Create and obtaining a CMEK key

If you use customer-managed encryption keys (CMEK) to encrypt your Assured Workloads resources, this page shows you how to create and obtain those keys. Learn more about Assured Workloads encryption options.

Before you begin

1. Choose an encryption strategy.

   Note: Review Data encryption and encryption keys, to determine your encryption strategy.

2. Create an Assured Workloads folder for a control package that supports your requirements.

3. Select the project ID for the project that contains your Assured Workloads CMEK keys. If you chose IL4 or CJIS as a control package, then, by default, this project is created for you.

Note: When accessing a project within an Assured Workloads folder, you must acknowledge the Regulatory Intercept, which generates an audit log when accessing a regulated resource.

Create the key

Note: If you have already created a CMEK, you can skip key creation and go directly to Obtain your CMEK key resource ID.

To create the CMEK key, do the following:

1. In the Google Cloud console, go to the Key management page:

   Go to Key management

2. Select the Assured Workloads CMEK project. By default, this project ID starts with cmek-.

3. Click your key ring.

4. Click Create Key.

5. From the What type of key do you want to create? list, select Generated key.

6. In Key name enter the key name.

7. From the Protection level list, select Software.

8. From the Purpose list, select Symmetric encryption/decryption.

9. From the Rotation period list, select 90 days.

10. Optional: To add a label, do the following:

    1. Click Add a label.
    2. Enter a key in the Key text field.
    3. Enter a value in the Value text field.

11. Click Create.

Obtain your CMEK key resource ID

Note: You might need to contact your security administrator or Assured Workloads administrator to obtain the key resource ID.

1. In Google Cloud console, in the Project Selector, select the project ID for the project that contains your CMEK keys. By default, if Assured Workloads creates this project, it prepends the project ID cmek-.

2. In Security, go to the Key management page:

   Go to Key management

3. Under Key rings, click the key ring name.

4. In Key ring details, in the Keys tab, click the name of the key.

5. Click the More icon to the right of the key name.

6. Click Copy Resource Name.

   The resource string is formatted as follows:

    projects/SECURITY_PROJECT_ID/locations/LOCATION/keyRings/KEY_RING_NAME/cryptoKeys/KEY_NAME
   

What's next

• Learn about supporting compliance with key management.
• Learn about data encryption and encryption keys.