What is Cloud External Key Manager?
Cloud External Key Manager (EKM) enables the use of encryption keys from external key management systems. The keys never leave your own infrastructure. Google Cloud accesses the external key manager at runtime.
Core Features
- External key storage: Keys remain in your own HSM
- Transparent encryption: Integration with CMEK-enabled GCP services
- Key Access Justifications: Logs show why keys were accessed
- Partner ecosystem: Certified integrations with leading HSM providers
- VPC-SC integration: Additional protection through Service Perimeter
Common Use Cases
Regulatory Compliance
Industries like financial services or healthcare often require encryption keys to be stored outside the cloud provider.
Key Sovereignty
Companies retain complete control over keys. Revoking access makes cloud data immediately inaccessible.
Zero-Trust Security
EKM as part of a zero-trust architecture. Google has no access to unencrypted data without explicit key access.
Benefits
- Complete control over encryption keys
- Keys never in Google infrastructure
- Audit trail for all key accesses
- Meets strict compliance requirements
Note
Cloud EKM requires an external key manager from a certified partner. The additional latency from external calls should be considered for time-critical workloads.
Integration with innFactory
As a Google Cloud Partner, innFactory supports you with Cloud EKM: architecture, partner selection, integration, and compliance consulting.
Available Tiers & Options
Standard
- Keys outside Google infrastructure
- Regulatory compliance
- Customer key control
- Additional latency
- External HSM required
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Cloud External Key Manager?
Cloud EKM enables the use of encryption keys stored in external HSM systems for encrypting GCP data.
Which external key managers are supported?
Cloud EKM supports Thales CipherTrust Manager, Fortanix DSM, Equinix SmartKey, and other certified partners.
Why should I use Cloud EKM?
EKM is for scenarios where keys must be stored outside of Google. Typical reasons are regulatory requirements or key sovereignty.
What happens if the external key manager is unreachable?
Without access to the external key manager, encrypted data cannot be decrypted. High availability of the external HSM is critical.
How does EKM differ from Cloud HSM?
With Cloud HSM, keys are in Google-managed HSMs. With EKM, keys remain entirely outside Google in your own HSM.
