By default, Google Cloud automatically encrypts data at rest using encryption keys managed by Google. If you have specific compliance or regulatory requirements related to the keys that protect your data, you can use customer-managed encryption keys (CMEK).
With CMEK, you can protect your Backup and DR data using a cryptographic key that you control through Cloud Key Management Service. When you use CMEK, you manage the key in Cloud Key Management Service and control access by managing Identity and Access Management permissions on the key. If you temporarily disable or permanently destroy the CMEK key, the data protected by that key becomes inaccessible.
How Backup and DR uses CMEK
Backup and DR protects backups using CMEK in one of two ways, depending on the workload type:
Vault-level CMEK: uses the Cloud Key Management Service key configured directly on the backup vault to encrypt the backup data.
Source-level CMEK: inherits and uses the encryption key of the source workload, preserving its existing CMEK protection.
Configuring a Backup vault container with CMEK
A backup vault is a secure, isolated logical container used to store and manage your backups. When you configure a backup vault with a CMEK key, Backup and DR uses that key to protect the backups stored inside the vault.
For some resource types, a CMEK-enabled backup vault encrypts backup data using the vault's Cloud Key Management Service key.
For example, if one or more disks attached to a Compute Engine instance use CMEK, Backup and DR considers the instance CMEK-protected. You must back up such instances to a CMEK-enabled backup vault. If all disks attached to the instance use Google-managed encryption, then in the Google Cloud console, you must store backups in a non-CMEK backup vault. However, if you use the Google Cloud CLI, API, or Terraform, you can configure backups for an instance with Google-managed encryption to use a CMEK-enabled backup vault. When you store a backup in a CMEK-enabled backup vault, the vault's Cloud Key Management Service key encrypts the backup data, regardless of the instance's disk encryption status.
Inherited settings
Backups inherit either the source workload key or uses the backup vault's CMEK key to protect backups using CMEK depending on the resource type.
Encryption using the source resource CMEK
For workload types that don't allow backups to use a different key from the source workload, Backup and DR preserves the source resource's encryption by using the source workload's own encryption key to protect backups.
This applies to the following workload types:
Compute Engine disk and Persistent Disk backups: If the source workloads use CMEK, their backups also use the same CMEK key. If they use Google-managed encryption, their backups also use Google-managed encryption. You must store these backups in a backup vault that is not configured with CMEK.
Cloud SQL instance backups: Backup and DR uses the original database instance's key to encrypt the backup.
To perform these operations and access the source resource's Cloud Key Management Service key, Backup and DR uses its service agent. You must grant the service agent the necessary IAM permissions on the source key.
The following table summarizes which encryption key is used for backups of different workload types:
| Workload | Encryption key used for backup | CMEK support status |
|---|---|---|
| Compute Engine instance | Backup vault CMEK key | Supported |
| Compute Engine disk | The source disk encryption key | Supported |
| Cloud SQL | The source instance's encryption key | Supported |
| AlloyDB cluster | - | Not supported |
| Filestore instance | - | Not supported |
| Google Cloud VMware Engine, Oracle database, and SQL Server database | - | Not supported |
Limitations
Backup and DR support for CMEK has the following limitations:
CMEK protection is supported for Compute Engine instance, Persistent Disk, and Cloud SQL backups stored in backup vaults.
You can configure CMEK on a backup vault only at creation time.
You cannot enable, disable, or change CMEK on an existing backup vault.
The Cloud Key Management Service key must be in the same location as the backup vault. A backup vault in a region must use a key from the same region. A multi-regional backup vault must use a key from the same multi-region.
Cross-region backups must use a key from the same region as the backup vault.
Cross-region restores of CMEK-protected Compute Engine instances are only supported through the Google Cloud CLI, API or Terraform. For instructions, see Restoring from a CMEK-enabled backup vault.
Backup and DR doesn't support customer-supplied encryption keys (CSEK).
The default backup vault and default backup plan use Google-managed encryption. To use CMEK, you must create a new backup vault and explicitly enable CMEK.
Key revocation and enhanced backups
For enhanced backups, the source workload and the backup vault use different service agents to access the CMEK key.
Cloud SQL service agent: if you revoke access to the CMEK key from the Cloud SQL service agent, the source instance becomes suspended.
Backup and DR service agent: existing enhanced backups remain restorable as long as the Backup and DR service agent retains access to the CMEK key. Revoking access from the Backup and DR service agent prevents new backups from being created and prevents existing backups from being restored.
Pricing
Backup and DR does not charge any additional fees for using CMEK. However, you are charged for the use of your keys in Cloud Key Management Service. For more information, see Cloud Key Management Service pricing.
What's next
- Learn how to use CMEK with Backup and DR Service