Using Cloud HSM for Multi Region GCS Bucket Encryption

One of the most confusing staff is when you are using GCS Multi Region Bucket for resilience and DR purpose and you want to encrypt your bucket with Cloud HSM, Cloud HSM is a fully managed service that allows you to protect your encryption keys within FIPS 140–2 Level 3 certified Hardware Security Modules (HSMs). When you use Cloud HSM with GCS, the encryption and decryption operations are transparent. GCS automatically uses your key to protect your data as it’s written and read.

The crucial requirement is that the Cloud KMS key must reside in the same location as your GCS bucket. For a multi-region bucket, you must create your HSM key in the corresponding multi-region (e.g., a GCS bucket in the EU multi-region requires a Cloud KMS key in the Europe multi-region).

This guide details how to create a FIPS 140–2 Level 3 compliant hardware-backed encryption key and configure a GCS bucket (Multi Region)to use it for protecting all newly uploaded objects automatically.

Prerequisites

1. A Google Cloud Platform (GCP) Project.
2. The gcloud and gsutil command-line tools installed and authenticated.
3. A GCS bucket. If you don’t have one, create it with gsutil mb -l [BUCKET_LOCATION] gs://[YOUR_BUCKET_NAME].

Step 1: Define Your Configuration

Before running any commands, identify the names and locations you will use. The most critical rule is that the Cloud KMS key’s location must be compatible with the GCS bucket’s location.

• For a multi-region GCS bucket (e.g., EU): Use a multi-region KMS location (e.g., europe).
• For a dual-region GCS bucket (e.g., EUR4): Use the corresponding dual-region KMS location (e.g., eur4).
• For a single-region GCS bucket (e.g., us-central1): Use the same single-region KMS location (e.g., us-central1).

Fill in these placeholder values for your environment:

• [YOUR_PROJECT_ID]: Your GCP Project ID.
• [YOUR_BUCKET_NAME]: The name of your GCS bucket.
• [KMS_LOCATION]: The KMS location that matches your bucket’s location (e.g., europe, us-central1).
• [YOUR_KEY_RING_NAME]: A name for your new key ring (e.g., gcs-hsm-keyring).
• [YOUR_KEY_NAME]: A name for your new encryption key (e.g., gcs-hsm-key).

Step 2: Create a Cloud KMS Key Ring

A key ring is a logical container for your keys in a specific location.

gcloud kms keyrings create [YOUR_KEY_RING_NAME] \

— project [YOUR_PROJECT_ID] \

— location [KMS_LOCATION]

Step 3: Create the Cloud HSM-Backed Key

Create the encryption key within the key ring. The — protection-level “hsm” flag is essential; it ensures the key is generated and managed within a physical Hardware Security Module.

gcloud kms keys create [YOUR_KEY_NAME] \

— project [YOUR_PROJECT_ID] \

— keyring [YOUR_KEY_RING_NAME] \

— location [KMS_LOCATION] \

— purpose “encryption” \

— protection-level “hsm”

Step 4: Grant GCS Permission to Use the Key

Google Cloud Storage requires explicit permission to use your key to encrypt and decrypt data on your behalf. This is done by granting a specific role to the GCS service account.

1. Find your project’s GCS service account email: Each project has a unique, system-managed service account for GCS. Find its email address with this command:

gsutil kms serviceaccount -p [YOUR_PROJECT_ID]

The output will be an email address like service-1234567890@gs-project-accounts.iam.gserviceaccount.com.

1. Grant the necessary role to the service account: Using the email from the previous step, grant it the cloudkms.cryptoKeyEncrypterDecrypter role. Replace [GCS_SERVICE_ACCOUNT_EMAIL] with the email you just found.

gcloud kms keys add-iam-policy-binding [YOUR_KEY_NAME] \

— project [YOUR_PROJECT_ID] \

— keyring [YOUR_KEY_RING_NAME] \

— location [KMS_LOCATION] \

— member “serviceAccount:[GCS_SERVICE_ACCOUNT_EMAIL]” \

— role “roles/cloudkms.cryptoKeyEncrypterDecrypter”

Step 5: Configure the GCS Bucket’s Default Encryption

Apply the key as the default for your bucket. Any new objects uploaded after this command will be automatically encrypted with this key.

Note: This does not affect existing objects. To encrypt them, you must rewrite them (e.g., by copying them onto themselves with gsutil cp gs://[BUCKET]/** gs://[BUCKET]/).

gsutil kms encryption -k \

projects/[YOUR_PROJECT_ID]/locations/[KMS_LOCATION]/keyRings/[YOUR_KEY_RING_NAME]/cryptoKeys/[YOUR_KEY_NAME] \

gs://[YOUR_BUCKET_NAME]

Step 6: Verify the Configuration

Finally, confirm that your setup is working correctly.

1. Create and upload a new test file:

echo “This is a test of Cloud HSM encryption.” > my-test-file.txt

gsutil cp my-test-file.txt gs://[YOUR_BUCKET_NAME]/

2. Inspect the new object’s metadata:

gsutil stat gs://[YOUR_BUCKET_NAME]/my-test-file.txt

3. Analyze the output: Look for the KMS key field in the output. If the setup was successful, it will display the full resource name of your key:

KMS key: projects/[YOUR_PROJECT_ID]/locations/[KMS_LOCATION]/keyRings/[YOUR_KEY_RING_NAME]/cryptoKeys/[YOUR_KEY_NAME]

Seeing this line confirms that your object is protected by your Cloud HSM key.