This example creates a sample centralized Cloud KMS configuration, and uses it to implement CMEK for Cloud Storage and Compute Engine in a separate project.
The example is designed to match real-world use cases with a minimum amount of resources, and be used as a starting point for scenarios where application projects implement CMEK using keys managed by a central team. It also includes the IAM wiring needed to make such scenarios work.
This is the high level diagram:
This sample creates several distinct groups of resources:
- projects
- Cloud KMS project
- Service Project configured for GCE instances and GCS buckets
- networking
- VPC network
- One subnet
- Firewall rules for SSH access via IAP and open communication within the VPC
- IAM
- One service account for the GGE instance
- KMS
- One key ring
- One crypto key (Protection level: software) for Cloud Engine
- One crypto key (Protection level: software) for Cloud Storage
- GCE
- One instance encrypted with a CMEK Cryptokey hosted in Cloud KMS
- GCS
- One bucket encrypted with a CMEK Cryptokey hosted in Cloud KMS
| name | description | type | required | default |
|---|---|---|---|---|
| billing_account | Billing account id used as default for new projects. | string |
✓ | |
| root_node | The resource name of the parent Folder or Organization. Must be of the form folders/folder_id or organizations/org_id. | string |
✓ | |
| location | The location where resources will be deployed. | string |
"europe" |
|
| project_kms_name | Name for the new KMS Project. | string |
"my-project-kms-001" |
|
| project_service_name | Name for the new Service Project. | string |
"my-project-service-001" |
|
| region | The region where resources will be deployed. | string |
"europe-west1" |
|
| vpc_ip_cidr_range | Ip range used in the subnet deployef in the Service Project. | string |
"10.0.0.0/20" |
|
| vpc_name | Name of the VPC created in the Service Project. | string |
"local" |
|
| vpc_subnet_name | Name of the subnet created in the Service Project. | string |
"subnet" |
| name | description | sensitive |
|---|---|---|
| bucket | GCS Bucket URL. | |
| bucket_keys | GCS Bucket Cloud KMS crypto keys. | |
| projects | Project ids. | |
| vm | GCE VM. | |
| vm_keys | GCE VM Cloud KMS crypto keys. |