Ensure GCP Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK)

Error: GCP Big Query Tables are not encrypted with Customer Supplied Encryption Keys (CSEK)

Bridgecrew Policy ID: BC_GCP_GENERAL_32
Checkov Check ID: CKV_GCP_81
Severity: LOW

GCP Big Query Tables are not encrypted with Customer Supplied Encryption Keys (CSEK)

Description

Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage that is available for Big Query Tables. Google does not store your keys on its servers and cannot access your protected data unless you provide the key. If you forget or lose your key Google is unable to recover the key or to recover any data encrypted with that key. To control and manage this encryption yourself, you must provide your own encryption keys.

We recommend you supply your own encryption keys for Google to use, at a minimum to encrypt business critical Big Query Tables. This helps protect the Google-generated keys used to encrypt and decrypt your data.

Fix - Runtime

Fix - Buildtime

Terraform

resource "google_bigquery_dataset" "pass" {
  dataset_id                  = var.dataset.dataset_id
  friendly_name               = var.dataset.friendly_name
  description                 = var.dataset.description
  location                    = var.location
  default_table_expiration_ms = var.dataset.default_table_expiration_ms

  default_encryption_configuration {
    kms_key_name = google_kms_crypto_key.example.name
  }
}