Google CloudOverview
Customer-managed encryption keys (CMEK) provide stronger governance and key lifecycle control for regulated workloads.
Why this matters
For regulated data, teams often need provable control over key use, rotation, and disablement.
Important note
Spanner CMEK is applied when you create a database or restore into a new database. It is not a simple in-place toggle for an existing database that already uses Google-managed encryption.
Remediation guidance
Google Cloud Remediation
Service-wide fix (recommended): define which Spanner workloads must use CMEK, pre-approve the key locations, and build the requirement into database creation workflows.
When to use service-wide remediation
Use the service-wide path when multiple teams create Spanner databases in regulated projects.
Google Cloud console
- Open the Spanner instance that will host the database.
- Choose
Create database. - Expand
Show encryption options. - Select
Cloud KMS keyand choose the approved key. - Create the database and verify the encryption information on the database details page.
Google Cloud CLI
Create a CMEK-protected database:
gcloud spanner databases create <database-name> \
--instance=<instance-name> \
--kms-key=projects/<kms-project>/locations/<kms-location>/keyRings/<keyring>/cryptoKeys/<key>
Validate the encryption configuration:
gcloud spanner databases describe <database-name> \
--instance=<instance-name>
Operational notes
- This is not an in-place update for an existing non-CMEK database. The usual fix is to create a new CMEK-protected database and migrate by backup and restore or by export and import.
- In multi-region or custom instance configurations, you might need multiple regional keys instead of a single key.
- The Spanner service agent must be granted
roles/cloudkms.cryptoKeyEncrypterDecrypteron the selected key or keys.
References
- https://docs.cloud.google.com/spanner/docs/use-cmek
- https://docs.cloud.google.com/sdk/gcloud/reference/spanner/databases/create
- https://docs.cloud.google.com/spanner/docs/cmek
Query logic
These are the stored checks tied to this control.
Spanner instances without CMEK
Connectors
Covered asset types
Expected check: eq []
{ cloudSpannerInstances(where: { OR: [ { kmsKeyName: "" }, { kmsKeyName: null } ] }) { ...AssetFragment } }
