Logo of Trend Micro
Use the Knowledge Base AI to help improve your Cloud Posture

Use Customer-Managed Encryption Keys for Eventarc Channel Encryption

Trend Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1100 automated best practice checks.

Risk Level: High (not acceptable risk)

Ensure that the data managed by your Google Cloud Eventarc channels is encrypted with Customer-Managed Encryption Keys (CMEKs) instead of Google-managed encryption keys. This ensures that events passing through your Eventarc channels are encrypted, as CMEKs cannot be applied on a per-trigger basis. When you enable encryption with CMEKs for a channel in a Google Cloud Platform (GCP) project, all Eventarc triggers for Google event types in that project and region are fully encrypted with CMEKs. CMEKs provide greater control over the encryption and decryption process, helping you meet stringent compliance requirements.

Security

By default, Google Cloud Platform (GCP) encrypts all data at rest using Google-managed encryption keys. This type of encryption is handled by GCP without any additional effort from you or your application. However, if you prefer to have full control over data encryption, you can use your own Customer-Managed Encryption Key (CMEK). To create and manage your own CMEKs, utilize Cloud Key Management Service (Cloud KMS). Cloud KMS offers secure and efficient encryption key management, including controlled key rotation and revocation mechanisms.

Audit

Case A: To determine if your Google Eventarc channels are protected with Customer-Managed Encryption Keys (CMEKs), perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Eventarc console available at https://console.cloud.google.com/eventarc/.

04 In the left navigation panel, under Standard, choose Channels to access the list of Google Cloud Eventarc channels available for the selected GCP project.

05 Click on the name (link) of the Google Eventarc channel created for the selected project, listed in the Name column. A Google channel refers to a channel where the Provider is Google.

06 In the Encryption section, check the Use a customer-managed encryption key (CMEK) settings status to determine the type of the encryption key used by the selected resource. If the Use a customer-managed encryption key (CMEK) setting checkbox is not checked (enabled), the data managed by the selected Google Eventarc channel is not encrypted at rest using a Cloud KMS Customer-Managed Encryption Key (CMEK).

07 Repeat step no. 5 and 6 for each Google Eventarc channel available within the selected GCP project.

08 Repeat steps no. 2 - 7 for each GCP project deployed within your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each project available in your Google Cloud Platform (GCP) account: 

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDs: 

PROJECT_ID
cc-web-project-123123
cc-ai-project-112233
cc-dev-project-112233

03 Run eventarc google-channels describe command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter, to describe the full ID of the Customer-Managed Encryption Key (CMEK) used to encrypt the data managed by the Google Eventarc channel in the specified location: 

gcloud eventarc google-channels describe
	--project=cc-web-project-123123
	--location=us-central1
	--format="json(cryptoKeyName)"

04 The command output should return the ID of the requested encryption key: 

null

If the eventarc google-channels describe command output returns null, as shown in the example above, the data managed by the selected Google Eventarc channel is not encrypted at rest using a Cloud KMS Customer-Managed Encryption Key (CMEK).

05 Repeat steps no. 3 and 4 for each Google Eventarc channel available in the selected GCP project.

06 Repeat steps no. 3 – 5 for each GCP project deployed in your Google Cloud account.

Case B: To determine if your third-party Eventarc channels are protected with Customer-Managed Encryption Keys (CMEKs), perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Eventarc console available at https://console.cloud.google.com/eventarc/.

04 In the left navigation panel, under Standard, choose Channels to access the list of Google Cloud Eventarc channels available for the selected GCP project.

05 Click on the name (link) of the Eventarc channel that you want to examine, listed in the Name column. A third-party channel refers to a channel where the Provider is any provider other than Google.

06 In the Details section, check the Encryption attribute value to determine the type of the encryption key used by the selected resource. If the Encryption attribute value is Events encrypted using Google-managed encryption keys, the data managed by the selected third-party Eventarc channel is not encrypted at rest using a Cloud KMS Customer-Managed Encryption Key (CMEK).

07 Repeat step no. 5 and 6 for each third-party Eventarc channel available within the selected GCP project.

08 Repeat steps no. 2 - 7 for each GCP project deployed within your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each project available in your Google Cloud Platform (GCP) account: 

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDs: 

PROJECT_ID
cc-web-project-123123
cc-ai-project-112233
cc-dev-project-112233

03 Run eventarc channels list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to list the third-party Eventarc channels created for the selected project: 

gcloud eventarc channels list
	--project=cc-web-project-123123
	--format="default(name)"

04 The command request should return the requested channel IDs (i.e., fully qualified identifiers): 

---
name: projects/cc-web-project-123123/locations/us-central1/channels/cc-project5-eventarc-channel
---
name: projects/cc-web-project-123123/locations/us-central1/channels/cc-datadog-eventarc-channel

05 Run eventarc channels describe command (Windows/macOS/Linux) with the ID of the Eventarc channel that you want to examine as the identifier parameter, to describe the full ID of the Customer-Managed Encryption Key (CMEK) used to encrypt the data managed by the selected channel: 

gcloud eventarc channels describe "projects/cc-web-project-123123/locations/us-central1/channels/cc-project5-eventarc-channel"
	--format="json(cryptoKeyName)"

06 The command output should return the ID of the requested encryption key: 

null

If the eventarc channels describe command output returns null, as shown in the example above, the data managed by the selected third-party Eventarc channel is not encrypted at rest using a Cloud KMS Customer-Managed Encryption Key (CMEK).

07 Repeat steps no. 5 and 6 for each third-party Eventarc channel available in the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

Case A: To enable encryption with Customer-Managed Encryption Keys (CMEKs) for your Google Eventarc channels, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 To create and configure your new Customer-Managed Encryption Key (CMEK), perform the following actions:

  1. Navigate to Key management console available at https://console.cloud.google.com/security/kms.
  2. Before you can set up and configure your Customer-Managed Encryption Key (CMEK), you must create a key ring. A Cloud KMS key ring is a grouping of cryptographic keys made available for organizational purposes in a specific location. To get started, choose CREATE KEY RING to set up the required key ring.
  3. A key ring requires a name and a location. On the Create key ring setup page, provide a unique name in the Key ring name box, select the key location type from the Location type list, then choose the appropriate key location from the Region/Multi-region dropdown list. The location can be either multi-region or associated with a particular region. If the CMEKs created later within this key ring will be used to encrypt/decrypt data in a particular region, select that region as the key ring location. Choose CREATE to deploy the new key ring.
  4. On the Create key setup page, provide the following information:
    1. For Name and protection level, provide a unique name for your new KMS key in the Key name box and choose the protection level that you want to use from the Protection Level dropdown list. Choose CONTINUE to continue the setup process.
    2. For Key material, choose Generated key to generate the key material for you (recommended). Choose CONTINUE.
    3. For Purpose and algorithm, choose Symmetric encrypt/decrypt to define the types of operations that your cryptographic key can perform. Choose CONTINUE to continue the setup.
    4. For Versions, configure the key rotation period as necessary. Choose CONTINUE.
    5. For Additional settings (optional), set the duration for the scheduled for destruction (i.e., soft deleted) state before the key is removed from the system. Choose ADD LABEL and use the Key and Value text fields to create labels in order to organize the identity of the new key.
    6. Choose CREATE to deploy your new Cloud KMS Customer-Managed Encryption Key (CMEK).

04 Navigate to Eventarc console available at https://console.cloud.google.com/eventarc/.

05 In the left navigation panel, under Standard, choose Channels to access the list of Google Cloud Eventarc channels available for the selected GCP project.

06 Click on the name (link) of the Google Eventarc channel created for the selected project, listed in the Name column. A Google channel refers to a channel where the Provider is Google.

07 In the Encryption section, perform the following actions:

  1. Check the Use a customer-managed encryption key (CMEK) settings checkbox to show the encryption settings available for your channel.
  2. For Keys, choose the location of your CMEK from the Region dropdown list, and select the name of your new Customer-Managed Encryption Key (CMEK) from the CMEK encryption key dropdown list.
  3. Inside the \ service account does not have the "cloudkms.cryptoKeyEncrypterDecrypter" role. Verify the service account has permission to encrypt/decrypt with the selected key box, choose GRANT to grant the associated service account access to your key using the Cloud KMS CryptoKey Encrypter/Decrypter role.
  4. Choose SAVE to apply the changes. This will enable CMEK-based encryption for your Google Eventarc channel.

08 Repeat steps no. 6 and 7 for each Google Eventarc channel that you want to configure, available within the selected GCP project.

09 Repeat steps no. 2 – 8 for each GCP project deployed in your Google Cloud account.

Using GCP CLI

01 Before you can create your own Customer-Managed Encryption Key (CMEK), you have to provision a key ring. A Cloud KMS key ring is a grouping of cryptographic keys made available for organizational purposes in a specific Google Cloud location. Run kms keyrings create command (Windows/macOS/Linux) to create a new Cloud KMS key ring in the specified location. If the keys deployed later within this key ring will be used to encrypt resources in a given region, select that region as the key ring location: 

gcloud kms keyrings create cc-project5-key-ring
	--location=us-central1
	--project=cc-web-project-123123
	--format="table(name)"

02 The command output should return the resource name of the newly created key ring: 

NAME: projects/cc-web-project-123123/locations/us-central1/keyRings/cc-project5-key-ring

03 Run kms keys create command (Windows/macOS/Linux) to create a new Customer-Managed Encryption Key (CMEK) within the Cloud KMS key ring created at the previous steps: 

gcloud kms keys create cc-eventarc-kms-key
	--location=us-central1
	--keyring=cc-project5-key-ring
	--purpose=encryption
	--protection-level=software
	--rotation-period=90d
	--next-rotation-time=2025-06-15T10:00:00.0000Z
	--format="table(name)"

04 The command output should return the full resource name of the new Customer-Managed Encryption Key: 

NAME: projects/cc-web-project-123123/locations/us-central1/keyRings/cc-project5-key-ring/cryptoKeys/cc-eventarc-kms-key

05 Run kms keys add-iam-policy-binding command (Windows/macOS/Linux) to add the required IAM policy binding to your CMEK. This assigns the Cloud KMS CryptoKey Encrypter/Decrypter role to the associated service account (i.e., service-\<project-number\>@gcp-sa-eventarc.iam.gserviceaccount.com). Replace \<project-number\> with your Google Cloud Platform (GCP) project number: 

gcloud kms keys add-iam-policy-binding cc-eventarc-kms-key
	--keyring=cc-project5-key-ring
	--location=us-central1
	--member='serviceAccount:service-<project-number>@gcp-sa-eventarc.iam.gserviceaccount.com'
	--role=roles/cloudkms.cryptoKeyEncrypterDecrypter

06 The command output should return the updated IAM policy (YAML format): 

Updated IAM policy for key [cc-eventarc-kms-key].
bindings:
- members:
	- serviceAccount:service-123456789012@gcp-sa-eventarc.iam.gserviceaccount.com
	role: roles/cloudkms.cryptoKeyEncrypterDecrypter
etag: ABCD1234ABCD
version: 1

07 Run eventarc google-channels update command (Windows/macOS/Linux) to enable data encryption with Cloud KMS Customer-Managed Encryption Keys (CMEKs) for your Google Eventarc channel. For --crypto-key parameter, specify the fully qualified identifier of the CMEK returned in step no 4 (the command does not produce an output): 

gcloud eventarc google-channels update
	--location="us-central1"
	--crypto-key="projects/cc-web-project-123123/locations/us-central1/keyRings/cc-project5-key-ring/cryptoKeys/cc-eventarc-kms-key"

08 Repeat step no. 7 for each Google Eventarc channel that you want to configure, available in the selected GCP project.

09 Repeat steps no. 1 – 8 for each GCP project deployed in your Google Cloud account.

Case B: To enable encryption with Customer-Managed Encryption Keys (CMEKs) for your third-party Eventarc channels, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 To create and configure your new Customer-Managed Encryption Key (CMEK), perform the following actions:

  1. Navigate to Key management console available at https://console.cloud.google.com/security/kms.
  2. Before you can set up and configure your Customer-Managed Encryption Key (CMEK), you must create a key ring. A Cloud KMS key ring is a grouping of cryptographic keys made available for organizational purposes in a specific location. To get started, choose CREATE KEY RING to set up the required key ring.
  3. A key ring requires a name and a location. On the Create key ring setup page, provide a unique name in the Key ring name box, select the key location type from the Location type list, then choose the appropriate key location from the Region/Multi-region dropdown list. The location can be either multi-region or associated with a particular region. If the CMEKs created later within this key ring will be used to encrypt/decrypt data in a particular region, select that region as the key ring location. Choose CREATE to deploy the new key ring.
  4. On the Create key setup page, provide the following information:
    1. For Name and protection level, provide a unique name for your new KMS key in the Key name box and choose the protection level that you want to use from the Protection Level dropdown list. Choose CONTINUE to continue the setup process.
    2. For Key material, choose Generated key to generate the key material for you (recommended). Choose CONTINUE.
    3. For Purpose and algorithm, choose Symmetric encrypt/decrypt to define the types of operations that your cryptographic key can perform. Choose CONTINUE to continue the setup.
    4. For Versions, configure the key rotation period as necessary. Choose CONTINUE.
    5. For Additional settings (optional), set the duration for the scheduled for destruction (i.e., soft deleted) state before the key is removed from the system. Choose ADD LABEL and use the Key and Value text fields to create labels in order to organize the identity of the new key.
    6. Choose CREATE to deploy your new Cloud KMS Customer-Managed Encryption Key (CMEK).

04 Navigate to Eventarc console available at https://console.cloud.google.com/eventarc/.

05 In the left navigation panel, under Standard, choose Channels to access the list of Google Cloud Eventarc channels available for the selected GCP project.

06 Click on the name (link) of the Eventarc channel that you want to configure, listed in the Name column. A third-party channel refers to a channel where the Provider is any provider other than Google.

07 Chose EDIT from the top menu to modify the channel configuration settings.

08 In the Encryption section, choose Cloud KMS key, select Cloud KMS for Key type, and choose the name of your new Customer-Managed Encryption Key (CMEK) from the Select a Cloud KMS key dropdown list. Inside the \ service account does not have the "cloudkms.cryptoKeyEncrypterDecrypter" role. Verify the service account has permission to encrypt/decrypt with the selected key box, choose GRANT to grant the associated service account access to your key using the Cloud KMS CryptoKey Encrypter/Decrypter role. Choose SAVE to apply the changes. This will enable CMEK-based encryption for the selected third-party Eventarc channel.

09 Repeat steps no. 6 - 8 for each third-party Eventarc channel that you want to configure, available within the selected GCP project.

10 Repeat steps no. 2 – 9 for each GCP project deployed in your Google Cloud account.

Using GCP CLI

01 Before you can create your own Customer-Managed Encryption Key (CMEK), you have to provision a key ring. A Cloud KMS key ring is a grouping of cryptographic keys made available for organizational purposes in a specific Google Cloud location. Run kms keyrings create command (Windows/macOS/Linux) to create a new Cloud KMS key ring in the specified location. If the keys deployed later within this key ring will be used to encrypt resources in a given region, select that region as the key ring location: 

gcloud kms keyrings create cc-project5-key-ring
	--location=us-central1
	--project=cc-web-project-123123
	--format="table(name)"

02 The command output should return the resource name of the newly created key ring: 

NAME: projects/cc-web-project-123123/locations/us-central1/keyRings/cc-project5-key-ring

03 Run kms keys create command (Windows/macOS/Linux) to create a new Customer-Managed Encryption Key (CMEK) within the Cloud KMS key ring created at the previous steps: 

gcloud kms keys create cc-eventarc-kms-key
	--location=us-central1
	--keyring=cc-project5-key-ring
	--purpose=encryption
	--protection-level=software
	--rotation-period=90d
	--next-rotation-time=2025-06-15T10:00:00.0000Z
	--format="table(name)"

04 The command output should return the full resource name of the new Customer-Managed Encryption Key: 

NAME: projects/cc-web-project-123123/locations/us-central1/keyRings/cc-project5-key-ring/cryptoKeys/cc-eventarc-kms-key

05 Run kms keys add-iam-policy-binding command (Windows/macOS/Linux) to add the required IAM policy binding to your CMEK. This assigns the Cloud KMS CryptoKey Encrypter/Decrypter role to the associated service account (i.e., service-\<project-number\>@gcp-sa-eventarc.iam.gserviceaccount.com). Replace \<project-number\> with your Google Cloud Platform (GCP) project number: 

gcloud kms keys add-iam-policy-binding cc-eventarc-kms-key
	--keyring=cc-project5-key-ring
	--location=us-central1
	--member='serviceAccount:service-<project-number>@gcp-sa-eventarc.iam.gserviceaccount.com'
	--role=roles/cloudkms.cryptoKeyEncrypterDecrypter

06 The command output should return the updated IAM policy (YAML format): 

Updated IAM policy for key [cc-eventarc-kms-key].
bindings:
- members:
	- serviceAccount:service-123456789012@gcp-sa-eventarc.iam.gserviceaccount.com
	role: roles/cloudkms.cryptoKeyEncrypterDecrypter
etag: ABCD1234ABCD
version: 1

07 Run eventarc channels update command (Windows/macOS/Linux) to enable data encryption with Cloud KMS Customer-Managed Encryption Keys (CMEKs) for your third-party Eventarc channel. For --crypto-key command parameter, specify the fully qualified identifier of the CMEK returned in step no 4: 

gcloud eventarc channels update "projects/cc-web-project-123123/locations/us-central1/channels/cc-project5-eventarc-channel"
	--location="us-central1"
	--crypto-key="projects/cc-web-project-123123/locations/us-central1/keyRings/cc-project5-key-ring/cryptoKeys/cc-eventarc-kms-key"

08 The command output should return the update operation status: 

Updating channel [cc-project5-eventarc-channel] in project [cc-web-project-123123], location [us-central1]... done.

09 Repeat steps no. 7 and 8 for each third-party Eventarc channel that you want to configure, available in the selected GCP project.

10 Repeat steps no. 1 – 11 for each GCP project deployed in your Google Cloud account.

References

Publication date Apr 11, 2025

Related Eventarc rules