Home › Associate Cloud Engineer › Section 5: Configuring Access and Security › Cloud KMS

Cloud KMS Study Notes

By the Cloud Cert Notes Editorial Team
Last updated: November 2026

Cloud Key Management Service (Cloud KMS) lets you create, manage, and use cryptographic keys to protect data in Google Cloud. It underpins customer-managed encryption keys (CMEK) for services such as Cloud Storage, BigQuery, and Compute Engine persistent disks.

Exam tip: If the question mentions controlling rotation or revoking access to encrypted data at rest, the answer is CMEK with Cloud KMS.

Key facts

Keys are organized as key rings inside a location, and a key ring's location is permanent and should match the location of the data it protects.
A key has one or more versions; one version is marked primary and is used for encryption, while older versions remain available for decryption until destroyed.
Key purposes include symmetric encrypt/decrypt, asymmetric signing, and asymmetric decryption, and the purpose chosen at creation cannot be changed later.
Automatic rotation can be configured for symmetric keys so a new primary version is created on a schedule you define.
Destroying a key version is scheduled with a delay period by default, giving time to cancel, after which material is unrecoverable and data encrypted with it cannot be read.
With CMEK, Google services use your Cloud KMS key to encrypt data at rest, and disabling the key version makes that data inaccessible to the service.
Customer-supplied encryption keys (CSEK) for Compute Engine and Cloud Storage mean you provide raw key material per operation and Google does not store it.
Software keys are protected in Google data centers, HSM keys are backed by FIPS 140-2 Level 3 hardware modules, and external keys are managed outside Google through Cloud EKM.
IAM permissions on keys are separate from data access: a user needs both access to the resource and permission to use its key for CMEK operations.

What the exam expects you to know

Select CMEK when a scenario requires customer control over key rotation, disabling, or destruction for data at rest in Google services.
Explain envelope encryption conceptually: a data encryption key encrypts the data and a key encryption key in KMS wraps that key.
Know that Google encrypts all data at rest by default with Google-managed keys, so KMS is about control and compliance, not enabling encryption.
Place key rings in the same region or multi-region as the protected resource, since key location cannot be changed after creation.
Use rotation policies and scheduled destruction carefully, understanding that destroying a version permanently destroys access to its ciphertext.
Distinguish protection levels: software, HSM for regulated workloads needing hardware backing, and EKM when keys must stay in an external manager.

Cloud KMS vs Secret Manager: when to use which

Use Cloud KMS when you need cryptographic keys to encrypt data, sign artifacts, or provide CMEK for Google services such as BigQuery and Cloud Storage. Use Secret Manager when you need to store and retrieve a secret value itself, such as a password, token, or API key, for an application to use at runtime. KMS never returns your key material to you; Secret Manager does return the stored secret to authorized callers. Exam wording decides it: 'encrypt this dataset with our own key' is KMS, while 'store this database password securely' is Secret Manager. See also the Secret Manager notes.

Useful gcloud commands

gcloud kms keyrings create my-ring --location=global
gcloud kms keys create my-key --keyring=my-ring --location=global --purpose=encryption
gcloud kms encrypt --key=my-key --keyring=my-ring --location=global --plaintext-file=plain.txt --ciphertext-file=cipher.txt
gcloud kms keys versions destroy 1 --key=my-key --keyring=my-ring --location=global

Common exam traps

KMS keys cannot be exported or downloaded; if a scenario needs to retrieve a stored password value, KMS is the wrong service entirely.
Disabling or destroying a CMEK key version immediately blocks access to data encrypted with it, which can cause outages if done casually.
Key rings and keys cannot be moved between locations or projects after creation, so choosing the wrong region means recreating the key.
Rotation creates a new version for future encryption but does not automatically re-encrypt existing data, which stays readable through its original version.

Frequently asked questions

What is the difference between CMEK and CSEK?

With CMEK, keys live in Cloud KMS under your control and Google services request them when needed, so rotation and disabling are managed centrally. With CSEK, you supply the raw key with each operation and Google does not persist it, which gives control but puts key delivery and loss risk entirely on you.

Does deleting a project delete its KMS keys?

No, key destruction is a separate scheduled operation with a waiting period by default, and key material is not removed simply because a resource using it is deleted. Administrators must explicitly disable or destroy key versions. This separation protects against accidental permanent data loss from a single mistaken deletion.

Why choose an HSM key over a software key?

HSM keys keep key material inside FIPS 140-2 Level 3 certified hardware modules, which some regulations and enterprise policies require. Software keys use the same API and features but are protected in software. On the exam, wording about strict compliance or hardware-backed protection points to the HSM protection level.

Study aid disclaimer: Cloud Cert Notes is an independent educational study aid. It is not affiliated with, endorsed by, or sponsored by Google, Microsoft, Amazon, Oracle, or Alibaba. Google Cloud, Associate Cloud Engineer, and Cloud Digital Leader are trademarks of Google LLC; all other certification names and product names are trademarks of their respective owners. Always confirm service details against the official provider documentation before sitting an exam.