GCP policy to enforce to use EKM (externally managed key) in KMS

Question

Anyone knows how can we enforce the use of EKM (externally managed key) in the GCP KMS? I would like to avoid using Google-generated keys in the KMS as per our company policy.

Thanks

Answer 1

External key manager (EKM) is the key manager used outside of Google Cloud to manage your keys. You can create and manage external keys either via the internet or via a Virtual Private Cloud (VPC). The key resides on the external system, and is never sent to Google.

You can store external keys in the following external key management partner systems:
Supported today:
Fortanix
Futurex
Thales
Virtru

With Cloud EKM, you can use keys that you manage within a supported external key management partner to protect data within Google Cloud. You can protect data at rest in supported CMEK integration services, or by calling the Cloud Key Management Service API directly.

For more information on EKM refer to the documentation google-kms-ekm.

EDIT-1

Below procedure to implement EKM:

1. First, you need to create or use an existing key in a supported external key management partner system. This key has a unique URI or key path.

2. Next, you can grant your Google Cloud project access to use the key, in the external key management partner system.

3. In your Google Cloud project, you create a Cloud EKM key, using the URI or key path for the externally-managed key.

You can also follow the step-by-step instructions to create a Cloud EKM key accessed via the internet or create a Cloud EKM key accessed via a VPC

EKM while creating VM:

Console -> Compute Engine -> VM Instances -> Create Instance -> Boot disk -> CHANGE -> SHOW ADVANCED CONFIGURATION -> Encryption -> choose the encryption management solution you want to use for the disk.

EKM while creating storage bucket:

Console -> Cloud Storage -> Create Bucket -> Choose how to protect object data -> Enable “customer managed encryption key” By default “Google-managed key” Encryption type will be used. The Cloud Console cannot be used to upload an object with a customer-supplied encryption key. Use gsutil or the client libraries instead.

For more information refer to the documentation cloud storage customer supplied encryption keys.

EDIT -2

Currently it is impossible to enforce EKM as an organization policy constraint.

There is a Feature Request on this similar requirement where the product team is working . You can track the issue here .

As a temporary workaround you can create a log-based alert or metric and filter the audit log with "kmsKeyName" keyword or exclude the keyword for non CMEK logs.

protoPayload.authenticationInfo.principalEmail="SA to filter" protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" "kmsKeyName".

Note that the query can be modified based on your use case.