Customer-Managed Keys

Customer-managed keys (CMKs or CMEKs) give cloud customers control over the encryption keys used to protect their data in cloud services, rather than using provider-managed keys. Customers create and manage keys in a Cloud KMS or HSM, and the cloud service uses these keys via the Key Management Service API.

CMEKs allow customers to audit key usage, revoke access by deleting keys, and meet regulatory requirements mandating customer control over encryption keys.