A company deploying Compute Engine virtual machines requires that persistent disks are encrypted using raw 256-bit AES encryption keys generated in their local data center. Security policy dictates that Google Cloud must never store these key strings at rest on Google infrastructure under any circumstances, and the keys must be supplied during disk creation and attach operations. Which encryption mechanism meets these requirements?
- Customer-Supplied Encryption Keys (CSEK)Answer
- BCustomer-Managed Encryption Keys (CMEK) stored in Cloud KMS
- CGoogle-default encryption using primitive Owner roles for access control
- DGoogle-default encryption protected by VPC Service Controls
Answer
Customer-Supplied Encryption Keys (CSEK) meet the requirement because the customer supplies their own raw 256-bit AES keys with each API call, and Google Cloud never persists these keys to disk.
Customer-Supplied Encryption Keys (CSEK) allow organizations to provide raw AES-256 keys directly to Compute Engine when creating or attaching disks. Google uses the key in memory to perform encryption/decryption operations and discards it immediately without writing the key material to persistent storage.
Step-by-Step Solution
Key Concept
Customer-Supplied Encryption Keys (CSEK) vs Customer-Managed Encryption Keys (CMEK)