Google CloudOverview
Overview
Artifact Registry supports customer-managed encryption keys (CMEK) through Cloud KMS. Using CMEK gives security teams stronger control over key rotation, separation of duties, and auditability for software supply-chain assets stored in the registry.
Remediation guidance
From Google Cloud Console
- Open the affected Artifact Registry repository.
- Edit the repository settings.
- Select a Cloud KMS key under customer-managed encryption.
- Save the repository configuration and validate the key policy allows the registry service to use it.
Using gcloud
gcloud artifacts repositories create <repository> --repository-format=docker --location=<location> --kms-key=<kms-key-resource-name>
For existing repositories, migrate or recreate them with CMEK where required by your policy baseline.
Query logic
These are the stored checks tied to this control.
Artifact Registry repositories without customer-managed encryption keys
Connectors
Google Cloud
Covered asset types
ArtifactRegistryRepository
Expected check: eq []
{ artifactRegistryRepositories(where: { OR: [ { kmsKeyName: "" }, { kmsKeyName: null } ] }) { ...AssetFragment } }
