Use Customer-Managed Encryption Keys for Repositories Encryption

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Artifact Registry console available at https://console.cloud.google.com/artifacts/.

04 In the left navigation panel, under Artifact Registry, choose Repositories to access the list of Artifact Registry repositories available for the selected GCP project.

05 Choose the repository that you want to examine and check the Encryption column to determine the type of the encryption key used by the selected resource. If the value listed in the Encryption column is Google-managed, the artifacts stored within the selected Artifact Registry repository are not encrypted at rest using a Cloud KMS Customer-Managed Encryption Key (CMEK).

06 Repeat step no. 5 for each Artifact Registry repository available within the selected GCP project.

07 Repeat steps no. 2 - 6 for each project deployed within your Google Cloud account.

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each project available in your Google Cloud Platform (GCP) account:

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDs:

PROJECT_ID
cc-web-project-123123
cc-iot-project-112233

03 Run artifacts repositories list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the name and the location of each Artifact Registry repository available in the selected project:

gcloud artifacts repositories list
	--project cc-web-project-123123
	--format="(REPOSITORY,LOCATION)"

04 The command output should return the repository names and their location:

ARTIFACT_REGISTRY

REPOSITORY: cloud-run-source-deploy
LOCATION: us-central1

REPOSITORY: cc-project5-artifact-repo
LOCATION: us-central1

05 Run artifacts repositories describe command (Windows/macOS/Linux) with the name of the Artifact Registry repository that you want to examine as the identifier parameter, to describe the ID of the Customer-Managed Encryption Key (CMEK) used to encrypt your repository data:

gcloud artifacts repositories describe cloud-run-source-deploy
	--project cc-web-project-123123
	--location us-central1
	--format="json(kmsKeyName)"

06 The command output should return the full ID of the requested Customer-Managed Encryption Key:

null

07 Repeat steps no. 5 and 6 for each Registry repository repository available in the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 To create and configure your new Customer-Managed Encryption Key (CMEK), perform the following actions:

1. Navigate to Key management console available at https://console.cloud.google.com/security/kms.
2. Before you can set up and configure your Customer-Managed Encryption Key (CMEK), you must create a key ring. A Cloud KMS key ring is a grouping of cryptographic keys made available for organizational purposes in a specific location. To get started, choose CREATE KEY RING to set up the required key ring.
3. A key ring requires a name and a location. On the Create key ring setup page, provide a unique name in the Key ring name box, select the key location type from the Location type list, then choose the appropriate key location from the Region/Multi-region dropdown list. The location can be either multi-region or associated with a particular region. If the CMEKs created later within this key ring will be used to encrypt/decrypt data in a particular region, select that region as the key ring location. Choose CREATE to deploy the new key ring.
4. On the Create key setup page, provide the following information:
   1. For Name and protection level, provide a unique name for your new KMS key in the Key name box and choose the protection level that you want to use from the Protection Level dropdown list. Choose CONTINUE to continue the setup process.
   2. For Key material, choose Generated key to generate the key material for you (recommended). Choose CONTINUE.
   3. For Purpose and algorithm, choose Symmetric encrypt/decrypt to define the types of operations that your cryptographic key can perform. Choose CONTINUE to continue the setup.
   4. For Versions, configure the key rotation period as necessary. Choose CONTINUE.
   5. For Additional settings (optional), set the duration for the scheduled for destruction (i.e., soft deleted) state before the key is removed from the system. Choose ADD LABEL and use the Key and Value text fields to create labels in order to organize the identity of the new key.
   6. Choose CREATE to deploy your new Cloud KMS Customer-Managed Encryption Key (CMEK).

04 Navigate to Artifact Registry console available at https://console.cloud.google.com/artifacts/.

05 In the left navigation panel, under Artifact Registry, select Repositories, choose CREATE REPOSITORY, and perform the following actions to create a new Artifact Registry repository:

1. Provide a unique name for the new repository in the Name box.
2. For Format, select the repository format.
3. If multiple repository modes are available, select Standard for Mode.
4. For Location Type, select the location for the repository.
5. Add a description for the new repository in the Description text box.
6. (Optional) For Labels, choose ADD LABEL and use the Key and Value text fields to create labels in order to organize the identity of the repository.
7. For Encryption, choose Cloud KMS key. Select Cloud KMS for Key type, and choose the name of your Cloud KMS Customer-Managed Encryption Key (CMEK) from the Select a Cloud KMS key dropdown list. Inside the \ service account does not have the "cloudkms.cryptoKeyEncrypterDecrypter" role. Verify the service account has permission to encrypt/decrypt with the selected key box, choose GRANT to grant the associated service account access to your key using the Cloud KMS CryptoKey Encrypter/Decrypter role.
8. (Optional) If you want to use cleanup policies in order to delete unused artifacts, define policies to automatically clean up your artifacts in the Cleanup policies section.
9. For Vulnerability scanning, choose Enabled to allow scanning in your repository. Vulnerability scanning is currently supported for Docker standard and remote repositories.
10. Choose CREATE to create your new, CMEK-encrypted Artifact Registry repository.

06 Repeat step no. 5 for each Artifact Registry repository that you want to re-create, available within the selected GCP project.

07 Repeat steps no. 2 – 6 for each project deployed in your Google Cloud account.

01 Before you can create your own Customer-Managed Encryption Key (CMEK), you have to provision a key ring. A Cloud KMS key ring is a grouping of cryptographic keys made available for organizational purposes in a specific Google Cloud location. Run kms keyrings create command (Windows/macOS/Linux) to create a new Cloud KMS key ring in the specified location. If the keys deployed later within this key ring will be used to encrypt resources in a given region, select that region as the key ring location:

gcloud kms keyrings create cc-cloud-repo-key-ring
	--location=us
	--project=cc-web-project-123123
	--format="table(name)"

02 The command output should return the resource name of the newly created key ring:

NAME
projects/cc-web-project-123123/locations/us/keyRings/cc-cloud-repo-key-ring

03 Run kms keys create command (Windows/macOS/Linux) to create a new Customer-Managed Encryption Key (CMEK) within the Cloud KMS key ring created at the previous steps:

gcloud kms keys create cc-cloud-repo-kms-key
	--location=us
	--keyring=cc-cloud-repo-key-ring
	--purpose=encryption
	--protection-level=software
	--rotation-period=90d
	--next-rotation-time=2025-01-25T10:00:00.0000Z
	--format="table(name)"

04 The command output should return the full resource name of the new Customer-Managed Encryption Key:

NAME
projects/cc-web-project-123123/locations/us/keyRings/cc-cloud-repo-key-ring/cryptoKeys/cc-cloud-repo-kms-key

05 Run kms keys add-iam-policy-binding command (Windows/macOS/Linux) to assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the required service account:

gcloud kms keys add-iam-policy-binding cc-cloud-repo-kms-key
	--keyring cc-cloud-repo-key-ring
	--location us-central1
	--member='serviceAccount:service-<project-number>@gcp-sa-artifactregistry.iam.gserviceaccount.com'
	--role roles/cloudkms.cryptoKeyEncrypterDecrypter

06 The command output should return the updated IAM policy (YAML format):

Updated IAM policy for key [cc-cloud-repo-kms-key].
bindings:
- members:
	- serviceAccount:service-<project-number>@gcp-sa-artifactregistry.iam.gserviceaccount.com
	role: roles/cloudkms.cryptoKeyEncrypterDecrypter
etag: ABCD1234ABCD1234
version: 1

07 Run the artifacts repositories create command (OSX/Linux/UNIX) to create a new, CMEK-encrypted Artifact Registry repository using your own Cloud KMS Customer-Managed Encryption Key (CMEK):

gcloud artifacts repositories create new-cloud-run-source-deploy
	--repository-format=docker
	--location=us-central1
	--kms-key="projects/cc-web-project-123123/locations/us/keyRings/cc-cloud-repo-key-ring/cryptoKeys/cc-cloud-repo-kms-key"
	--async

08 The command output should return the artifacts repositories create command request information:

Create request issued for: [new-cloud-run-source-deploy]
Check operation [projects/cc-web-project-123123/locations/us-central1/operations/abcdabcd-1234-abcd-1234-abcd1234abcd] for status.

09 Repeat steps no. 7 and 8 for each Artifact Registry repository that you want to re-create, available in the selected GCP project.

10 Repeat steps no. 1 – 9 for each GCP project deployed in your Google Cloud account.