Google Cloud Key Management

Understanding Google Cloud Key Management Service (KMS)

The Google Cloud Key Management Service (KMS) is a managed service that allows you to create, manage, and use cryptographic keys to protect sensitive data. Google Cloud KMS supports both symmetric and asymmetric keys, enabling a wide range of cryptographic operations such as encryption, decryption, signing, and verification. Key concepts in Google Cloud KMS include: Key Rings: Logical groupings of keys used to organize and manage access to related keys. CryptoKeys: The actual cryptographic keys stored within a key ring. Each CryptoKey can have multiple versions, allowing for key rotation and lifecycle management. CryptoKey Versions: Each version represents specific cryptographic key material. Only one version is typically enabled for use at a time. Symmetric Keys: Used for encrypting and decrypting data with the same key. Asymmetric Keys: Used for operations where different keys are used for encryption and decryption, or for signing and verifying data. Google Cloud KMS is designed to help you meet security and compliance requirements by providing centralized key management, audit logging, and integration with other Google Cloud services.

Google Cloud KMS Keys and Data Encryption: A Secure File Storage Example

To understand how Google Cloud KMS can be used in practice, consider a secure file storage application. This application allows users to upload and retrieve confidential files, ensuring that all data is encrypted both at rest and in transit. Use of KMS Keys: Centralized Key Management: KMS keys are used to centrally manage encryption keys, define access policies, and control which users or services can perform cryptographic operations. Audit and Compliance: All key usage is logged, providing a detailed audit trail for compliance and security monitoring. Data Encryption Process: Envelope Encryption: When a user uploads a file, the application generates a unique data encryption key (DEK) for that file. The file is encrypted locally using the DEK . Key Wrapping: The DEK itself is then encrypted (wrapped) using a KMS key. The encrypted DEK is stored alongside the encrypted file. Secure Access: When the file needs to be accessed, the encrypted DEK is sent to KMS to be decrypted (unwrapped). The plaintext DEK is then used to decrypt the file. This approach ensures that each file is encrypted with a unique key, and the master keys used to protect these data keys are securely managed and audited by Google Cloud KMS.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Creating a Key in Google Cloud KMS

To create a cryptographic key in Google Cloud KMS, you first create a key ring, then create a CryptoKey within that key ring. You can specify the purpose of the key (such as encryption/decryption or signing/verification) and the type of key material (symmetric or asymmetric).

Below is an example of how to create a key ring and a symmetric encryption key:

Python

from google.cloud import kms

# Initialize the KMS client
client = kms.KeyManagementServiceClient()

# Define project, location, and key ring details
project_id = "your-project-id"
location_id = "global"
key_ring_id = "sample-key-ring"
crypto_key_id = "sample-crypto-key"

# Build the parent path for the key ring
parent = f"projects/{project_id}/locations/{location_id}"

# Create the key ring
key_ring = client.create_key_ring(
    request={
        "parent": parent,
        "key_ring_id": key_ring_id,
        "key_ring": {},
    }
)

# Create a symmetric encryption key within the key ring
crypto_key = client.create_crypto_key(
    request={
        "parent": key_ring.name,
        "crypto_key_id": crypto_key_id,
        "crypto_key": {
            "purpose": kms.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT,
        },
    }
)

from google.cloud import kms

# Initialize the KMS client
client = kms.KeyManagementServiceClient()

# Define project, location, and key ring details
project_id = "your-project-id"
location_id = "global"
key_ring_id = "sample-key-ring"
crypto_key_id = "sample-crypto-key"

# Build the parent path for the key ring
parent = f"projects/{project_id}/locations/{location_id}"

# Create the key ring
key_ring = client.create_key_ring(
    request={
        "parent": parent,
        "key_ring_id": key_ring_id,
        "key_ring": {},
    }
)

# Create a symmetric encryption key within the key ring
crypto_key = client.create_crypto_key(
    request={
        "parent": key_ring.name,
        "crypto_key_id": crypto_key_id,
        "crypto_key": {
            "purpose": kms.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT,
        },
    }
)

Key Ring: Organizes related keys and controls access at a group level.
CryptoKey: The cryptographic key used for encryption and decryption.
Purpose: Specifies the intended use of the key, such as ENCRYPT_DECRYPT for symmetric encryption.

Retrieving Key Metadata in Google Cloud KMS

To view details about a specific key, you can retrieve its metadata. This includes information such as the key's purpose, creation time, primary version, and current state.

Here is how you can retrieve and display metadata for a CryptoKey:

Python

# Build the resource name for the CryptoKey
crypto_key_name = f"projects/{project_id}/locations/{location_id}/keyRings/{key_ring_id}/cryptoKeys/{crypto_key_id}"

# Get the CryptoKey metadata
crypto_key = client.get_crypto_key(request={"name": crypto_key_name})

print("Key Name:", crypto_key.name)
print("Purpose:", crypto_key.purpose)
print("Primary Version:", crypto_key.primary.name)
print("Creation Time:", crypto_key.create_time)
print("Labels:", crypto_key.labels)
print("Rotation Period:", crypto_key.rotation_period)

# Build the resource name for the CryptoKey
crypto_key_name = f"projects/{project_id}/locations/{location_id}/keyRings/{key_ring_id}/cryptoKeys/{crypto_key_id}"

# Get the CryptoKey metadata
crypto_key = client.get_crypto_key(request={"name": crypto_key_name})

print("Key Name:", crypto_key.name)
print("Purpose:", crypto_key.purpose)
print("Primary Version:", crypto_key.primary.name)
print("Creation Time:", crypto_key.create_time)
print("Labels:", crypto_key.labels)
print("Rotation Period:", crypto_key.rotation_period)

Output:

text

Key Name: projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key
Purpose: CryptoKeyPurpose.ENCRYPT_DECRYPT
Primary Version: projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key/cryptoKeyVersions/1
Creation Time: 2024-01-15 10:30:45.123456+00:00
Labels: {}
Rotation Period: None

Key Name: projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key
Purpose: CryptoKeyPurpose.ENCRYPT_DECRYPT
Primary Version: projects/your-project-id/locations/global/keyRings/sample-key-ring/cryptoKeys/sample-crypto-key/cryptoKeyVersions/1
Creation Time: 2024-01-15 10:30:45.123456+00:00
Labels: {}
Rotation Period: None

This metadata helps you manage your keys, monitor their usage, and ensure compliance with security policies.

Key Rotation in Google Cloud KMS

Key rotation is an important security practice that helps limit the amount of data encrypted with a single key version. In Google Cloud KMS, you can configure automatic rotation for symmetric keys by specifying a rotation period. When a key is rotated, a new key version is created and set as the primary version for encryption.

To set up automatic key rotation:

Python

import time
from google.protobuf import duration_pb2

# Set the rotation period (e.g., 30 days)
rotation_period = duration_pb2.Duration()
rotation_period.seconds = 60 * 60 * 24 * 30  # 30 days

# Update the CryptoKey to enable automatic rotation
updated_crypto_key = client.update_crypto_key(
    request={
        "crypto_key": {
            "name": crypto_key_name,
            "rotation_period": rotation_period,
            "next_rotation_time": {"seconds": int(time.time() + rotation_period.seconds)},
        },
        "update_mask": {"paths": ["rotation_period", "next_rotation_time"]},
    }
)

import time
from google.protobuf import duration_pb2

# Set the rotation period (e.g., 30 days)
rotation_period = duration_pb2.Duration()
rotation_period.seconds = 60 * 60 * 24 * 30  # 30 days

# Update the CryptoKey to enable automatic rotation
updated_crypto_key = client.update_crypto_key(
    request={
        "crypto_key": {
            "name": crypto_key_name,
            "rotation_period": rotation_period,
            "next_rotation_time": {"seconds": int(time.time() + rotation_period.seconds)},
        },
        "update_mask": {"paths": ["rotation_period", "next_rotation_time"]},
    }
)

Rotation Period: Defines how often a new key version is created.
Next Rotation Time: Specifies when the next rotation should occur.

Important Note: Automatic rotation only creates new key versions for future encryption operations. It does not re-encrypt existing ciphertexts, which remain encrypted with their original key versions. All previous key versions remain available for decrypting existing data, ensuring that your encrypted data remains accessible even after rotation.

Automatic rotation helps maintain strong security by regularly updating key material without manual intervention.

Understanding Google Cloud Key Management Service (KMS)

Google Cloud KMS Keys and Data Encryption: A Secure File Storage Example

Join the 1M+ learners on CodeSignal

Creating a Key in Google Cloud KMS

Retrieving Key Metadata in Google Cloud KMS

Encrypting and Decrypting Data using Google Cloud KMS

Working with Data Keys and Envelope Encryption

Key Rotation in Google Cloud KMS

Scheduling Key Destruction in Google Cloud KMS

Summary