VM disks for critical VMs should be encrypted with customer-supplied encryption keys

Docs > Datadog Security > OOTB Rules > VM disks for critical VMs should be encrypted with customer-supplied encryption keys

Description

Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. If you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data. By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.

Default value

By default, VM disks are encrypted with Google-managed keys. They are not encrypted with Customer-Supplied Encryption Keys.

Rationale

By default, Google Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part. However, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys. If you provide your own encryption keys, Compute Engine uses your key to protect the Google-generated keys used to encrypt and decrypt your data. Only users who can provide the correct key can use resources protected by a customer-supplied encryption key. Google does not store your keys on its servers and cannot access your protected data unless you provide the key. This also means that if you forget or lose your key, there is no way for Google to recover the key or to recover any data encrypted with the lost key. Business critical VMs should have VM disks encrypted with CSEK.

Impact

If you lose your encryption key, you will not be able to recover the data.

Remediation

You cannot update the encryption of an existing disk. Therefore, you should create a new disk with encryption set to Customer supplied.

From the console

Go to Compute Engine Disks in your Google Cloud console.
Click CREATE DISK.
Set Encryption type to Customer supplied.
Provide the Key in the box.
Select Wrapped key.
Click Create.

From the command line

You can use the gcloud CLI to encrypt a disk using the --csek-key-file flag during instance creation. If you are using an RSA-wrapped key, use the gcloud beta component. See RSA key wrapping in Google’s Compute Engine documentation.

gcloud compute instances create <INSTANCE_NAME> --csek-key-file <example-
file.json>

To encrypt a standalone persistent disk:

gcloud compute disks create <DISK_NAME> --csek-key-file <example-file.json>