Customer-managed encryption keys

By default, NotebookLM Enterprise encrypts customer content at rest. NotebookLM Enterprise handles encryption for you without any additional actions on your part. This option is called Google default encryption.

If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in Cloud KMS with CMEK-integrated services including NotebookLM Enterprise. Using Cloud KMS keys gives you control over their protection level, location, rotation schedule, usage and access permissions, and cryptographic boundaries. Using Cloud KMS also lets you view audit logs and control key life cycles. Instead of Google owning and managing the symmetric key encryption keys (KEKs) that protect your data, you control and manage these keys in Cloud KMS.

After you set up your resources with CMEKs, the experience of accessing your NotebookLM Enterprise resources is similar to using Google default encryption. For more information about your encryption options, see Customer-managed encryption keys (CMEK).

Limitations of Cloud KMS in NotebookLM Enterprise

The following limitations apply to CMEK (Cloud KMS) keys in NotebookLM Enterprise:

  • Keys can't be changed or rotated.

  • Organization policy constraints can't be applied to NotebookLM Enterprise.

  • After a key has been registered, it can't be deregistered or removed.

  • You must use the US or EU multi-region (not the global region). For more information about multi-regions and data residency, including limits associated with using non-global locations, see NotebookLM Enterprise locations.

  • CMEK-protection with NotebookLM Enterprise is not integrated with Cloud Asset Inventory search.

  • You can't change the encryption settings of notebooks. An unprotected notebook can't later be protected.

  • If you need to register more than one key for a project, contact your Google account team to request a quota increase for CMEK configurations, providing a justification for why you need more than one key.

  • Using external key manager (EKM) or hardware security module (HSM) with CMEK is in GA with allowlist. To use EKM or HSM with CMEK, contact your Google account team.

    The following limitations apply to EKM or HSM with CMEK:

    • Your EKM and HSM quota for encrypt and decrypt calls should have at least 1,000 QPM of headroom. For how to check your quotas, see Check your Cloud KMS quotas.

    • If using EKM, the key must be reachable for more than 90% of any time window of longer than 30 seconds. If the key isn't reachable for this amount of time, it can negatively impact indexing and search freshness.

    • If there are billing issues, persistent out-of-quota issues, or persistent unreachability issues for more than 12 hours, the service automatically turns down the CmekConfig associated with the EKM or HSM key.

Before you begin

Make sure you satisfy the following prerequisites:

  • A symmetric Cloud KMS key with the rotation period set to Never (Manual rotation). See Create a key ring and Create a key in the Cloud KMS documentation.

  • The CryptoKey Encrypter/Decrypter IAM role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the key has been granted to the Discovery Engine service agent. For general instructions on how to add a role to a service agent, see Grant or revoke a single role.

  • The CryptoKey Encrypter/Decrypter IAM role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the key has been granted to the Cloud Storage service agent. If this role is not granted, data import for CMEK-protected notebooks will fail because Discovery Engine is not able to make the CMEK-protected, temporary bucket and directory that is required for importing.

  • Don't create any notebooks that you want managed by your key until after you have completed the key registration instructions on this page.

Register your Cloud KMS key

To register your own managed key for NotebookLM Enterprise, follow these steps:

  1. Call the UpdateCmekConfig method with the Cloud KMS key that you want to register.

    curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{"kms_key":"projects/KMS_PROJECT_ID/locations/KMS_LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME"}' \
"https://LOCATION-discoveryengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/cmekConfigs/CMEK_CONFIG_ID?set_default=SET_DEFAULT"

    Replace the following:

    • KMS_PROJECT_ID: the ID of your Google Cloud project that contains the key. The project number won't work.
    • KMS_LOCATION: the multi-region of your KMS key: us or europe.
    • KEY_RING: the name of the key ring that holds the key.
    • KEY_NAME: the name of the key.
    • PROJECT_ID: the ID of your Google Cloud project that contains the notebooks.

    • LOCATION: the multi-region: us or eu.

    • CMEK_CONFIG_ID: an ID for the CmekConfig resource. The ID can contain [1-63] characters that can be letters, digits, hyphens, and underscores.

    • SET_DEFAULT: set to true to use the key as the default key for subsequent notebooks created in the multi-region.

  2. Optional: Record the name value returned by the method and follow the instructions in Get details about a long-running operation to see when the operation is complete.

    It typically takes a few minutes to register a key.

After the operation completes, new notebooks in that multi-region are protected by the key.

Verify that NotebookLM Enterprise is protected by a key

If you want to confirm that NotebookLM Enterprise is protected by your key, follow these steps:

  1. Call the ListCmekConfigs method:

      curl -X GET \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://LOCATION-discoveryengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/cmekConfigs"

    Replace the following:

    • LOCATION: the multi-region of your data store: us or eu.
    • PROJECT_ID: the ID of your Google Cloud project that contains the data

  2. Review the output from the command. The CmekConfig is ready for use if all of the following are in the output:

    • "state": "ACTIVE"
    • "isDefault": true
    • "notebooklmState": NOTEBOOK_LM_READY

If a key is disabled or revoked

If a key is disabled or permissions for the key are revoked, within a short time, around 15 minutes, the protected notebooks stop ingesting and serving data and users can no longer access the notebooks. However, re-enabling a key or restoring permissions takes a long time. It can take up to 24 hours before notebooks can resume serving data.

Therefore, don't disable a key unless necessary. Disabling and enabling a key in NotebookLM Enterprise is a time-consuming operation. For example, repeatedly switching a key between disabled and enabled means it will take a long time for the notebooks to reach a protected state. Disabling a key and re-enabling it immediately afterward could result in days of downtime because the key is first disabled and subsequently re-enabled.