About Cloud KMS
What is Cloud KMS? What can it do?
Cloud Key Management Service (Cloud KMS) is a cloud-hosted key management service that lets you manage encryption for your cloud services the same way you do on-premises. You can generate, use, rotate, and destroy cryptographic keys. Cloud KMS is integrated with Identity and Access Management (IAM) and Cloud Audit Logs so you can manage permissions on individual keys, and monitor how they are used.
Can I store secrets?
Cloud KMS stores keys and metadata about keys, and does not have a general data storage API. Secret Manager is recommended for storing and accessing sensitive data for use in Google Cloud.
Is there an SLA?
Yes, see Cloud KMS Service Level Agreement.
How do I provide product feedback?
Contact the engineering team at cloudkms-feedback@google.com.
How do I provide documentation feedback?
While viewing Cloud KMS documentation, click Send feedback near the top right of the page. This will open a feedback form.
If I need help, what are my options?
We invite our users to post their questions on Stack Overflow. Along with the active Stack Overflow community, our team actively monitors Stack Overflow posts and answers questions with the tag google-cloud-kms.
We also offer various levels of support depending on your needs. For additional support options, see our Google Cloud Support Packages.
Does Cloud KMS have any quotas?
Yes. For information about quotas, including viewing or requesting additional quotas, see Cloud KMS quotas.
There is no limit on the number of keys, key rings, or key versions. Additionally, there is no limit on the number of keys per key ring and key versions per key.
In what countries can I use Cloud KMS?
You can use Cloud KMS in any country where Google Cloud services are supported.
Keys
What kinds of key does Cloud KMS generate?
See Key purposes and algorithms.
Are keys stored in an HSM?
Keys with protection level HSM are stored in a hardware security module
(HSM).
Keys with protection level SOFTWARE are stored in software.
An HSM-backed key never persists outside of an HSM.
To what standards do the keys comply?
Keys generated in Cloud KMS and the cryptographic operations performed with those keys comply with Federal Information Processing Standard (FIPS) publication Security requirements for cryptographic modules 140-2.
Keys generated with protection level
SOFTWARE, and the cryptographic operations performed with them, comply with FIPS 140-2 Level 1.Keys generated with protection level
HSM, and the cryptographic operations performed with them, comply with FIPS 140-2 Level 3.For keys that are generated outside of Cloud KMS and then imported, customers who have FIPS requirements are responsible for ensuring that their keys are generated in a FIPS-compliant fashion.
How is key material generated?
Cloud KMS software-protected keys are generated using Google’s common cryptographic library using a random number generator (RNG) built by Google. HSM-protected keys are generated securely by the HSM, which was validated to meet FIPS 140-2 Level 3.
Which library is used to generate key material?
Cloud KMS keys are generated using Google’s common cryptographic library which implements cryptographic algorithms using BoringSSL. For more information, see Google’s common cryptographic library.
Are keys constrained to a geographic location?
Keys belong to a region, but are not constrained to that region. For more information, see Cloud KMS locations.
Can I auto-delete keys?
No.
Can I auto-rotate keys?
For keys used for symmetric encryption, yes. See Automatic rotation: Setting the rotation period for a key.
For keys used for asymmetric encryption or asymmetric signing, no. To learn more, see Considerations for asymmetric key rotation.
Does key rotation re-encrypt data? If not, why?
Key rotation does not automatically re-encrypt data. When you decrypt data, Cloud KMS knows which key version to use for the decryption. As long as a key version is not disabled or destroyed, Cloud KMS can decrypt data protected with that key.
Why can't I delete keys or key rings?
To prevent resource name collisions, key ring and key resources CANNOT be deleted. Key versions also cannot be deleted, but key version material can be destroyed so that the resources can no longer be used. For more information, see Lifetime of objects. Billing is based on the number of active key versions; if you destroy all active key version material, there is no charge for the key rings, keys, and key versions which remain.
Can I export keys?
No. Keys are not exportable from Cloud KMS by design. All encryption and decryption with these keys must be done within Cloud KMS. This helps prevent leaks and misuse, and enables Cloud KMS to emit an audit trail when keys are used.
Can I import keys?
Yes. You can import only into keys with protection level HSM or SOFTWARE.
For more information, see Importing a key.
Separately from Cloud KMS, the following products support Customer-Supplied Encryption Key (CSEK) functionality.
| Product | CSEK topic |
|---|---|
| Compute Engine | Encrypting Disks with Customer-Supplied Encryption Keys |
| Cloud Storage | Using Customer-Supplied Encryption Keys |
How long after I destroy a key version can I get it back?
After you schedule a key version for destruction, you have a default time period of 30 days before the key version is actually destroyed. The time period before a key version is destroyed is configurable. During that time, if needed you can restore the key version.
Can I change the period before a scheduled key is destroyed?
Yes, you can configure the duration of time before the key is destroyed. Note that you can set the duration only at the time of key creation.
When I make changes to a key, how quickly do the changes take effect?
Some operations to Cloud KMS resources are strongly consistent, while others are eventually consistent and may take up to 3 hours to propagate. For more details, see Cloud KMS resource consistency.
Why is my key in PENDING_GENERATION state?
Due to the CPU cost of generating key material, creation of an asymmetric signing or asymmetric encryption key version may take a few minutes. Key versions that are protected by a hardware security module (HSM) also take some time. When a newly created key version is ready, its state will automatically change to ENABLED.
Authorization and authentication
How do I authenticate to the Cloud KMS API?
How clients authenticate may vary a bit depending on the platform on which the code is running. For details, see Accessing the API.
What IAM roles should I use?
To enforce the principle of least privilege, ensure that the user and service accounts in your organization have only the permissions essential to performing their intended functions. For more information, see Separation of duties.
How quickly is an IAM permission removed?
Removal of a permission should be in effect in less than one hour.
Miscellaneous
What is additional authenticated data, and when would I use it?
Additional authenticated data (AAD) is any string that you pass to Cloud KMS as part of an encrypt or decrypt request. It is used as an integrity check and can help protect your data from a confused deputy attack. For more information, see Additional authenticated data.
Are data access logs enabled by default? How do I enable data access logs?
Data access logs are not enabled by default. For more information, see Enabling data access logs.
How do Cloud KMS keys relate to service account keys?
Service account keys are used for service-to-service authentication within Google Cloud. Service account keys are unrelated to Cloud KMS keys.
How do Cloud KMS keys relate to API keys?
An API key is a simple encrypted string that can be used when calling certain APIs that don't need access to private user data. API keys track API requests associated with your project for quota and billing. API keys are unrelated to Cloud KMS keys.
Do you have additional details about the HSMs used by Cloud HSM?
All HSM devices are manufactured by Marvell (formerly Cavium). The FIPS certificate for the devices is on the NIST website.