Use Customer-Managed Encryption Keys for Eventarc GoogleApiSources

Sign in to the Google Cloud Management Console.

Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

Navigate to Eventarc console available at https://console.cloud.google.com/eventarc/.

In the left navigation panel, under Advanced, choose Bus to access the Eventarc message bus available for the selected GCP project.

Choose EDIT from the top menu to view the message source configured for the selected message bus.

In the Message source section, find the google-api-source message source, and check the Encryption attribute value to determine the type of the encryption key used by the selected resource. If the Encryption attribute value is Event messages encrypted using Google-managed encryption keys, the collection of events coming from the associated Eventarc GoogleApiSource resource is not encrypted using a Cloud KMS Customer-Managed Encryption Key (CMEK).

Repeat steps no. 2 - 6 for each GCP project deployed within your Google Cloud account.

Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each project available in your Google Cloud Platform (GCP) account:

gcloud projects list
	--format="table(projectId)"

The command output should return the requested GCP project IDs:

PROJECT_ID
cc-web-project-123123
cc-ai-project-112233
cc-dev-project-112233

Run eventarc google-api-sources list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to list the Eventarc GoogleApiSource resources available for the selected project:

gcloud beta eventarc google-api-sources list
	--project=cc-web-project-123123
	--format="default(name)"

The command request should return the requested GoogleApiSource IDs (i.e., fully qualified identifiers):

---
name: projects/cc-web-project-123123/locations/us-central1/googleApiSources/google-api-source

Run eventarc google-api-sources describe command (Windows/macOS/Linux) with the ID of the Eventarc GoogleApiSource resource that you want to examine as the identifier parameter, to describe the full ID of the Customer-Managed Encryption Key (CMEK) used to encrypt the data managed by the selected Eventarc resource:

gcloud beta eventarc google-api-sources describe "projects/cc-web-project-123123/locations/us-central1/googleApiSources/google-api-source"
	--format="json(cryptoKeyName)"

The command output should return the ID of the requested encryption key:

null

If the eventarc google-api-sources describe command output returns null, as shown in the example above, the collection of events coming from the associated Eventarc GoogleApiSource resource is not encrypted using a Cloud KMS Customer-Managed Encryption Key (CMEK).

Repeat steps no. 3 – 6 for each GCP project deployed in your Google Cloud account.

Sign in to the Google Cloud Management Console.

Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

To create and configure your new Customer-Managed Encryption Key (CMEK), perform the following actions:

1. Navigate to Key management console available at https://console.cloud.google.com/security/kms.
2. Before you can set up and configure your Customer-Managed Encryption Key (CMEK), you must create a key ring. A Cloud KMS key ring is a grouping of cryptographic keys made available for organizational purposes in a specific location. To get started, choose CREATE KEY RING to set up the required key ring.
3. A key ring requires a name and a location. On the Create key ring setup page, provide a unique name in the Key ring name box, select the key location type from the Location type list, then choose the appropriate key location from the Region/Multi-region dropdown list. The location can be either multi-region or associated with a particular region. If the CMEKs created later within this key ring will be used to encrypt/decrypt data in a particular region, select that region as the key ring location. Choose CREATE to deploy the new key ring.
4. On the Create key setup page, provide the following information:
   1. For Name and protection level, provide a unique name for your new KMS key in the Key name box and choose the protection level that you want to use from the Protection Level dropdown list. Choose CONTINUE to continue the setup process.
   2. For Key material, choose Generated key to generate the key material for you (recommended). Choose CONTINUE.
   3. For Purpose and algorithm, choose Symmetric encrypt/decrypt to define the types of operations that your cryptographic key can perform. Choose CONTINUE to continue the setup.
   4. For Versions, configure the key rotation period as necessary. Choose CONTINUE.
   5. For Additional settings (optional), set the duration for the scheduled for destruction (i.e., soft deleted) state before the key is removed from the system. Choose ADD LABEL and use the Key and Value text fields to create labels in order to organize the identity of the new key.
   6. Choose CREATE to deploy your new Cloud KMS Customer-Managed Encryption Key (CMEK).

Navigate to Eventarc console available at https://console.cloud.google.com/eventarc/.

In the left navigation panel, under Advanced, choose Bus to access the Eventarc message bus available for the selected GCP project.

Chose EDIT from the top menu to modify the message bus configuration settings.

In the Message source section, perform the following actions:

1. Find the google-api-source message source, and click on the Delete button (bin icon) to remove the existing, non-compliant message source from your Eventarc bus. In the Delete resource box, choose CONFIRM to confirm the resource removal.
2. Choose ADD SOURCE, ensure that Source name is set to google-api-source, and select the log severity level for the new message source. In the Encryption section, choose Cloud KMS key, select Cloud KMS for Key type, and choose the name of your new Customer-Managed Encryption Key (CMEK) from the Select a Cloud KMS key dropdown list. Inside the \ service account does not have the "cloudkms.cryptoKeyEncrypterDecrypter" role. Verify the service account has permission to encrypt/decrypt with the selected key box, choose GRANT to grant the associated service account access to your key using the Cloud KMS CryptoKey Encrypter/Decrypter role. Choose CREATE to deploy your Eventarc GoogleApiSource resource. This will enable CMEK-based encryption for your new Eventarc GoogleApiSource resource.

Repeat steps no. 2 – 7 for each GCP project deployed in your Google Cloud account.

Before you can create your own Customer-Managed Encryption Key (CMEK), you have to provision a key ring. A Cloud KMS key ring is a grouping of cryptographic keys made available for organizational purposes in a specific Google Cloud location. Run kms keyrings create command (Windows/macOS/Linux) to create a new Cloud KMS key ring in the specified location. If the keys deployed later within this key ring will be used to encrypt resources in a given region, select that region as the key ring location:

gcloud kms keyrings create cc-project5-key-ring
	--location=us-central1
	--project=cc-web-project-123123
	--format="table(name)"

The command output should return the resource name of the newly created key ring:

NAME: projects/cc-web-project-123123/locations/us-central1/keyRings/cc-project5-key-ring

Run kms keys create command (Windows/macOS/Linux) to create a new Customer-Managed Encryption Key (CMEK) within the Cloud KMS key ring created at the previous steps:

gcloud kms keys create cc-eventarc-kms-key
	--location=us-central1
	--keyring=cc-project5-key-ring
	--purpose=encryption
	--protection-level=software
	--rotation-period=90d
	--next-rotation-time=2025-10-15T10:00:00.0000Z
	--format="table(name)"

The command output should return the full resource name of the new Customer-Managed Encryption Key:

NAME: projects/cc-web-project-123123/locations/us-central1/keyRings/cc-project5-key-ring/cryptoKeys/cc-eventarc-kms-key

Run kms keys add-iam-policy-binding command (Windows/macOS/Linux) to add the required IAM policy binding to your CMEK. This assigns the Cloud KMS CryptoKey Encrypter/Decrypter role to the associated service account (i.e., the service account with the "eventarc.serviceAgentrole"). For example, service-\<project-number\>@gcp-sa-eventarc.iam.gserviceaccount.com):

gcloud kms keys add-iam-policy-binding cc-eventarc-kms-key
	--keyring=cc-project5-key-ring
	--location=us-central1
	--member='serviceAccount:service-<project-number>@gcp-sa-eventarc.iam.gserviceaccount.com'
	--role=roles/cloudkms.cryptoKeyEncrypterDecrypter

The command output should return the updated IAM policy (YAML format):

Updated IAM policy for key [cc-eventarc-kms-key].
bindings:
- members:
	- serviceAccount:service-123456789012@gcp-sa-eventarc.iam.gserviceaccount.com
	role: roles/cloudkms.cryptoKeyEncrypterDecrypter
etag: ABCD1234ABCD
version: 1

Run eventarc google-api-sources update command (Windows/macOS/Linux) to enable event message encryption with a Cloud KMS Customer-Managed Encryption Key (CMEK) for your Eventarc GoogleApiSource resource. For --crypto-key command parameter, specify the fully qualified identifier of the CMEK returned in step no 4:

gcloud beta eventarc google-api-sources update "projects/cc-web-project-123123/locations/us-central1/googleApiSources/google-api-source"
	--location="us-central1"
	--crypto-key="projects/cc-web-project-123123/locations/us-central1/keyRings/cc-project5-key-ring/cryptoKeys/cc-eventarc-kms-key"

The command output should return the update operation status:

Updating Google API source [google-api-source] in project [cc-web-project-123123], location [us-central1]...done.

Repeat steps no. 1 – 8 for each GCP project deployed in your Google Cloud account.