Use Customer-Managed Encryption Keys for Dialogflow CX Agents

Sign in to the Google Cloud Management Console.

Navigate to Conversational Agents (Dialogflow CX) console available at https://conversational-agents.cloud.google.com/.

Select the Google Cloud Platform (GCP) project that you want to examine from the Project dropdown menu available in the console top navigation bar.

In the Agents section, choose the Dialogflow CX agent that you want to examine and check the configuration value listed in the Using CMEK column to determine the type of the encryption key used by the selected agent. If the value listed in the Using CMEK column is No, the data managed by the selected Dialogflow CX agent is not encrypted using a Cloud KMS Customer-Managed Encryption Key (CMEK).

Repeat step no. 4 for each Conversational Agents (Dialogflow CX) agent available within the selected GCP project.

Repeat steps no. 3 and 4 for each GCP project deployed within your Google Cloud account.

Sign in to the Google Cloud Management Console.

Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar (must match the project where you plan to deploy your Dialogflow CX agent).

To create and configure your new Customer-Managed Encryption Key (CMEK), perform the following actions:

1. Navigate to Key management console available at https://console.cloud.google.com/security/kms.
2. Before you can set up and configure your Customer-Managed Encryption Key (CMEK), you must create a key ring. A Cloud KMS key ring is a grouping of cryptographic keys made available for organizational purposes in a specific location. To get started, choose CREATE KEY RING to set up the required key ring.
3. A key ring requires a name and a location. On the Create key ring setup page, provide a unique name in the Key ring name box, select Region from the Location type list, then choose the appropriate key location from the Region dropdown list (must match the region where you plan to deploy your Dialogflow CX agent). Choose CREATE to deploy the new key ring.
4. On the Create key setup page, provide the following information:
   1. For Name and protection level, provide a unique name for your new KMS key in the Key name box and choose the protection level that you want to use from the Protection Level dropdown list. Choose CONTINUE to continue the setup process.
   2. For Key material, choose Generated key to generate the key material for you (recommended). Choose CONTINUE.
   3. For Purpose and algorithm, choose Symmetric encrypt/decrypt to define the types of operations that your cryptographic key can perform. Choose CONTINUE to continue the setup.
   4. For Versions, configure the key rotation period as necessary. Choose CONTINUE.
   5. For Additional settings (optional), set the duration for the scheduled for destruction (i.e., soft deleted) state before the key is removed from the system. Choose ADD LABEL and use the Key and Value text fields to create labels in order to organize the identity of the new key.
   6. Choose CREATE to deploy your new Cloud KMS Customer-Managed Encryption Key (CMEK).

On the Keys listing page, choose the newly created Cloud KMS key, select the Actions button (i.e., 3-dot icon), and choose Copy resource name to copy the full ID of the new KMS key.

Navigate to CCAI (Contact Center AI) console available at https://ccai.cloud.google.com/.

Select the Google Cloud Platform (GCP) project that you want to examine from the Project dropdown menu available in the console top navigation bar.

Choose the CMEK tab and perform the following actions:

1. Choose Check or create service account next to Before adding CMEK keys, you need to create a CCAI CMEK service account. This will create the required service account. Ensure that the new service account has the Cloud KMS CryptoKey Encrypter/Decrypter role.
2. Choose + (plus icon) next to the Google Cloud region where you plan to deploy your Dialogflow CX agent, paste the KMS key ID copied in step no. 4, and select OK (i.e., check icon) to apply the changes.

Navigate to Conversational Agents (Dialogflow CX) console available at https://conversational-agents.cloud.google.com/.

Select the Google Cloud Platform (GCP) project that you want to access from the Project dropdown menu available in the console top navigation bar.

In the Agents section, choose Create agent, and perform the following operations to create a new CMEK-encrypted Dialogflow CX agent:

1. For Get started with Conversational Agents, choose Build your own to create your own agent.
2. For Display name, provide a unique name for your agent.
3. For Location, choose the region where to deploy your Dialogflow CX agent. Once the correct region is selected, the Console should display the following message: This region is using CMEK.
4. For Time zone, select the appropriate time zone. Date and time requests are resolved using the time zone selected in this step.
5. For Default language, choose the language the agent uses.
6. For Conversation start, choose how your agent starts each conversation.
7. Choose Create to deploy your new CMEK-encrypted Dialogflow CX agent.

Repeat step no. 10 for each Conversational Agents (Dialogflow CX) agent that you want to deploy for the selected GCP project.

Repeat steps no. 2 – 11 for each GCP project deployed in your Google Cloud account.