A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and…

For managing and rotating encryption keys in a Compute Engine-based cluster using Managed

Instance Groups (MIGs), Customer-Managed Encryption Keys (CMEK) with Cloud KMS is the

appropriate solution.

Set Up Cloud KMS:

Go to the Cloud Console and navigate to Security > Cryptographic Keys.

Create a keyring and a key.

Create and Use CMEK:

While creating or updating a Compute Engine instance, specify the CMEK key.

Example command:

gcloud compute instances create example-instance \ --image-family=debian-9 \ --image-

project=debian-cloud \ --boot-disk-kms-

key=projects/[PROJECT_ID]/locations/global/keyRings/[KEY_RING]/cryptoKeys/[KEY]

Rotate Keys:

Rotate keys periodically using Cloud KMS by creating new key versions and updating the instances to

use the new key versions.

Reference::

Customer-Managed Encryption Keys (CMEK)

Using Customer-Managed Encryption Keys