What a key management service does for creating, rotating, and revoking keys
Cloud KMS is Google Cloud's centralized service for creating, managing, and controlling access to cryptographic keys used to encrypt data at rest across Google Cloud services. By default, Google encrypts all data at rest using Google-managed keys, but Cloud KMS lets organizations bring their own key management for compliance, auditing, and control requirements via Customer-Managed Encryption Keys (CMEK). Understanding when and why to use Cloud KMS is key to designing secure, compliant data pipelines on Google Cloud.
1 · Learn the must-know
- Google Cloud encrypts all data at rest by default using Google-managed encryption keys, even if you never touch Cloud KMS.
- Cloud KMS enables Customer-Managed Encryption Keys (CMEK), giving you control over key creation, rotation, and destruction while Google still manages the underlying infrastructure.
- Services like BigQuery, Cloud Storage, and Pub/Sub support CMEK integration, letting you specify a Cloud KMS key to encrypt data instead of relying solely on default Google-managed keys.
- Cloud KMS supports automatic key rotation on a schedule, and rotating a key does not re-encrypt existing data immediately: new data uses the new key version while old data remains decryptable via prior versions.
- Disabling or destroying a Cloud KMS key used for CMEK renders the associated encrypted data permanently inaccessible, so key lifecycle management directly impacts data availability.
- IAM permissions on Cloud KMS keys (e.g., roles/cloudkms.cryptoKeyEncrypterDecrypter) control who can use a key for encryption/decryption, separate from permissions on the data itself, enabling separation of duties.
2 · Check your understanding
A data practitioner is setting up a new BigQuery dataset that will store sensitive customer records. The security team requires that the organization retain full control over the encryption key, including the ability to disable or destroy it to immediately revoke access to the data, rather than relying on Google's default key management. What should the data practitioner do?
What you have tried across GCP ADP's objectives, not a readiness score.
Data Preparation and Ingestion~30% of the exam0 of 8 tried
Data Analysis and Presentation~27% of the exam0 of 12 tried
Data Pipeline Orchestration~18% of the exam0 of 9 tried
Data Management~25% of the exam0 of 12 tried
3 · Keep going
Ready for more? Take a weighted mock or try free practice questions.