This page describes how customer-managed encryption keys (CMEK) work with Database Migration Service migration jobs.
Is CMEK right for you?
CMEK is intended for organizations that have sensitive or regulated data that requires them to manage their encryption keys.
Google-managed encryption versus customer-managed encryption
The CMEK feature lets you use your own cryptographic keys for data transported by Database Migration Service. After adding CMEK, whenever an API call is made, Database Migration Service uses your key to access data.
CMEK, including software, hardware, and external keys, are all managed through the Cloud Key Management Service (KMS) API.
Which locations support CMEK-enabled Database Migration Service migration jobs?
CMEK is available in all Database Migration Service locations.
Understand service accounts
When your Database Migration Service migration jobs have CMEK enabled, you need to use a service account to request key access from Cloud Key Management Service.
To use a CMEK on a project, you must have a service account and you must grant the key access to the service account. The service account must exist inside of the project. The service account is visible in all regions.
Understand keys
In Cloud Key Management Service, you need to create a keyring with a cryptographic key, set with a location. When you create a new migration job in Database Migration Service, you select this key to encrypt the migration job.
You need to know the key ID and key region when you create new migration jobs that use CMEK. You must put the destination databases in the same region as the CMEK associated with the migration job. You can create one project for both keys and destination databases, or different projects for each.
CMEK uses the following format:
projects/[CMEK_ENABLED_PROJECT]/locations/[REGION]/keyRings/[RING_NAME]/cryptoKeys/[KEYNAME]