Spanner Databases Should Be Encrypted With Customer Managed Keys
More Info:
Enusre Spanner database is encrypted with Customer Managed KeysRisk Level
MediumAddress
SecurityCompliance Standards
HIPAA, SOC2, GDPR, ISO27001Triage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Spanner Databases Should Be Encrypted With Customer Managed Keys” for GCP using GCP console, follow the below steps:
- Open the GCP Console and navigate to the Google Cloud Spanner instance for which you want to enable Customer Managed Encryption Keys (CMEK) encryption.
- Click on the instance name to open the instance details page.
- In the left navigation menu, click on “Encryption”.
- On the Encryption page, click on “Edit”.
- In the Encryption Settings dialog box, select “Customer-managed key” as the encryption type.
- Select the key ring and key you want to use to encrypt the data.
- Click on “Save” to apply the changes.
- Once the encryption settings are updated, all the data stored in the Spanner database will be encrypted using the selected customer-managed key.
- Verify that the encryption is working by accessing the data and checking that it is encrypted.
Using CLI
Using CLI
To remediate the misconfiguration “Spanner Databases Should Be Encrypted With Customer Managed Keys” in GCP using GCP CLI, follow the below steps:
- Open the Cloud Shell in the GCP Console.
-
Run the following command to check if any Spanner instances are not encrypted with customer-managed keys:
-
If any Spanner instances are found that are not encrypted with customer-managed keys, then create a new key ring using the following command:
Replace
[KEYRING_NAME]with the desired name for your key ring and[LOCATION]with the desired location for your key ring. -
Create a new key in the key ring using the following command:
Replace
[KEY_NAME]with the desired name for your key and[KEYRING_NAME]and[LOCATION]with the values you used in step 3. -
Grant the Cloud Spanner service account the
cloudkms.cryptoKeyEncrypterDecrypterrole on the key you just created using the following command:Replace[KEY_NAME]and[KEYRING_NAME]with the values you used in step 4, and replace[LOCATION]with the location of your key ring. Also, replace[SERVICE_ACCOUNT_EMAIL]with the email address of the Cloud Spanner service account. -
Update the Spanner instance to use the customer-managed key using the following command:
Replace
[INSTANCE_ID]with the ID of the Spanner instance you want to update,[PROJECT_ID]with the ID of your GCP project,[LOCATION]with the location of your key ring, and[KEYRING_NAME]and[KEY_NAME]with the values you used in step 4. -
Verify that the Spanner instance is now encrypted with the customer-managed key using the following command:
Replace
[INSTANCE_ID]with the ID of the Spanner instance you updated.
Using Python
Using Python
To remediate the misconfiguration “Spanner Databases Should Be Encrypted With Customer Managed Keys” for GCP using Python, you can follow the below steps:By following these steps, you can remediate the misconfiguration “Spanner Databases Should Be Encrypted With Customer Managed Keys” for GCP using Python.
- First, you need to create a new Cloud KMS key ring and key for use with Cloud Spanner. You can use the following Python code to create a new key ring and key:
- Next, you need to enable customer-managed encryption for Cloud Spanner using the newly created key. You can use the following Python code to enable customer-managed encryption:
- Finally, you need to verify that customer-managed encryption is enabled for the Cloud Spanner instance. You can use the following Python code to check the encryption status: