CMEKs for Secret Manager
By default, secrets are encrypted with Google default encryption. However, some highly regulated customers require control of keys, so Secret Manager supports customer-managed encryption keys (CMEKs) (within Cloud KMS) for encrypting:
Note
However, if you disable or permanently destroy the CMEK, the secret encrypted with that key cannot be decrypted.
- Secret payloads are encrypted by Google-managed keys before being written to persistent storage with no additional configuration required.
- Secret Manager encrypts data with a unique data encryption key (DEK) before writing it to persistent storage in a specific location. The Secret Manager service owns a replica-specific key called a key encryption key (KEK), which is used to encrypt the DEK. This is commonly referred to as envelope encryption.
- The CMEK is a symmetric key that you control within Cloud KMS when using CMEKs with Secret Manager. The CMEK must be stored in the same GCP region...
