--- title: "Google Key Management (GCP KMS) : Getting Started Guide" description: "Discover how to use Google Cloud Platform Key Management Services (GCP KMS) to manage your keys and secure your infrastructure in this ATA Learning tutorial!" canonical: "https://adamtheautomator.com/gcp-kms/" --- # Google Key Management (GCP KMS) : Getting Started Guide > Discover how to use Google Cloud Platform Key Management Services (GCP KMS) to manage your keys and secure your infrastructure in this ATA Learning tutorial! Source: https://adamtheautomator.com/gcp-kms/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Google Key Management (GCP KMS) : Getting Started Guide](https://adamtheautomator.com/wp-content/uploads/2022/11/Getting-Started-with-Google-Key-Management-GCP-KMS.jpg) # Google Key Management (GCP KMS) : Getting Started Guide [![](https://secure.gravatar.com/avatar/2788bb1a3f735603f81eca51d68daec56a9d97e805a10268fb2c20afcc76b81b?s=192&d=mm&r=g)Nicholas Xuan Nguyen](https://adamtheautomator.com/author/nicholas-xuan-nguyen/)15 November 20228 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Google Cloud](/tag/google-cloud/)[Security](/tag/security/) Table of Contents * [Prerequisites](#prerequisites) * [Enabling the Cloud KMS API for the Google Cloud Project](#enabling-the-cloud-kms-api-for-the-google-cloud-project) * [Starting the Cloud Shell to Create Keys and Keyrings](#starting-the-cloud-shell-to-create-keys-and-keyrings) * [Encrypting and Decrypting Data with GCP KMS](#encrypting-and-decrypting-data-with-gcp-kms) * [Cleaning Up Google Cloud Resources](#cleaning-up-google-cloud-resources) * [Conclusion](#conclusion) Securing data is a top priority for any organization, and encryption is one of the most effective ways to protect data. But how exactly? Google Cloud Platform (GCP) provides a key management service called Google Key Management Service (KMS), which lets you quickly create and manage encryption keys. In this tutorial, you will learn how to create and use a key in GCP KMS. You will also go through some important concepts related to key management, such as keys, keyrings, and key versions. Ready? Read on, and take your data security to the next level! ## Prerequisites This tutorial will be a hands-on demonstration. To follow along, be sure you have a GCP account with active billing, but a [free trial](https://cloud.google.com/free) would suffice. A Google Cloud Project is a collection of resources you create and manage in GCP. Note that you should create separate projects for each of your applications. Doing so lets you efficiently manage the resources for each application. In the end, you can delete all the resources associated with a project, which is helpful for clean-up. To create a new Google Cloud project: 1\. Open your favorite web browser, and log in to the [GCP Console](https://console.cloud.google.com/). Like the AWS console, the GCP console is a web-based interface for managing your resources in Google Cloud. 2\. On your GCP console, navigate to the [Manage Resources](https://console.cloud.google.com/cloud-resource-manager) page, where you can see and manage all your existing projects. 3\. Next, click on the CREATE PROJECT button to create a new project. ![Creating a new Google Cloud project](https://adamtheautomator.com/wp-content/uploads/2022/11/image-117-1024x382.png) Creating a new Google Cloud project Lastly, configure the following settings for your new project, and click **CREATE** to create your project. * **Project name** – Enter a name for your project, which does not need to be unique, and can be changed later on. This tutorial’s choice for the project name is **gcp-kms-demo**. * **Location** – Select the parent organization or folder where you want this project to be created. Your newly created project will be the top parent. But you can skip this field if you do not have an organization. > _The Location field might not show up if you use a trial account._ ![Configuring a new Google Cloud project](https://adamtheautomator.com/wp-content/uploads/2022/11/image-118.png) Configuring a new Google Cloud project If successful, you will see your newly-created Google Cloud project listed, as shown below. ![Viewing the newly-created Google Cloud project](https://adamtheautomator.com/wp-content/uploads/2022/11/image-119.png) Viewing the newly-created Google Cloud project ## Enabling the Cloud KMS API for the Google Cloud Project You have just created your first If successful, you will see your newly-created Google Cloud project listed, as shown below.Cloud project, and typically you cannot leave it unprotected. Worry not! The Cloud KMS API is a set of Google-provided encryption APIs that you can use to protect your data. To use the Cloud KMS API, you need to enable it for your project: 1\. Navigate to the [google project selector](https://console.cloud.google.com/projectselector2/home/dashboard) page, and select your Google Cloud project (gcp-kms-demo). ![Selecting a project](https://adamtheautomator.com/wp-content/uploads/2022/11/image-120.png) Selecting a project 2\. Next, navigate to the [Enable access to API](https://console.cloud.google.com/apis/enableflow?apiid=cloudkms.googleapis.com) page, and click NEXT to confirm enabling the API for the selected project. ![Confirming the selected Google Cloud project](https://adamtheautomator.com/wp-content/uploads/2022/11/image-121.png) Confirming the selected Google Cloud project 3\. Now, click ENABLE to enable the Cloud KMS API. ![Enabling the Cloud KMS API](https://adamtheautomator.com/wp-content/uploads/2022/11/image-122.png) Enabling the Cloud KMS API At this point, the Cloud KMS API is enabled for your project. You can now start using the Cloud KSM API to create and manage encryption keys. ![Verifying the Cloud KMS API is enabled](https://adamtheautomator.com/wp-content/uploads/2022/11/image-123.png) Verifying the Cloud KMS API is enabled ## Starting the Cloud Shell to Create Keys and Keyrings Enabling the Cloud KMS API prepares you to create keys and keyrings to [encrypt](https://adamtheautomator.com/aws-key-management/) and decrypt your data. Keys and keyrings are the fundamental concepts in Cloud KMS. Related:[Use Encryption Keys Like a Pro With AWS Key Management](https://adamtheautomator.com/aws-key-management/)
KeyA key is an encryption key stored in a keyring that you can use to encrypt and decrypt your data. Each key has a name, and the name must be unique within the keyring. You can use IAM ( Identity and Access Management) policies to control who has access to keys.
KeyringA keyring is a container in Cloud KMS that holds a set of keys. You can think of the keyring as a folder on your computer that contains many files. But in essence, a keyring holds a set of keys in a specific Cloud KMS location.
Related:[Helpful Guide to IAM in AWS Through Examples](https://adamtheautomator.com/iam-aws/) But before creating keys and keyrings, you first have to start the [Cloud Shell](https://cloud.google.com/shell/). The Cloud Shell is a free and interactive shell you can use to run commands on the Google Cloud Platform without installing any tools on your machine. 1\. In the GCP Console, click the Activate Cloud Shell button (top-right), as shown below, to start the Cloud Shell. ![Starting the Cloud Shell](https://adamtheautomator.com/wp-content/uploads/2022/11/image-124.png) Starting the Cloud Shell A Cloud Shell session initializes, as shown below (at the bottom of the page), where you can run commands. ![Viewing the Cloud Shell prompt](https://adamtheautomator.com/wp-content/uploads/2022/11/image-125.png) Viewing the Cloud Shell prompt 2\. Next, run the following gcloud This prompt shows up the first time you run the gcloud command in the Cloud Shell, asking you to authorize the gcloud tool to access the KSM API.in the Cloud Shell to create a new keyring (keyrings) called kms-demo-keyring in the global location. ```bash gcloud kms keyrings create "kms-demo-keyring" \ --location "global" ``` When prompted, click AUTHORIZE to continue running the command. This prompt shows up the first time you run the gcloud command in the Cloud Shell, asking you to authorize the gcloud tool to access the KSM API. ![Authorizing access to the KSM API](https://adamtheautomator.com/wp-content/uploads/2022/11/image-126.png) Authorizing access to the KSM API As shown below, there are no output messages when the keyring is successfully created. ![Creating a new keyring](https://adamtheautomator.com/wp-content/uploads/2022/11/image-127.png) Creating a new keyring 3\. Once authorized, run the below command to create a key (keys) called kms-demo-key01 in the keyring (kms-demo-keyring). The –purpose flag specifies that GCP KMS will use this key for encryption. Related:[Use Encryption Keys Like a Pro With AWS Key Management](https://adamtheautomator.com/aws-key-management/) Note that the location (global) must be the same as what you set for the keyring. ```bash gcloud kms keys create "kms-demo-key01" \ --location "global" \ --keyring "kms-demo-keyring" \ --purpose "encryption" ``` > _Each time you create or rotate a key, Cloud KMS creates a new version of the key. This feature lets you easily roll back to a previous version if necessary._ Like creating a keyring, there are no output messages when the key is successfully created. > But at this point, you have a keyring and key that you can use to encrypt and decrypt your data. ![Creating a key for encryption](https://adamtheautomator.com/wp-content/uploads/2022/11/image-128.png) Creating a key for encryption 4\. Now, run the following command to list the keys in a –keyring (kms-demo-keyring) ```bash gcloud kms keys list --location "global" --keyring "kms-demo-keyring" ``` You will see an output similar to the screenshot below with information as follows:
PURPOSEENCRYPT_DECRYPTIndicates the purpose of the key (encryption and decryption).
ALGORITHMGOOGLE_SYMMETRIC_ENCRYPTIONIndicates the key uses Google Symmetric Encryption, the default algorithm for Cloud KMS keys.
PROTECTION_LEVELSOFTWAREIndicates the key is software-protected.
LABELSYou can add labels to keys to categorize them or to add additional information.
PRIMARY ID1Indicates the key is the primary key for the keyring, which is what Cloud KMS uses by default when you do not specify a key.

Note that you can have only one primary key per keyring.
PRIMARY STATEENABLEDShows the current status of the key. The ENABLED state indicates the key can be used for its specified purpose.
![Listing the keys in a keyring](https://adamtheautomator.com/wp-content/uploads/2022/11/image-129.png) Listing the keys in a keyring ## Encrypting and Decrypting Data with GCP KMS Encryption is a crucial line of defense to deter malicious parties’ access to sensitive data. And now that you have an encryption key, you can use it to encrypt your data. To encrypt data with GCP KMS: 1\. Run the below command, which does not provide output, but creates a text file (gcp-kms-demo.txt) with some texts to encrypt. ```bash echo "This is some sensitive data that I want to encrypt." > gcp-kms-demo.txt ``` 2\. Next, run each command below to list (ls) the text file (gcp-kms-demo.txt) and view (cat) its content to verify the data. ```bash # List the text file ls cat gcp-kms-demo.txt # View the text file's content cat gcp-kms-demo.txt ``` ![Listing the text file and verifying the data](https://adamtheautomator.com/wp-content/uploads/2022/11/image-131.png) Listing the text file and verifying the data 3\. Once verified, run the below command to encrypt the data in your file (gcp-kms-demo.txt) using your key (kms-demo-key01). The encrypted data will then be stored in a new file called gcp-kms-demo.txt.encrypted. Although this command does not provide output, you will later verify the encryption in the following step. ```bash gcloud kms encrypt \ --location "global" \ --keyring "kms-demo-keyring" \ --key "kms-demo-key01" \ --plaintext-file ./gcp-kms-demo.txt \ --ciphertext-file ./gcp-kms-demo.txt.encrypted ``` ![Encrypting data](https://adamtheautomator.com/wp-content/uploads/2022/11/image-132.png) Encrypting data 4\. Now, run the following command to try and view the encrypted file’s data (gcp-kms-demo.txt.encrypted). ```bash cat gcp-kms-demo.txt.encrypted ``` You will see broken, strange, and unreadable symbols, as shown below. This output indicates that the file was successfully encrypted. You need to store this encrypted file in a secure location. For example, you can store multiple copies in AWS S3, GCP Cloud Storage, or Azure Blob Storage. Google Cloud does not save the plain text version of your data. So if you lose the encrypted file, decrypting the file to get the original data back is impossible. ![Verifying the file data is encrypted](https://adamtheautomator.com/wp-content/uploads/2022/11/image-133.png) Verifying the file data is encrypted Related:[How To Upload File to S3 with the AWS CLI](https://adamtheautomator.com/upload-file-to-s3/) 5\. Once encrypted, run the command below to decrypt your data (gcp-kms-demo.txt.encrypted) using the same key (kms-demo-key01). But this time, the decrypted data is stored in a new file called gcp-kms-demo.txt.decrypted. Like with encryption, this command does not provide output, but you will verify the decryption in the following step. ```bash gcloud kms decrypt \ --location "global" \ --keyring "kms-demo-keyring" \ --key "kms-demo-key01" \ --ciphertext-file ./gcp-kms-demo.txt.encrypted \ --plaintext-file ./gcp-kms-demo.txt.decrypted ``` ![Decrypting encrypted data](https://adamtheautomator.com/wp-content/uploads/2022/11/image-134.png) Decrypting encrypted data 6\. Finally, run the following command to view (cat) the decrypted file (gcp-kms-demo.txt.decrypted) and verify the data was successfully decrypted. ```bash cat gcp-kms-demo.txt.decrypted ``` Below, you can see the original data you saved on the text file. Congratulations! You have successfully encrypted and decrypted data using Google Cloud KMS. ![Verifying the encrypted file has been decrypted](https://adamtheautomator.com/wp-content/uploads/2022/11/image-135.png) Verifying the encrypted file has been decrypted ## Cleaning Up Google Cloud Resources Your resources (a keyring and a key) are billed per use. So when you are finished with them, you should delete your resources to avoid recurring charges. 1\. Run the below command to list all of the versions of the key (keys) you created. ```bash gcloud kms keys versions list \ --location "global" \ --keyring "kms-demo-keyring" \ --key "kms-demo-key01" ``` You will see at least one version listed, as shown below. ![Listing all the key versions](https://adamtheautomator.com/wp-content/uploads/2022/11/image-136.png) Listing all the key versions 2\. Next, run the following command, which does not provide output but destroys the specified key (kms-demo-key01). Note that to delete your resources successfully, you must specify the location, keyring, and key names. ```bash gcloud kms keys versions destroy 1\ --location "global" \ --keyring "kms-demo-keyring" \ --key "kms-demo-key01" ``` 3\. Now, run the below command to list the keys again. ```bash gcloud kms keys versions list ``` Below, the STATE indicates the key has been scheduled for destruction (DESTROY\_SCHEDULED). You can not destroy a key right away. Google gives a 30-day grace period, which greatly helps if you accidentally destroy a key. After 30 days, the key will be permanently destroyed automatically and cannot be recovered. ![Verifying the key has been scheduled for destruction](https://adamtheautomator.com/wp-content/uploads/2022/11/image-137.png) Verifying the key has been scheduled for destruction 4\. Navigate to the [Manage Resources](https://console.cloud.google.com/cloud-resource-manager) page, tick the checkbox next to your Google Cloud project, and click DELETE to delete the entire project. ![Deleting the Google Cloud project](https://adamtheautomator.com/wp-content/uploads/2022/11/image-138.png) Deleting the Google Cloud project 5\. Lastly, enter the Project ID, and click SHUT DOWN to delete your project. Like deleting a key, you have 30 days to change your mind before the project is permanently deleted. ![Confirming Google Cloud project deletion](https://adamtheautomator.com/wp-content/uploads/2022/11/image-139.png) Confirming Google Cloud project deletion ## Conclusion Data encryption is a critical security measure to protect your data, and you have seen that GCP KSM is up to the task. In this tutorial, you have learned that GCP KMS is a convenient service that lets you encrypt your data with a few commands. With this newfound knowledge, why not set up a [key rotation](https://cloud.google.com/kms/docs/key-rotation) to secure even more of your data? Rotate your key at least once a month to maintain optimal security. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fgcp-kms%2F&text=Google%20Key%20Management%20\(GCP%20KMS\)%20%3A%20Getting%20Started%20Guide)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fgcp-kms%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fgcp-kms%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/12/stig-viewer.jpg) ### [How to Use STIGviewer and Increase Security](/stig-viewer/) Learn how to use the Stigviewer to discover technical standards to implement and enhance your security in this ATA Learning tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2022/11/How-to-Perform-a-gcloud-CLI-Install-and-Manage-Google-Cloud.jpg) ### [How to Perform a gcloud CLI Install and Manage Google Cloud](/gcloud-cli-install/) Discover how to manage Google Cloud from the command-line with a gcloud CLI install and take control of GCP in this ATA Learning tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2022/06/The-Definitive-Getting-Started-Guide-to-Google-Cloud-SQL.jpg) ### [The Definitive Getting Started Guide to Google Cloud SQL](/cloud-sql/) Move your databases from on-premise to the power of the cloud and learn how to use Google Cloud SQL to take reliability and performance to the next level! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)