CMEKs for Secret Manager

By default, secrets are encrypted with Google default encryption. However, some highly regulated customers require control of keys, so Secret Manager supports customer-managed encryption keys (CMEKs) (within Cloud KMS) for encrypting:

Note

However, if you disable or permanently destroy the CMEK, the secret encrypted with that key cannot be decrypted.

• Secret payloads are encrypted by Google-managed keys before being written to persistent storage with no additional configuration required.
• Secret Manager encrypts data with a unique data encryption key (DEK) before writing it to persistent storage in a specific location. The Secret Manager service owns a replica-specific key called a key encryption key (KEK), which is used to encrypt the DEK. This is commonly referred to as envelope encryption.
• The CMEK is a symmetric key that you control within Cloud KMS when using CMEKs with Secret Manager. The CMEK must be stored in the same GCP region...