Google CloudOverview
CMEK on Bigtable helps organizations meet key custody and compliance requirements.
Remediation guidance
Google Cloud Remediation
Service-Wide (Recommended)
Enforce CMEK requirements through organization standards and project controls for regulated workloads.
Google Cloud Console (Asset-Level)
- Open Bigtable instance settings/creation flow.
- Select CMEK option.
- Assign approved KMS key.
Google Cloud CLI (Asset-Level)
gcloud bigtable instances create <instance-name> --cluster=<cluster-name> --cluster-zone=<zone> --display-name="<display-name>" --kms-key=projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<key>
References
- https://cloud.google.com/bigtable/docs/customer-managed-encryption-keys
Query logic
These are the stored checks tied to this control.
Bigtable instances without CMEK
Connectors
Google Cloud
Covered asset types
BigTable
Expected check: eq []
{ bigTableInstances(where: { OR: [ { kmsKeyName: "" }, { kmsKeyName: null } ] }) { ...AssetFragment } }
