Encrypting data as it moves into the platform

Google Cloud encrypts data at rest and in transit by default using Google-managed encryption keys, with no configuration required. For data ingestion and processing pipelines, engineers can choose stronger control via Customer-Managed Encryption Keys (CMEK) through Cloud KMS, or full control via Customer-Supplied Encryption Keys (CSEK), depending on compliance and key-management needs.

1 · Learn the must-know

• 1By default, all data at rest in services like BigQuery, Cloud Storage, Pub/Sub, and Dataflow is encrypted using Google-managed keys with no user action needed.
• 2CMEK lets you use a key you create and manage in Cloud KMS to encrypt data in services such as BigQuery, Cloud Storage, Pub/Sub, and Dataflow, giving you control over key rotation, disabling, and destruction while Google still handles the underlying cryptographic operations.
• 3CSEK allows you to supply your own AES-256 key (not stored by Google) for services like Cloud Storage and Compute Engine, but Google does not manage or retain the key, so losing it means losing access to the data.
• 4Data in transit within Google's network and between services is encrypted automatically, and traffic leaving Google's network can be secured further via TLS or VPN/Interconnect with encryption.
• 5When using CMEK with Dataflow, the KMS key must be in the same region as the job, and the Dataflow service account needs the Cloud KMS CryptoKey Encrypter/Decrypter role on that key.
• 6A common exam gotcha: enabling CMEK does not change how you write queries or pipelines, encryption/decryption is transparent to the application, but IAM permissions on the KMS key are a frequent cause of pipeline failures if misconfigured.

2 · Check your understanding