Skip to content

Latest commit

 

History

History
58 lines (46 loc) · 3.24 KB

README.md

File metadata and controls

58 lines (46 loc) · 3.24 KB
Raw

GCE and GCS CMEK via centralized Cloud KMS

This example creates a sample centralized Cloud KMS configuration, and uses it to implement CMEK for Cloud Storage and Compute Engine in a separate project.

The example is designed to match real-world use cases with a minimum amount of resources, and be used as a starting point for scenarios where application projects implement CMEK using keys managed by a central team. It also includes the IAM wiring needed to make such scenarios work.

This is the high level diagram:

High-level diagram

Managed resources and services

This sample creates several distinct groups of resources:

  • projects
    • Cloud KMS project
    • Service Project configured for GCE instances and GCS buckets
  • networking
    • VPC network
    • One subnet
    • Firewall rules for SSH access via IAP and open communication within the VPC
  • IAM
    • One service account for the GGE instance
  • KMS
    • One key ring
    • One crypto key (Protection level: software) for Cloud Engine
    • One crypto key (Protection level: software) for Cloud Storage
  • GCE
    • One instance encrypted with a CMEK Cryptokey hosted in Cloud KMS
  • GCS
    • One bucket encrypted with a CMEK Cryptokey hosted in Cloud KMS

Variables

name description type required default
billing_account Billing account id used as default for new projects. string ✓
root_node The resource name of the parent Folder or Organization. Must be of the form folders/folder_id or organizations/org_id. string ✓
location The location where resources will be deployed. string "europe"
project_kms_name Name for the new KMS Project. string "my-project-kms-001"
project_service_name Name for the new Service Project. string "my-project-service-001"
region The region where resources will be deployed. string "europe-west1"
vpc_ip_cidr_range Ip range used in the subnet deployef in the Service Project. string "10.0.0.0/20"
vpc_name Name of the VPC created in the Service Project. string "local"
vpc_subnet_name Name of the subnet created in the Service Project. string "subnet"

Outputs

name description sensitive
bucket GCS Bucket URL.
bucket_keys GCS Bucket Cloud KMS crypto keys.
projects Project ids.
vm GCE VM.
vm_keys GCE VM Cloud KMS crypto keys.