thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

Google Cloud Key Management Service (Cloud KMS)

Google Cloud service for managing cryptographic keys, with software, HSM, and external key options.

Definition

Cloud KMS supports software keys, Cloud HSM keys (FIPS 140-validated), and Cloud External Key Manager (EKM), which keeps keys in a third-party system outside Google. CMEK lets customers control keys for services such as Cloud Storage and BigQuery. IAM roles like cloudkms.cryptoKeyEncrypterDecrypter control use.

Example

A BigQuery dataset is configured with a CMEK stored in Cloud KMS so revoking the key blocks access to the data.

Exam tip

Cloud EKM is Google's hold-your-own-key option.

Related terms