Cloud KMS best practices

Key access and key ring access are managed by organizing keys into key rings and projects, and by granting IAM roles on the keys, key rings, and projects. As you build out your cloud environment, follow the guidance in the following list for how to design your key resource hierarchy to reduce risk:

1. Create a dedicated project for Cloud KMS that is separate from workload projects.
2. Add key rings into the dedicated Cloud KMS project. Create key rings as needed to impose a separation of duties.
3. Monitor privileged admin operations: key deletion operations for out-of-band key creation are considered a privileged operation.
4. Review CMEK-related findings in Security Command Center.
5. Use encryption keys with the appropriate key strength and protection level for data sensitivity or classification. For example, for sensitive data, use keys with a higher strength. Additionally, use encryption keys with different protection levels for different data...