Volume encryption for GCP
You can encrypt disks in GCP using the following methods:
Encryption by default (PMK or Google Managed Key)
Customer Managed Encryption Key (CMEK) using Google Cloud KMS
For more information on GCP encryption, see: https://cloud.google.com/security/encryption-at-rest
Table: Encryption for creating snapshots
Disk encryption | Snapshot encryption |
|---|---|
Platform Managed Key (PMK) | Same PMK is used as the source disk. |
CMEK | Same CMEK is used as the source disk. |
Table: Encryption for restoring snapshots
Snapshot encryption | Restored disk encryption |
|---|---|
PMK | Same PMK is used as the snapshot. |
CMEK | Same CMEK is used as the snapshot, if the target restore location is within the scope of the key. |
Note:
For successful restoration, the target restore location must be inside the scope of the key during restoration.