Volume encryption for GCP

You can encrypt disks in GCP using the following methods:

For more information on GCP encryption, see: Google Cloud Encryption.

Table: Encryption for creating snapshots

Disk encryption	Snapshot encryption
Platform Managed Key (PMK)	Same PMK is used as the source disk.
CMEK	Same CMEK is used as the source disk.

Table: Encryption for restoring snapshots

Snapshot encryption	Restored disk encryption
PMK	Same PMK is used as the snapshot.
CMEK	Same CMEK is used as the snapshot, if the target restore location is within the scope of the key.

Table: Encryption for restoring from backup

Snapshot encryption	Restored disk encryption
PMK	Same PMK is used as the source disk.
CMEK	Same CMEK is used as the source disk, else PMK is used.

Note:

For successful restoration, the target restore location must be inside the scope of the key during restoration.