Control: 4.7 Ensure VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys (CSEK)
Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.
If you provide your own encryption keys, Compute Engine uses your key to protect the Google-generated keys used to encrypt and decrypt your data. Only users who can provide the correct key can use resources protected by a customer-supplied encryption key.
At least business critical VMs should have VM disks encrypted with
- Login to Compute Engine Disks.
- Click CREATE DISK.
- Set Encryption type to Customer supplied,
- Provide the Key in the box.
- Select Wrapped key.
- Click Create.
From Command Line
- In the gcloud compute tool, encrypt a disk using the
--csek-key-fileflag during instance creation. If you are using an RSA-wrapped key, use the gcloud beta component:
gcloud (beta) compute instances create INSTANCE_NAME --csek-key-file <example-file.json>
- To encrypt a standalone persistent disk:
gcloud (beta) compute disks create DISK_NAME --csek-key-file <examplefile.json>
steampipe check gcp_compliance.control.cis_v120_4_7
This control uses a named query:compute_disk_encrypted_with_csk