Using Customer Supplied Encryption Keys with Cloud Storage

Overview
Cloud Storage always encrypts your data on the server side with a Google-managed encryption key, before it is written to disk, at no additional charge. As an alternative to a Google-managed server-side encryption key, you can choose to provide your own AES-256 key, encoded in standard Base64. This key is known as a customer-supplied encryption key.

In this lab, you will configure customer-supplied encryption keys (CSEK) for Cloud Storage. Files will then be uploaded into a storage bucket. You will then generate a new encryption key and rotate CSEK keys.

Cloud Storage does not permanently store your key on Google's servers or otherwise manage your key. Instead, you provide your key for each Cloud Storage operation, and your key is purged from Google's servers after the operation is complete. Cloud Storage stores only a cryptographic hash of the key so that future requests can be validated against the hash.

Your key cannot be recovered from this hash, and the hash cannot be used to decrypt your data.

Objectives
In this lab, you wil learn how to perform the following tasks:
- Configure CSEK for Cloud Storage.
- Utilize CSEK to encrypt files in Cloud Storage.
- Delete local files from Cloud Storage and verify encryption.
- Rotate your encryption keys without downloading and re-uploading data.
#gcp #googlecloud #qwiklabs #learntoearn

Видео Using Customer Supplied Encryption Keys with Cloud Storage канала Backyard Techmu by Adrianus Yoga