Cloud KMS / Cloud HSM / EKM Complete Guide: CMEK, Key Rotation, and FIPS on GCP

Cloud KMS is GCP's centralized key management service for the encryption keys that protect your data. Combined with Cloud HSM (FIPS 140-2 Level 3 certified hardware) and Cloud EKM (external HSM integration), it covers everything from regulated industries to zero-trust key management.

Three Key Management Models

CMEK / CSEK / Google Default

• Google Default Encryption: Every GCP service is encrypted by default with Google-managed keys
• CMEK (Customer-managed Encryption Key): The customer manages the keys in KMS and services consume them
• CSEK (Customer-supplied Encryption Key): The customer supplies the key on every call (Cloud Storage and Compute only; operationally hard)

Key Hierarchy

• KeyRing: Logical grouping of keys, scoped to a region
• CryptoKey: Individual key, typically one per use case
• CryptoKeyVersion: Versions of the key; a new version is created on every rotation

Key Operations

# Create the KeyRing
gcloud kms keyrings create my-keyring \
  --location=asia-northeast1

# Create the CryptoKey (symmetric)
gcloud kms keys create my-key \
  --keyring=my-keyring --location=asia-northeast1 \
  --purpose=encryption --rotation-period=90d \
  --next-rotation-time=2026-09-01T00:00:00Z

# Encrypt
gcloud kms encrypt --key=my-key --keyring=my-keyring \
  --location=asia-northeast1 \
  --plaintext-file=secret.txt --ciphertext-file=secret.enc

# Create a GCS bucket with CMEK
gcloud storage buckets create gs://my-bucket \
  --default-encryption-key=projects/PROJECT/locations/asia-northeast1/keyRings/my-keyring/cryptoKeys/my-key

Key Rotation

• Set rotation_period on the CryptoKey (e.g., 90 days)
• A new CryptoKeyVersion automatically becomes the primary
• Older versions can be Disabled or Destroyed, but keeping them around for decryption is recommended
• There is a 24-hour grace period before final destruction (soft delete)

Key IAM Roles

• roles/cloudkms.admin: Full administrative access
• roles/cloudkms.cryptoKeyEncrypterDecrypter: Encrypt and decrypt
• roles/cloudkms.cryptoKeyEncrypter: Encrypt only
• roles/cloudkms.cryptoKeyDecrypter: Decrypt only
• roles/cloudkms.publicKeyViewer: View public keys

Pricing Examples

Comparison with Other Clouds

Confidential Computing Integration

• Confidential VM encrypts memory using AMD SEV or Intel TDX
• Confidential GKE Nodes keep Pods encrypted while they run
• Encryption at rest, in transit, and in use — all three at once
• Critical for regulated industries: healthcare, finance, and the public sector

Best Practices

• Separate KeyRings per environment (Prod / Dev)
• Keep at least one previous key version Disabled (not destroyed) for decryption
• Use VPC Service Controls to keep the KMS API inside a perimeter
• Log every key operation via Audit Logs (enable Data Access Logs)
• Verify the key version at application startup
• For regulated workloads, use Cloud HSM or Cloud EKM

Google Cloud is a trademark of Google LLC. For the latest information, see the official Cloud KMS documentation.