Description

Ensure that Cloud SQL instances use a customer-managed encryption key (CMEK) from Cloud Key Management Service (KMS), instead of relying solely on Google-managed default encryption, for encrypting data at rest.

Rationale

Cloud SQL encrypts all data at rest by default using Google-managed keys, but organizations with strict compliance, data sovereignty, or key-lifecycle requirements often need direct control over the encryption key, including the ability to rotate, disable, or destroy it independently of Google. Using CMEK ensures that the organization retains control over the cryptographic key material and can revoke access to data at rest by disabling or destroying the key, which is important for regulatory frameworks that require demonstrable control over encryption keys.

Impact

  • Gives the organization direct control over the lifecycle of the encryption key protecting database data at rest

  • Enables the ability to revoke access to data by disabling or destroying the KMS key

  • Supports compliance requirements that mandate customer-managed encryption keys

  • Requires careful key management, since destroying the CMEK key renders the instance's data permanently inaccessible

Default Value

By default, new Cloud SQL instances are encrypted at rest using Google-managed encryption keys; CMEK must be explicitly configured at instance creation time.

Pre-Requisites

  • A Cloud KMS key ring and key created in the same region as the Cloud SQL instance

  • The Cloud SQL service agent granted the Cloud KMS CryptoKey Encrypter/Decrypter role on the key

  • IAM permissions to create Cloud SQL instances and manage Cloud KMS keys

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud SQL and select the instance to review.

  4. Open the Configuration or Overview section and review the Data Protection / Customer-managed encryption key details.

  5. Verify that the instance shows a customer-managed key rather than Google-managed encryption.

  6. Verify the referenced Cloud KMS key exists, is enabled, and the Cloud SQL service agent has the required Encrypter/Decrypter permission on it.

  7. If the instance uses Google-managed encryption instead of CMEK, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Navigate to Security > Key Management (Cloud KMS) and create a key ring and key in the same region as the target Cloud SQL instance, if one does not already exist.

  3. Grant the Cloud SQL service agent ([email protected]) the Cloud KMS CryptoKey Encrypter/Decrypter role on the key.

  4. Note that CMEK can only be set at instance creation time; it cannot be applied retroactively to an existing instance.

  5. Navigate to Cloud SQL > Create instance.

  6. Configure the instance settings, and under Data Protection / Customer-managed encryption, select Customer-managed and choose the key created above.

  7. Complete the instance creation.

  8. If an existing instance must be converted to CMEK, plan a migration: create a new CMEK-encrypted instance, migrate the data (for example, via export/import or Cloud SQL replication), redirect application connections, and decommission the old instance.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Navigate to Cloud SQL and identify the CMEK-encrypted instance.

  3. Because the encryption key cannot be changed on an existing instance, reverting to Google-managed encryption requires creating a new instance without CMEK and migrating data back to it.

  4. Export the data from the CMEK-encrypted instance and import it into a newly created Google-managed-encryption instance.

  5. Redirect application connections to the new instance.

  6. Decommission the CMEK-encrypted instance once the migration is verified.

Reference