Cloud External Key Manager

This page provides an overview of Cloud External Key Manager (Cloud EKM).

Terminology

  • External key manager (EKM)

    The key manager used outside of Google Cloud to manage your keys.

  • Cloud External Key Manager (Cloud EKM)

    A Google Cloud service for using your external keys that are managed within a supported EKM.

  • Cloud EKM through the internet

    A version of Cloud EKM where Google Cloud communicates with your external key manager over the internet.

  • Cloud EKM through a VPC

    A version of Cloud EKM where Google Cloud communicates with your external key manager over a Virtual Private Cloud (VPC). For more information, see VPC network overview.

  • EKM key management from Cloud KMS

    When using Cloud EKM through a VPC with an external key management partner that supports the Cloud EKM control plane, you can use the Cloud KMS EKM management mode to simplify the process of maintaining external keys in your external key management partner and in Cloud EKM. For more information, see Coordinated external keys and EKM key management from Cloud KMS on this page.

  • Crypto space

    A container for your resources within your external key management partner. Your crypto space is identified by a unique crypto space path. The format of the crypto space path varies by external key management partner—for example, v0/cryptospaces/YOUR_UNIQUE_PATH.

  • Partner-managed EKM

    An arrangement where your EKM is managed for you by a trusted partner. For more information, see Partner-managed EKM on this page.

  • Key Access Justifications

    When you use Cloud EKM with Key Access Justifications, each request to your external key management partner includes a field that identifies the reason for each request. You can configure your external key management partner to allow or deny requests based on the Key Access Justifications code provided. For more information about Key Access Justifications, see Key Access Justifications overview.

Overview

With Cloud EKM, you can use keys that you manage within a supported external key management partner to protect data within Google Cloud. You can protect data at rest in supported CMEK integration services, or by calling the Cloud Key Management Service API directly.

Cloud EKM provides several benefits:

  • Key provenance: You control the location and distribution of your externally managed keys. Externally managed keys are never cached or stored within Google Cloud. Instead, Cloud EKM communicates directly with the external key management partner for each request.

  • Access control: You manage access to your externally managed keys in your external key manager. You can't use an externally managed key in Google Cloud without first granting the Google Cloud project access to the key in your external key manager. You can revoke this access at any time.

  • Centralized key management: You can manage your keys and access policies from a single user interface, whether the data they protect resides in the cloud or on your premises.