thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Intermediate

Customer-Managed Key (CMK)

Encryption key created and controlled by the customer in a cloud key management service, rather than by the provider.

Definition

Customer-managed keys let customers control key policies, rotation, enabling, disabling and deletion, and audit every use. Revoking or disabling a CMK makes data encrypted with it inaccessible. Examples include AWS KMS customer managed keys, Azure Key Vault keys used for customer-managed encryption and Google Cloud CMEK.

Example

Disabling the CMK protecting a storage account immediately prevents access to its data, satisfying a key-revocation requirement.

Exam tip

Provider-managed keys require no effort; CMKs add control and auditability; BYOK/HYOK add control over key origin and location.

Related terms