Ensure GCP data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK)

Error: GCP data flow jobs are not encrypted with Customer Supplied Encryption Keys (CSEK)

Bridgecrew Policy ID: BC_GCP_GENERAL_28
Checkov Check ID: CKV_GCP_90
Severity: LOW

GCP data flow jobs are not encrypted with Customer Supplied Encryption Keys (CSEK)

Description

Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine. Google Compute Engine encrypts all data at rest by default. Compute Engine handles and manages this encryption automatically, with no additional action required. When you provide your own encryption keys Compute Engine uses your key to protect the Google-generated keys used to encrypt and decrypt your data. Only users that provide the correct key can use resources protected by a customer-supplied encryption key. Google does not store your keys on its servers and cannot access your protected data unless you provide the key. If you forget or lose your key Google is unable to recover the key or to recover any data encrypted with that key. To control and manage this encryption yourself, you must provide your own encryption keys.

We recommend you supply your own encryption keys for Google to use, at a minimum to encrypt business critical data flow jobs. This helps protect the Google-generated keys used to encrypt and decrypt your data.

Fix - Runtime

TBD

Fix - Buildtime

Terraform

  • Resource: google_dataflow_job
  • Arguments: kms_key_name
resource "google_dataflow_job" "pass" {
  name              = "dataflow-job"
  template_gcs_path = "gs://my-bucket/templates/template_file"
  temp_gcs_location = "gs://my-bucket/tmp_dir"
  parameters = {
    foo = "bar"
    baz = "qux"
  }
  kms_key_name = "SecretSquirrel"
}