From a5a888bed8f104d397f8a67f496ea4550dae574e Mon Sep 17 00:00:00 2001 From: Filip Haftek Date: Mon, 15 Apr 2024 10:12:22 +0200 Subject: [PATCH] Cloud: CMEK support --- .../departments/cloud/technical-docs/cmek.md | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 content/departments/cloud/technical-docs/cmek.md diff --git a/content/departments/cloud/technical-docs/cmek.md b/content/departments/cloud/technical-docs/cmek.md new file mode 100644 index 000000000000..a76268e8283e --- /dev/null +++ b/content/departments/cloud/technical-docs/cmek.md @@ -0,0 +1,27 @@ +# Customer Managed Encryption Keys + +Customer Managed Encryption Keys (CMEK) is the security feature which ensures that the customer data in Google Cloud Platform are encrypted at rest using unique, dedicated keys stored in Cloud KMS - [Google Cloud Platform documentation](https://cloud.google.com/kms/docs/cmek). + +Benefits: + +- customer's data are encrypted with non-default Google key, which ensures Google (nor any other entity) cannot decrypt the data +- database data are encrypted with different key than GKE persistent volumes to increase security +- dedicated CMEK can be rotated manually or automatilly if required + +## How to enable CMEK + +> [!WARNING] CMEK can only be enabled during instance creation. Changing this conguration after the instance is created will require recreation of CloudSQL and Persistent Volumes, which will destroy all the data! + +To enable CMEK for Cloud instance during creation, add tag `cmek` to [instance features](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/cloud/-/blob/.github/workflows/mi_create.yml?L63) + +or + +modify instance `config.yaml` with given annotation: + +```yaml +"cloud.sourcegraph.com/enable-cmek" = "true" +``` + +## How to disable CMEK + +When CMEK is enabled for instance, it cannot be disabled. Changing this conguration after the instance is created will require recreation of CloudSQL and Persistent Volumes, which will destroy all the data!