply the Terraform configuration:

terraform apply

To create an instance with customer-managed encryption keys:

1. In the Google Cloud console, go to the Cloud SQL Instances page.

   Go to Cloud SQL Instances

2. Click Create instance.
3. Choose the database engine.
4. Enter a name for the instance. Do not include sensitive or personally identifiable information in your instance name; it is externally visible. You do not need to include the project ID in the instance name. This is created automatically where appropriate (for example, in the log files).
5. Enter the password for the 'root'@'%' user.
6. Set the region for your instance. Place your instance in the same region as the resources that access it. In most cases, you don't need to specify a zone.
7. In the Configuration options section, select all your configurations options until you reach Machine type and storage.
8. Expand Machine type and storage.
9. In the Encryption section, select Customer-managed key.
10. Select the KMS key from the dropdown menu or manually enter the KMS_KEY_ID. Only KMS keys in the same project and region as the instance are displayed. The primary key version of the key is used, so if a key version is provided in the key name, then it's trimmed. To choose a KMS key belonging to a different project but in the same region, select Don't see your key? Enter key resource ID and enter the KMS_KEY_ID captured earlier.
11. If the service account does not have permission to encrypt/decrypt with the selected key, a message displays. If this happens, click Grant to grant the service account the roles/cloudkms.cryptoKeyEncrypterDecrypter> IAM role on the selected KMS key.
12. Once the configuration options are selected, click Create.
13. You see a message explaining the implications of using customer-managed encryption key. Read and acknowledge it to proceed further with instance creation.

gcloud sql instances create INSTANCE_NAME \
--project=PROJECT_ID \
--disk-encryption-key=KMS_KEY_ID \
--database-version=VERSION \
--cpu=NUMBER_CPUS \
--memory=MEMORY_SIZE \
--region=REGION \
--root-password=INSERT-PASSWORD-HERE

To create an instance with CMEK, use a Terraform resource.

To delete your changes, do the following:

1. To disable deletion protection, in your Terraform configuration file set the deletion_protection argument to false.

   deletion_protection =  "false"

2. Apply the updated Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

1. Remove resources previously applied with your Terraform configuration by running the following command and entering yes at the prompt:

   terraform destroy

Before using any of the request data, make the following replacements:

• project-id: The project ID
• instance-id: The instance ID
• region: The region
• database-version: Emum version string (for example, POSTGRES_12)
• kms-resource-id: The ID you received from creating a key.

HTTP method and URL:

POST https://sqladmin.googleapis.com/v1/projects/project-id/instances

Request JSON body:

{
  "name":"instance-id",
  "region":"region",
  "databaseVersion": "database-version",
  "diskEncryptionConfiguration" :
  {
      "kmsKeyName" : "kms-resource-id"
  },
  "settings":
  {
     "backupConfiguration":
      {
         "pointInTimeRecoveryEnabled": true,
         "enabled":true
      }
   }
}

To send your request, expand one of these options:

Save the request body in a file named request.json, and execute the following command:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances"

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `

    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-16T02:32:12.281Z",
  "operationType": "UPDATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

Before using any of the request data, make the following replacements:

• project-id: The project ID
• instance-id: The instance ID
• region: The region
• database-version: Emum version string (for example, POSTGRES_12)
• kms-resource-id: The ID you received from creating a key.

HTTP method and URL:

POST https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances

Request JSON body:

{
  "name":"instance-id",
  "region":"region",
  "databaseVersion": "database-version",
  "diskEncryptionConfiguration" :
  {
      "kmsKeyName" : "kms-resource-id"
  },
  "settings":
  {
     "backupConfiguration":
      {
         "pointInTimeRecoveryEnabled": true,
         "enabled":true
      }
   }
}

To send your request, expand one of these options:

Save the request body in a file named request.json, and execute the following command:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances"

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `

    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-16T02:32:12.281Z",
  "operationType": "UPDATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

When you create a backup of a Cloud SQL instance, the backup is encrypted with the same primary key version as the primary instance's customer-managed key. If your instance uses a CMEK created by Cloud KMS Autokey, the backup still uses the same key as the primary instance; Autokey doesn't create keys for backups.

See Creating and managing on-demand and automatic backups.

You will see a message on the Create a backup form that says: "Your backup will be encrypted with the primary version of this instance's customer-managed encryption key. If anyone destroys or disables this key version, all backup data encrypted using that key version will be permanently lost. You can check the primary version for the key in Cloud KMS."

On the backups page, the list of backups enabled with customer-managed encryption keys have two extra columns. One column that shows that the backup is for a CMEK-enabled instance, and a column that displays the key version used to encrypt the backup.

When you create a read replica of a Cloud SQL instance in the same region, it inherits the same customer-managed encryption key as the parent instance. If you create a read replica in a different region, you are given a new list of customer-managed encryption keys to select from. Each region uses its own set of keys.

See Creating read replicas.

On the Create read replica page, you see the following information:

1. The Encryption shows customer-managed.
2. The Encryption key for the replica is displayed.
3. There is a message saying "Your replica will be encrypted with the primary instance's customer-managed key. If anyone destroys this key, all data encrypted with it will be permanently lost."

For a cross-region replica, you see the following message:

"Your cross-region replica will be encrypted with the selected customer-managed key. If anyone destroys this key, all data encrypted with it will be permanently lost."

When you create a clone of Cloud SQL instance, it inherits the same customer-managed encryption key as the one used to encrypt the source instance.

See Cloning instances.

On the Create clone page, you see the following information:

1. The Encryption shows customer-managed.
2. The Encryption key for the clone is displayed.
3. There is a message saying "Your clone will be encrypted with the source instance's customer-managed key. If anyone destroys this key, all data encrypted with it will be permanently lost."

Once you successfully create a Cloud SQL instance, you can look at the instance list or the instance overview page to see that it was created using a customer-managed encryption key. The details also show the key that was used to create the instance.

1. In the Google Cloud console, go to the Cloud SQL Instances page.

   Go to Cloud SQL Instances

2. In the Instances list, scroll to the right until you see the Encryption column. In this column, you see Google-managed and Customer-managed.
3. Click an instance name to open its Overview page. The customer-managed encryption key is listed in the Configuration pane.

You can re-encrypt your existing Cloud SQL instances and replicas with the latest primary key version. For more information about re-encrypting your existing CMEK-enabled instance or replica, see About keys.

• To re-encrypt your instance or replica with a new version, you'll need the new primary key version. If you need a new key version for your instances, you'll need to rotate your key using Cloud Key Management Service. To rotate your primary key, see Rotate a key.

• After your key rotation is complete, wait for the primary key change to be propagated before you re-encrypt your instances. If your key version change isn't consistent, your instance will continue to use the old key version after re-encryption. For more information, see Consistency of key versions.

After key rotation is complete, re-encrypt your existing CMEK-enabled instance or replica.

1. In the Google Cloud console, go to the Cloud SQL Instances page.

   Go to Cloud SQL Instances

2. To open the Overview page of an instance, click the instance name.
3. In the Configuration section, click Re-encrypt instance.
4. In the dialog that appears, confirm your selection by clicking Re-encrypt.

To re-encrypt the instance or replica, run the following command:

gcloud sql instances reencrypt INSTANCE_NAME

To re-encrypt your instance or replica with your new key, run the following command:

    POST https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID/reencrypt

Before using any of the request data, make the following replacements:

• PROJECT_ID: The project ID
• INSTANCE_ID: The instance ID

HTTP method and URL:

POST https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID/reencrypt

To send your request, expand one of these options:

Execute the following command:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d "" \
     "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID/reencrypt"

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `

    -Method POST `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID/reencrypt" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2023-06-28T21:19:09.503Z",
  "operationType": "REENCRYPT",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

    POST https://sqladmin.googleapis.com/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID/reencrypt

Before using any of the request data, make the following replacements:

• PROJECT_ID: The project ID
• INSTANCE_ID: The instance ID

HTTP method and URL:

POST https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID/reencrypt

To send your request, expand one of these options:

Execute the following command:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d "" \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID/reencrypt"

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `

    -Method POST `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID/reencrypt" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2023-06-28T21:22:13.663Z",
  "operationType": "REENCRYPT",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

When you re-encrypt a primary instance with a new primary key version, Cloud SQL automatically creates an on-demand backup called the re-encryption backup.

In your list of backups for your Cloud SQL instance, the re-encryption backup is listed as type on-demand and labeled with backup created automatically for data before CMEK re-encryption.

As with other on-demand backups, re-encryption backups persist until you delete them or delete the instance.

When you re-encrypt an instance, keep note of the following limitations:

• You can't perform any other admin operations on the instance while the re-encryption operation is going on.
• The re-encryption operation triggers a downtime that depends on the instance or replica size.
• Replicas of an instance aren't re-encrypted when an instance is en-encrypted. You need to re-encrypt each replica separately.
• Backups aren't automatically re-encrypted with the new key version when you re-encrypt your instance. To restore the backup or point-in-time-recovery to a time after the backup is taken, you'll need to keep the Cloud KMS key version the backup is encrypted with.
• Backups created after the Cloud KMS key that the instance is encrypted with is rotated will use the primary key version of that key automatically, even if the instance isn't encrypted with this key version.

For troubleshooting, see the Re-encryption troubleshooting table.

To protect data in Cloud SQL instances, you can use keys that you manage within a supported external key management partner. For more information, see Cloud External Key Manager, including the Considerations section.

When you are ready to create a Cloud EKM key, see Managing Cloud EKM keys. After a key is created, provide the key name when you create a Cloud SQL instance.

You can use Key Access Justifications (KAJ) as part of Cloud EKM. KAJ enables you to view the reason for each Cloud EKM request. Additionally, based on the justification provided, you can automatically approve or deny a request. To learn more, see the Overview.

Thus, KAJ provides extra control over your data by providing a justification for each attempt to decrypt the data.

Google lacks control over the availability of keys in an external key management partner system.

See the following topics:

• Disable an enabled key version
• Enable a disabled key version

This section describes things to try when you get an error message while setting up or using CMEK-enabled instances.

Cloud SQL administrator operations, such as create, clone, or update, might fail due to Cloud KMS errors, and missing roles or permissions. Common reasons for failure include a missing Cloud KMS key version, a disabled or destroyed Cloud KMS key version, insufficient IAM permissions to access the Cloud KMS key version, or the Cloud KMS key version is in a different region than the Cloud SQL instance. Use the following troubleshooting table to diagnose and resolve common problems.

GO TO THE SERVICE ACCOUNTS PAGE.

GO TO THE IAM ACCOUNTS PAGE

GO TO THE CRYPTO KEYS PAGE

GO TO THE IAM ACCOUNTS PAGE

Re-enable the Cloud KMS key version:

GO TO THE CRYPTO KEYS PAGE

In the Google Cloud project that hosts the key, confirm the cloudkms.cryptoKeyEncrypterDecrypter role is granted to your user or service account:

GO TO THE IAM ACCOUNTS PAGE

• Configure access to the instance.
• Connect to the instance with a client.
• Create a database on the instance.
• Import data into the instance.
• Create users on the instance.
• Learn more about instance settings.
• Learn how to add key access justifications to your keys.

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4