A enterprise architecture team is defining data encryption standards across Google Cloud workloads to meet distinct compliance and operational mandates. Match each business encryption requirement to the appropriate Google Cloud key management mechanism.
- Regulatory mandate requiring physical key storage strictly outside Google Cloud infrastructure while using cloud services.Cloud EKM (External Key Manager)
- Compliance mandate requiring keys to be generated and stored inside FIPS 140-2 Level 3 validated hardware modules managed in the cloud.Cloud KMS with Cloud HSM (CMEK)
- Operational requirement to supply encryption key material transiently per API request without persisting the key in GCP.Customer-Supplied Encryption Keys (CSEK)
- Standard baseline security requirement where platform services automatically encrypt data at rest without additional configuration.Google-default encryption
Answer
Cloud EKM corresponds to physical key storage outside Google Cloud; Cloud KMS with Cloud HSM corresponds to FIPS 140-2 Level 3 cloud-hosted keys; CSEK corresponds to transient key delivery per API call; Google-default encryption corresponds to zero-configuration server-side encryption.
The mapping accurately pairs each encryption deployment model (Cloud EKM, Cloud KMS with Cloud HSM, CSEK, and Google-default encryption) to its specific operational characteristics, key custody boundary, and regulatory compliance features.
Step-by-Step Solution
Key Concept
Data Encryption & Key Management Options in Google Cloud