Google Cloud EKM (External Key Manager)

this guide describes how to integrate google cloud ekm with {{k3}} this section covers important terminology, ekm features, key benefits of the integration, how the integration works, and an integration overview terminology the following list contains important terms and their definitions term definition external key manager (ekm) the key manager outside of google cloud that manages your keys (such as {{k3}} ) cloud external key manager (cloud ekm) a google cloud service for using your external keys that a supported ekm manages cloud ekm through the internet a version of cloud ekm where google cloud communicates with your external key manager over the internet cloud ekm through a vpc a version of cloud ekm where google cloud communicates with your external key manager over a virtual private cloud (vpc) google cloud ekm features the following list describes ekm features feature description base google ekm support with google cloud ekm, you can use keys you manage within a supported external key management partner (such as {{k3}} ) to protect data within google cloud you can protect data at rest in supported customer managed encryption keys (cmek) integration services or by calling the cloud key management service api directly justification the justification feature requires you to provide a reason or justification for any critical operation you perform on the key management system this feature enhances accountability and enables better auditing of actions taken within the system by mandating justifications, you can easily trace back decisions, identify patterns of misuse, and ensure that only authorized and necessary operations are executed vpc support virtual private cloud (vpc) support allows you to integrate the {{k3}} seamlessly into your existing vpc infrastructure on google cloud this feature ensures that the key management server operates within a secure, isolated environment, thereby reducing the potential attack surface and providing enhanced protection for sensitive data vpc support also simplifies network configurations and enables more granular control over access to the key management server checksum support (validity checks on keys via a cmac) checksum support, using a cipher based message authentication code (cmac), enables the {{k3}} to perform validity checks on cryptographic keys when you generate, store, or transmit keys, the system calculates a cmac and attaches it to the key the cmac acts as a checksum that enables the recipient to verify the integrity of the key this feature enhances the security of key management operations by ensuring that keys have not been tampered with or corrupted during storage or transmission this feature is transparent to the user asymmetric signing (rsa keys) asymmetric signing support for rsa keys enables the {{k3}} to generate and manage rsa key pairs, which can be used for digital signatures and public key encryption with this feature, users can create, store, and manage rsa keys in the {{k3}} , while leveraging google cloud external key manager for operations that require the private key, such as signing or decrypting data this expands the range of cryptographic operations that can be performed using the integrated solution and provides increased flexibility for users key management commands (in beta with google) the key management commands feature, currently in beta with google, enables users to execute a wider range of key management operations directly from the google cloud external key manager interface this includes actions such as key rotation, deletion, and metadata updates by providing a more comprehensive set of key management commands, these commands enable you to streamline your workflows and manage cryptographic keys more efficiently within the integrated environment these new features significantly enhance the capabilities of the {{k3}} and google cloud external key manager integration, providing improved security, accountability, and flexibility in cryptographic key management key benefits of the integration the google cloud ekm / {{k3}} integration provides several benefits benefit description key provenance you control the location and distribution of your externally managed keys externally managed keys are never cached or stored within google cloud instead, cloud ekm communicates directly with the {{k3}} for each request access control you manage access to your externally managed keys before you can use an externally managed key in google cloud, you must grant the google cloud project access to use the key you can revoke this access at any time centralized key management you can manage your keys and access policies from a single user interface, whether the data they protect resides in the cloud or on your premises in all cases, the key resides on the {{k3}} and is never sent to google refer to the google ekm documentation for the full list of services that support cmek with cloud ekm how it works this section provides a broad overview of how cloud ekm works with an external key first, you create or use an existing key in the {{k3}} application interface this key has a unique uri or key path next, you grant your google cloud project access to use the key, on the {{k3}} in your google cloud project, you create a cloud ekm key by using the uri or key path for the externally managed key within google cloud, the key appears with your other cloud kms and cloud hsm keys, with protection level external or external vpc the cloud ekm key and the external key management partner key work together to protect your data the external key is never exposed to google you must have both the cloud ekm key version and the external key for each encryption and decryption request if you lose access to either key, you cannot recover your data nor can you recreate an identical cloud ekm key version by using the same external key uri or key path refer to the google ekm documentation for information about the considerations and restrictions when using cloud ekm integration overview this guide covers the following tasks to integrate google cloud ekm with {{k3}} set up google cloud external key manager (ekm) initially set up tls and authentication on the {{k3}} configure manually managed keys configure google crypto space managed keys create an externally managed key in google cloud test encryption and decryption with externally managed key the following sections describe how to perform these tasks