Cloud KMS release notes

Cloud KMS is available in the following region:

• northamerica-south1

For more information, see Cloud KMS locations.

You can now use custom constraints with Organization Policy to provide more granular control over specific fields for some Cloud KMS resources. For more information, see Create custom organization policy constraints for Cloud KMS.

Cloud KMS with Autokey is now in General Availability for Cloud Storage, Compute Engine, BigQuery, Secret Manager, Cloud SQL, and Spanner.

Autokey simplifies creating and using customer-managed encryption keys (CMEKs) by automating provisioning and assignment. With Autokey, key rings, keys, and service accounts don't need to be planned and provisioned before they're needed. Instead, Autokey generates keys on demand as resources are created.

Using keys generated by Autokey can help you consistently align with industry standards and recommended practices for data security, including the HSM protection level, separation of duties, key rotation, location, and key specificity. Keys requested using Autokey function identically to other Cloud HSM keys with the same settings. For more information, see Autokey overview.

Cloud KMS with Autokey is now in Preview for Cloud Storage, Compute Engine, BigQuery, and Secret Manager.

Autokey simplifies creating and using customer-managed encryption keys (CMEKs) by automating provisioning and assignment. With Autokey, key rings, keys, and service accounts don't need to be planned and provisioned before they're needed. Instead, Autokey generates keys on demand as resources are created.

Using keys generated by Autokey can help you consistently align with industry standards and recommended practices for data security, including the HSM protection level, separation of duties, key rotation, location, and key specificity. Keys requested using Autokey function identically to other Cloud HSM keys with the same settings.

For more information, see Autokey overview.

Cloud KMS has two new organization policy constraints that you can use to control key version destruction. These constraints became available on November 1, 2023.

For more information, see Control key version destruction.

Cloud KMS now supports asymmetric signing and validation using ECDSA on the Curve25519 in PureEdDSA mode, which takes raw data as input instead of hashed data.

For more information on this and other algorithms supported by Cloud KMS, see Key purposes and algorithms.

Bare Metal Rack HSM is generally available for customers with specific business and technical requirements in limited regions.

Bare Metal Rack HSM is an infrastructure-as-a-service offering that lets you deploy large numbers of customer-owned hardware security modules (HSMs) in PCI-compliant facilities next to your Google Cloud workloads. This product helps to accelerate migration of your payment applications to Google Cloud.

For more information, including to compare Bare Metal Rack HSM with Bare Metal HSM, see Bare Metal Rack HSM.

Cloud KMS is available in the following region:

• africa-south1

For more information, see Cloud KMS locations.

Bare Metal HSM is generally available for customers with specific business and technical requirements in limited regions.

Bare Metal HSM is an infrastructure-as-a-service offering that lets you deploy customer-owned hardware security modules (HSMs) in PCI-compliant facilities next to your Google Cloud workloads. This product helps to accelerate migration of your payment applications to Google Cloud.

For more information, see Bare Metal HSM.

Cloud KMS is available in the following region:

• me-central2

For more information, see Cloud KMS locations.

Cloud KMS is available in the following region:

• europe-west10

For more information, see Cloud KMS locations.

The Key Usage dashboard in the Google Cloud console and the new KMS Inventory REST API are now generally available.

For more information about the Key Usage dashboard, see View key usage.

For more information about the KMS Inventory REST API, see KMS Inventory API.

For example curl commands using the KMS Inventory REST API, see View key usage and View keys by project.

Cloud HSM resources are now available in the following regions:

• europe-west12
• me-central1

For information about which locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see Cloud KMS locations.

Cloud KMS is available in the following region:

• me-central1

For more information, see Cloud KMS locations.

Cloud EKM now supports coordinated external keys.

Coordinated external keys let you create and manage keys in a compatible external key management system from Cloud KMS over a VPC network. For more information, see EKM key management from Cloud KMS.

Thales CipherTrust Cloud Key Manager is the first external key management partner system that is compatible with EKM key management from Cloud KMS.

Cloud KMS is available in the following region:

• europe-west12

For more information, see Cloud KMS locations.

Cloud KMS and Cloud EKM resources are available in the in (India) multi-regional location. Cloud HSM resources are not available in this location.

For information about which Google Cloud Locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see Cloud KMS Locations.

The Key Usage dashboard in the Google Cloud console and the new KMS Inventory REST API are now in Preview.

For more information about the Key Usage dashboard, see View key usage.

For more information about the KMS Inventory REST API, see KMS Inventory API.

For example curl commands using the KMS Inventory REST API, see View key usage and View keys by project.

Cloud HSM resources are now available in the following regions:

• europe-southwest1
• europe-west9
• me-west1

For information about which locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see Cloud KMS locations.

Cloud KMS is available in the following region:

• me-west1

For more information, see Cloud KMS locations.

Customers enrolled in Key Access Justifications will now see justifications listed in Cloud Audit Logs for Cloud KMS.

Cloud EKM now supports Dataproc Metastore. For more information, see Cloud External Key Manager.

Cloud KMS is available in the following region:

us-south1

For more information, see Cloud KMS locations.

Cloud KMS is available in the following region:

• us-east5

For more information, see Cloud KMS locations.

Cloud KMS is available in the following region:

• europe-southwest1

For more information, see Cloud KMS locations.

Cloud KMS is available in the following region:

• europe-west9

For more information, see Cloud KMS locations.

Two new organization policy constraints are now available in Preview to help ensure CMEK usage across an organization:

• constraints/gcp.restrictNonCmekServices requires CMEK protection.
• constraints/gcp.restrictCmekCryptoKeyProjects limits which Cloud KMS keys are used for CMEK protection.

To learn more, see CMEK organization policies.

Cloud EKM now supports Cloud Bigtable and Log Storage in Cloud Logging. For more information, see Cloud External Key Manager.

Using Cloud EKM with a Virtual Private Network is now generally available. This means you can access your external key manager with a private endpoint.

See Using Cloud EKM with VPC to learn more.

Cloud HSM resources are now available in the following regions:

• asia1
• eur3
• eur4
• nam3
• nam4
• nam6
• nam9

For information about which locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see Cloud KMS locations.

You can now use Cloud EKM with a Virtual Private Network (preview). This means you can access your external key manager with a private endpoint.

See Using Cloud EKM with VPC to learn more.

Cloud EKM now supports Cloud Run, Dataproc, and Vertex AI. For more information, see Cloud External Key Manager.

Cloud HSM is now available in the Melbourne (australia-southeast2) region.

Asymmetric keys for Cloud EKM are now generally available (GA).

Cloud KMS is now available in the Santiago (southamerica-west1) region.

You can now attest HSM keys using certificate chains via gcloud command-line tool, Cloud Console, or Cloud KMS API. See Verifying attestations to learn more.

Cloud KMS now provides a library that conforms to the PKCS #11 standard, which enables working with existing applications that use the PKCS #11 API. See Library for PKCS #11 to learn more.

Re-importing previously destroyed keys is now supported in Cloud KMS.

MAC keys are now supported by Cloud KMS. See Creating and validating MAC digital signatures to learn more.

Cloud KMS now supports a configurable variable soft deletion window for cryptographic keys.

You can now retrieve random bytes from the random number generator in Cloud HSM. See Generating random bytes to learn more.

Cloud EKM now supports Artifact Registry, Logs Router in Cloud Logging, and Cloud Spanner. For more information, see Cloud External Key Manager.

Several fields related to verifying end-to-end data integrity for cryptographic operations are generally available (GA).

Cloud EKM now supports Dataflow Appliance and Pub/Sub. For more information, see Cloud External Key Manager.

The europe-central2 region in Warsaw is now available. See Cloud KMS locations for more details.

Cloud EKM adds support for Dataflow shuffle and Secret Manager. For more information, see Cloud External Key Manager.

Cloud EKM now supports Cloud SQL and GKE. For more information, see Cloud External Key Manager.

Cloud HSM resources are available in the us-west4 and asia-southeast2 regions. Cloud KMS resources were already available in these regions.

For information about which Cloud Locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see the Cloud KMS regional locations.

Keys hosted by Thales are now supported in Cloud EKM. To learn more, see Cloud EKM.

Cloud KMS and Cloud EKM resources are available in the asia-southeast2 region. Cloud HSM resources are not available in this region.

For information about which Cloud Locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see the Cloud KMS regional locations.

Several fields related to data integrity have been added to the Cloud KMS API, along with guidelines for using them. To learn more about maintaining data integrity when performing cryptographic operations, see Verifying end-to-end data integrity.

Hosted Private HSM is generally available.

Cloud KMS and Cloud EKM resources are available in the us-west4 region. Cloud HSM resources are not available in this region.

Cloud HSM resources are available in the global multi-regional location.

For information about which Cloud Locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see the Cloud KMS regional locations.

Cloud External Key Manager (Cloud EKM) is generally available.

Importing keys into Cloud KMS software keys is generally available (GA).

Cloud EKM resources are now available in the asia-northeast3 and us-west3 locations.

Cloud KMS resources can now be created in the us-west3 region.

Cloud HSM resources are now also available in the us-west3 region.

Cloud EKM resources are not available in the us-west3 region.

For information about which Cloud Locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, refer to Cloud KMS locations.

You can now import key material into Cloud KMS software keys. For more information, see Key import. Importing key material into Cloud HSM keys is already generally available.

Cloud KMS resources can now be created in the asia-northeast3 region.

Cloud HSM resources are now also available in the asia-northeast3 region.

Learn more about Cloud Locations. For the list of all regions supported by Cloud KMS, Cloud HSM, and Cloud EKM, see the Cloud KMS regional locations.

Cloud External Key Manager (Cloud EKM) (Beta) allows you to encrypt data stored in Google Cloud using keys stored in a supported partner external key management system. You can encrypt or decrypt data in BigQuery, Compute Engine persistent disks, or directly using the Cloud KMS API.

You can learn about changes to the API since the Alpha release.

The gcloud beta kms import-jobs command group was released as part of gcloud 253.0.0.

Introduction of import key functionality into the Cloud KMS beta release.

The following are additions to the API definition.

New resources

ImportJob has been added as a resource.

The ImportJob resource contains the following methods:

• ImportJobs.create
• ImportJobs.get
• ImportJobs.getIamPolicy
• ImportJobs.list
• ImportJobs.setIamPolicy
• ImportJobs.testIamPermissions

The ImportJob resource contains the following enums:

• ImportJobState
• ImportMethod

The ImportJob resource contains the following type:

• WrappingPublicKey

New methods

• CryptoKeyVersions.import

New fields

• CreateCryptoKeyRequest.skip_initial_version_creation
• CryptoKeyVersions.import_failure_reason
• CryptoKeyVersions.import_job
• CryptoKeyVersions.import_time

New enums

• CryptoKeyVersionState.PENDING_IMPORT
• CryptoKeyVersionState.IMPORT_FAILED

New permissions

• cloudkms.cryptoKeyVersions.useToImport
• cloudkms.importJobs.create
• cloudkms.importJobs.get
• cloudkms.importJobs.getIamPolicy
• cloudkms.importJobs.list
• cloudkms.importJobs.setIamPolicy

For more information about Cloud KMS permissions, see Permissions and roles.

Cloud HSM resources are now available in the following regional locations:

• asia-east2
• europe-west6
• us-west2

For the list of all supported regions, see Supported regions.

Introduction of the Cloud KMS beta release to support filtering and sorting results from the following list operations.

• keyRings.list
• cryptoKeys.list
• cryptoKeyVersions.list

For more information, see Sorting and filtering list results.

Cloud HSM resources are now available in the following regional locations:

• asia-northeast1
• asia-northeast2

For the list of all supported regions, see Supported regions.

Cloud HSM resources are now available in the following regional locations:

• asia-south1
• europe-north1
• europe-west1
• europe-west4

For the list of all supported regions, see Supported regions for Cloud HSM.

Cloud HSM resources are now available in the us multi-regional location. For the list of all supported regions, see Supported regions for Cloud HSM.

Cloud KMS resources can now be created in the asia-northeast2 region. Learn more about Cloud Locations.

Cloud HSM resources are now available in the asia-southeast1 regional location. For the list of all supported regions, see Supported regions for Cloud HSM.

Cloud KMS resources can now be created in the europe-west6 region. Learn more about Cloud Locations.

CAVIUM_V2_COMPRESSED has been added as an enum value to AttestationFormat. To learn how to verify an attestation that is in the CAVIUM_V2_COMPRESSED format, see Verifying Attestations.

Announced general availability of asymmetric keys and Cloud HSM in Cloud KMS.

Cloud HSM resources are now available in the europe-west3 regional location. For the list of all supported regions, see Supported regions for Cloud HSM.

Cloud HSM resources are now available in the europe-west2 regional location. For the list of all supported regions, see Supported regions for Cloud HSM.

Cloud KMS resources can now be created in the eur4 and nam4 dual-regions. Learn more about Cloud Locations.

Cloud KMS resources can now be created in the asia-east2 region. Learn more about Cloud Locations.

New algorithms have been added:

• RSA_SIGN_PSS_4096_SHA512
• RSA_SIGN_PKCS1_4096_SHA512
• RSA_DECRYPT_OAEP_4096_SHA512

For the list of all supported algorithms, see Key purposes and algorithms.

Cloud HSM resources are now available in the us-central1 regional location. For the list of all supported regions, see Supported regions for Cloud HSM.

Attestations that are downloaded via the Google Cloud Platform Console are no longer base64-encoded. This matches the raw format of the attestations downloaded via the gcloud command-line tool and the Cloud KMS API. The instructions for Verifying Attestations expect the attestation to be in raw format, not base64-encoded.

Introduction of asymmetric keys and Cloud HSM into the Cloud KMS beta release.

Additions to the API definition:

• New method for creating digital signatures:
  • CryptoKeys.asymmetricSign
• New method for retrieving an asymmetric key's public key:
  • CryptoKeyVersions.getPublicKey
• New method for decrypting data encoded with an asymmetric public key generated by Cloud KMS:
  • CryptoKeyVersions.asymmetricDecrypt
• New types:
  • CryptoKeyVersionAlgorithm
  • CryptoKeyVersionTemplate
  • CryptoKeyVersionView
  • ProtectionLevel
• New fields:
  • CryptoKey.versionTemplate
  • CryptoKeyVersion.algorithm
  • CryptoKeyVersion.attestation
  • CryptoKeyVersion.generateTime
  • CryptoKeyVersion.protectionLevel
  • LocationMetadata.hsmAvailable
• The CryptoKey.list method now contains a versionView query parameter that lists the fields of the primary key version to include in the response.
• The CryptoKeyVersion.list method now contains a view query parameter that lists the fields to include in the response.
• The LocationMetadata resource returned by the Locations.get and Locations.list methods now contain an hsm_available field. The hsm_available field is a bool that indicates whether the location supports Hardware Security Modules (HSMs).

Cloud HSM resources are now available in the us-east1 and us-west1 regional locations.

Cloud KMS resources can now be created in the us-west2 region. Learn more about Cloud Locations.

Cloud KMS resources can now be created in the europe-north1 region. Learn more about Cloud Locations.

Cloud KMS resources can now be created in the following regions:

• asia-south1
• australia-southeast1
• europe-west2
• europe-west3
• northamerica-northeast1
• southamerica-east1
• us-east4

Learn more about Cloud Locations.

The name of the Cloud KMS page in the Google Cloud Platform Console has been changed from Encryption keys to Cryptographic keys.

Cloud KMS resources can now be created in the asia-northeast1 region. Learn more about Cloud Locations.

Cloud KMS resources can now be created in the asia, europe, and us multi-regional locations. Learn more about Cloud KMS locations.

Announced general availability of IAM custom roles for Cloud KMS.

The gcloud kms locations list command now supports the europe-west4 region.

The Google Cloud Platform console now supports the europe-west4 region. You can create new key rings in this region using the console, the API and the gcloud command-line tool. The gcloud kms locations list command will support this region approximately January 22, 2018. Learn more about Cloud Locations.

Cloud KMS resources can now be created in the europe-west4 region. You can use this region to create new key rings using the API and the gcloud command-line tool. This region will not be viewable in the Google Cloud Platform console or returned by gcloud kms locations list until approximately January 17, 2018. Learn more about Cloud Locations.

Labels can now be applied to CryptoKeys:

• The CryptoKey type now contains the labels field.
• To learn more about this feature, see Labeling CryptoKeys.

gcloud changes:

• The gcloud kms keys create command has a new parameter, --labels. Use this parameter to specify labels when you create a key.
• The output from the gcloud kms keys list command now contains a LABELS column.
• The gcloud beta kms keys update command is new. This command supports updating an existing key.

These changes are effective in gcloud version 170.0.0.

Cloud KMS resources can now be created in the asia-southeast1 region. Learn more about Cloud Locations.

Added encrypt and decrypt commands to gcloud beta kms as part of gcloud 157.0.0.

• Added examples for using gcloud beta kms encrypt and gcloud beta kms decrypt.

Data Access audit logs can now be self-enabled for Cloud KMS. For more information, see Cloud Audit Logging documentation.

• Updated documentation on logs types in Cloud KMS.

Cloud KMS resources can now be created in the us-west1 region. Learn more about Cloud Locations.

Launch of Cloud KMS to General Availability.

• Updated client libraries and code samples in C#, Go, Java, Node.js, PHP, Python, and Ruby.
• New Secret Management documentation that explains how to protect secrets using Cloud KMS.
• Added a Service Level Agreement (SLA).

Launch of Cloud KMS to Beta. Use Cloud KMS to create, use, rotate, automatically rotate, and destroy symmetric AES256 encryption keys. Cloud KMS is accessible via

• REST API
• Google APIs Client Libraries in go, python, and java
• Cloud Console user interface