Cloud Key Management Service (KMS)
Manage encryption keys on Google Cloud.
Overview
Cloud Key Management Service (KMS) allows you to create, import, and manage cryptographic keys and perform cryptographic operations in a centralized way. You can use these keys to encrypt data in other Google Cloud services (CMEK - Customer-Managed Encryption Keys) or directly in your own applications. The service provides both software-backed and hardware-backed (HSM) key protection.
✨ Key Features
- Centralized key management
- Customer-Managed Encryption Keys (CMEK) integrations
- Hardware Security Module (HSM) support
- Key rotation and versioning
- Fine-grained access control with IAM
- Cloud Audit Logs for all key operations
🎯 Key Differentiators
- FIPS 140-2 Level 3 validated HSMs
- Uniform CMEK experience across many GCP services
- Global and regional key options
Unique Value: Provides a secure, scalable, and compliant way to manage cryptographic keys, giving customers control over the encryption of their data in the cloud.
🎯 Use Cases (4)
✅ Best For
- Encrypting a BigQuery dataset with a customer-managed key
- Encrypting persistent disks for Compute Engine VMs
- Using the API to encrypt and decrypt sensitive data within an application
💡 Check With Vendor
Verify these considerations match your specific requirements:
- Storing large secrets (use Secret Manager)
- Certificate management (use Certificate Authority Service)
🏆 Alternatives
Offers a consistent and easy-to-use CMEK model across a wide range of services and provides a high level of security with its HSM-backed keys, which is a key differentiator for regulated industries.
💻 Platforms
🔌 Integrations
🛟 Support Options
- ✓ Email Support
- ✓ Live Chat
- ✓ Phone Support
- ✓ Dedicated Support (Enterprise Support tier)
🔒 Compliance & Security
💰 Pricing
Free tier: A number of free key versions and cryptographic operations per month.
🔄 Similar Tools in GCP Security Tools
Google Cloud Security Command Center
Centralized visibility and control over your cloud security posture....
Google Cloud Armor
Protects Google Cloud applications and websites from denial of service and web attacks....
Chronicle Security Operations
A security operations suite that ingests and analyzes security telemetry to detect and respond to th...
BeyondCorp Enterprise
Enables secure access to applications and resources based on user and device trust, regardless of ne...
Cloud Data Loss Prevention (DLP)
A fully managed service to help you manage sensitive data....
Cloud IDS
Detects malware, spyware, command-and-control attacks, and other network threats....