Query: Ensure that dataproc cluster is encrypted using customer-managed encryption key

Description

When you use Dataproc, cluster, and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key-encryption key (KEK). Google still controls the data encryption key (DEK).

Query

Tables used in this query:

• gcp_dataproc_cluster

Controls using this query:

• 1.17 Ensure that dataproc cluster is encrypted using customer-managed encryption key
• 1.17 Ensure that dataproc cluster is encrypted using customer-managed encryption key
• Ensure that dataproc cluster is encrypted using customer-managed encryption key

SQL