GCP - Key Management
- Cloud KMS: supports CMEK, customer owns the key
- Cloud KMS with Autokey: You retain full control of the keys created by Autokey. You can use manually-created Cloud KMS keys alongside keys created using Autokey. https://cloud.google.com/kms/docs/kms-autokey
- Google default encryption: customer does not own the key
KMS vs HSM
Cloud KMS is a software-based service for managing keys, while HSMs are dedicated hardware devices. HSMs offer enhanced security and performance due to their specialized hardware design. Businesses often use a combination of both, leveraging Cloud KMS for key management and HSMs for sensitive key storage and operations.
Recommended Reading
Sponsored
Google Cloud Platform
- Google Cloud Platform
- GCP - Compute
- GCP - Storage
- GCP - Networking
- GCP - DNS
- GCP - AI / ML
- GCP - PubSub
- GCP - Enterprise
- GCP - Key Management
- GCP - Dev Tools
- GCP - GCE
- GCP - GKE
- GCP - Agent Engine
- GCP - Google Distributed Cloud
- GCP - Cloud Run
- GCP - Load Balancing
- GCP - IAM
- GCP - Tokens
- GCP - Service Account
- GCP - Service Account Impersonation
- GCP - Application Default Credentials
- GCP - Security Guide
- GCP - Quotas
- GCP - Billing
- GCP - Colab
- GCP - GFE
- GCP - Open Source Dependencies
- GCP - Resource Hierarchy
- GCP - SaaS Runtime
- GCP - Deprecations
- GCP - How to provision resources
- GCP - How to provision resources with Terraform
GCP - Versus
- GCP - Versus
- GCP vs Kubernetes
- Gemini vs Vertex AI
- Asset vs Resource
- Service Account vs Service Agent
- Dataflow vs Dataproc
- Producer vs Consumer vs Tenant Project
- CSEK vs CMEK
- Secret Manager vs Cloud KMS
- Persistent Disk Snapshot vs Disk Image
- VPC vs VPC Service Controls
- Cloud Hub vs App Hub vs ADC
- Google API vs Cloud API
- Cloud IAP vs Cloud SWP
- GCE Metadata Server vs GKE Metadata Server
- Project vs Resource Level IAM Binding
- GKE vs GKE Enterprise
- Cloud PubSub vs PubSub Lite vs Managed Kafka
- VPC Peering vs VPC Service Perimeter