Meta tags:
description= Learn about the options for encrypting disks on Google Cloud, including how to use your own encryption keys;
Headings (most frequently used words):
for, encryption, with, and, confidential, mode, hyperdisk, balanced, disk, supported, keys, volumes, in, types, managed, encrypt, disks, customer, about, stay, organized, collections, save, categorize, content, based, on, your, preferences, rotation, google, owned, cmeks, cmek, cloud, kms, autokey, supplied, view, type, what, next, snapshots, machine, regions, limitations, products, pricing, support, resources, engage,
Text of the page (most frequently used words):
create (133), and (130), vms (105), for (95), with (85), the (82), about (65), troubleshoot (62), disk (59), #manage (50), compute (49), instance (49), hyperdisk (46), keys (45), disks (45), use (43), engine (43), cloud (42), view (42), using (42), google (40), server (39), encryption (34), windows (33), mig (33), you (32), overview (32), configure (32), performance (30), resources (27), reservation (27), set (27), mode (26), machine (25), confidential (24), managed (23), your (23), balanced (22), from (22), images (21), sql (21), that (20), monitor (20), image (19), key (19), snapshots (19), access (19), network (19), encrypt (18), gpu (18), linux (17), policies (16), creation (16), reservations (16), instances (16), can (15), custom (15), type (15), management (15), groups (15), ssh (15), recommendations (15), configuration (15), customer (14), cmeks (14), storage (14), workload (14), host (14), load (14), virtual (14), apply (14), connect (14), see (13), kms (13), volumes (13), availability (13), based (13), snapshot (13), best (13), persistent (13), bulk (13), microsoft (13), cluster (13), data (12), sole (12), regional (12), resource (11), add (11), logs (11), delete (11), practices (11), workloads (11), stateful (11), support (10), information (10), more (10), autokey (10), enable (10), application (10), manually (10), service (10), choose (10), metadata (10), migs (10), machines (10), attached (10), migrate (10), zones (10), high (9), security (9), protect (9), owned (9), licenses (9), tenant (9), multiple (9), openshift (9), shutdown (9), time (9), start (9), hpc (9), license (8), uses (8), types (8), new (8), supplied (8), control (8), usage (8), import (8), cpu (8), login (8), optimize (8), internal (8), install (8), disaster (8), recovery (8), agent (8), existing (8), update (8), guest (8), boot (8), h4d (8), flexibility (8), dns (8), optimized (8), tpu (8), thumb (7), cseks (7), how (7), pools (7), regions (7), used (7), demand (7), instant (7), options (7), networking (7), commitments (7), startup (7), balancing (7), benchmark (7), idle (7), addresses (7), request (7), scale (7), deploy (7), back (7), mysql (7), zonal (7), remove (7), maintenance (7), templates (7), backup (7), events (6), other (6), are (6), send (6), volume (6), available (6), when (6), csek (6), created (6), operations (6), local (6), ssd (6), audit (6), default (6), migration (6), updates (6), files (6), nested (6), gpus (6), across (6), applications (6), group (6), run (6), failover (6), extension (6), change (6), transfer (6), customized (6), spot (6), code (5), samples (5), understand (5), details (5), learn (5), suspend (5), console (5), automatically (5), get (5), location (5), monitoring (5), databases (5), accounts (5), errors (5), future (5), drivers (5), virtualization (5), nvidia (5), placement (5), node (5), highly (5), build (5), multi (5), modify (5), capacity (5), schedules (5), symphony (5), email (5), scripts (5), manager (5), between (5), operating (5), systems (5), enhanced (5), capabilities (5), stop (5), tenancy (5), restore (5), workstation (5), faq (5), flex (5), português (4), español (4), all (4), down (4), content (4), don (4), supported (4), only (4), specify (4), standard (4), automatic (4), rotation (4), schedule (4), tools (4), distributed (4), authentication (4), issues (4), ubuntu (4), bandwidth (4), tcp (4), pmu (4), number (4), share (4), projects (4), upgrade (4), live (4), autoscaling (4), cross (4), region (4), requests (4), calendar (4), single (4), metrics (4), health (4), active (4), clusters (4), containers (4), container (4), database (4), postgresql (4), extensions (4), work (4), zone (4), resize (4), graceful (4), locations (4), plans (4), replication (4), review (4), bound (4), terms (3), need (3), this (3), apache (3), format (3), extreme (3), throughput (3), additional (3), deprecated (3), cmek (3), must (3), api (3), industry (3), always (3), guides (3), infrastructure (3), observability (3), analytics (3), troubleshooting (3), pro (3), serial (3), configurations (3), patterns (3), higher (3), discounts (3), cuds (3), manual (3), scalable (3), resilient (3), autoscale (3), balancer (3), prevent (3), project (3), policy (3), list (3), testing (3), ibm (3), spectrum (3), perform (3), deploying (3), plan (3), during (3), prepare (3), deployment (3), rhel (3), environment (3), certificates (3), query (3), state (3), disable (3), properties (3), account (3), increase (3), lifecycle (3), design (3), size (3), non (3), pool (3), move (3), creating (3), workstations (3), series (3), tpus (3), product (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), sign (2), site (2), youtube (2), center (2), started (2), system (2), pricing (2), products (2), last (2), updated (2), 2026 (2), utc (2), licensed (2), under (2), feedback (2), automate (2), next (2), resume (2), west4 (2), following (2), follow (2), steps (2), lets (2), without (2), extend (2), hardware (2), encrypting (2), instructions (2), alternatives (2), deprecation (2), caution (2), source (2), terraform (2), identity (2), iam (2), roles (2), practice (2), limits (2), clones (2), adds (2), encrypted (2), own (2), provide (2), after (2), over (2), protection (2), permissions (2), keks (2), one (2), customize (2), documentation (2), sdk (2), languages (2), frameworks (2), costs (2), solutions (2), hybrid (2), multicloud (2), pipelines (2), hosting (2), development (2), quota (2), commitment (2), consumption (2), full (2), registration (2), sles (2), export (2), port (2), collecting (2), nodes (2), report (2), arm (2), core (2), rdp (2), general (2), app (2), latency (2), analyze (2), visible (2), cores (2), committed (2), generation (2), underutilized (2), insights (2), utilization (2), globally (2), web (2), autohealing (2), iis (2), external (2), shared (2), reserve (2), autoscaler (2), autoscalers (2), activity (2), kubernetes (2), provider (2), place (2), running (2), directory (2), setting (2), services (2), redis (2), cloning (2), writer (2), alwayson (2), name (2), file (2), authenticate (2), method (2), synchronization (2), global (2), switch (2), byol (2), payg (2), byos (2), changes (2), families (2), guide (2), securing (2), event (2), simulate (2), topology (2), together (2), repairs (2), repair (2), check (2), failures (2), template (2), suspended (2), stopped (2), target (2), distribution (2), physical (2), cancel (2), once (2), limit (2), interfaces (2), ipv6 (2), static (2), decrease (2), basic (2), consistent (2), scoped (2), copy (2), appliances (2), asynchronous (2), names (2), mount (2), memory (2), credentials (2), organization (2), user (2), through (2), advanced (2), rdma (2), specific (2), preemptible (2), provisioning (2), models (2), rtx (2), vws (2), constraints (2), accelerator (2), apis (2), reference (2), technology (2), areas (2), close (2), subscribe, newsletter, our, third, decade, climate, action, join, cookies, privacy, tech, twitter, blog, engage, training, certification, architecture, getting, github, status, release, notes, community, forums, contact, sales, marketplace, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, sample, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, except, otherwise, noted, page, java, registered, trademark, oracle, its, affiliates, developers, creative, commons, attribution, specification, preview, what, limitations, south1, east5, east4, central1, europe, n2d, having, refactor, property, enabling, computing, doesn, same, applied, gcloud, cli, identifier, then, either, rings, generated, part, agents, decrypt, they, already, exist, granted, required, rotating, rotate, recommends, rotates, yearly, basis, potential, impact, compromised, hyperdisks, section, lists, offered, layer, each, option, known, outside, whenever, most, cases, working, have, them, behalf, gives, their, level, cryptographic, boundaries, also, life, cycles, instead, owning, managing, symmetric, these, track, recommended, however, providing, directly, but, encrypts, rest, save, categorize, preferences, stay, organized, collections, home, concurrent, operation, renewal, nvme, resizing, common, pay, viewing, output, diagnostic, sudoers, screenshots, generate, bug, blackwell, soft, lockups, bus, locks, rescue, inaccessible, dumps, kernel, panic, fstab, unresponsive, suspension, reboots, shutdowns, connectivity, tips, nics, dpdk, improve, resiliency, communication, reduce, compact, idpf, interface, irdma, driver, nic, threads, per, sustained, merge, split, renew, purchase, cost, savings, dynamic, overcommit, cpus, floating, reliable, udp, backends, routing, https, scaling, consuming, consume, combine, cud, allow, sharing, decisions, signals, serving, predictions, organize, labels, replica, states, observe, reports, tensorflow, inference, tensorrt5, learning, monte, carlo, methods, spark, forwarding, others, integrate, clustering, exchange, 2016, sharepoint, strategies, passive, inactive, setups, built, integrations, validation, were, deployed, transition, test, hammerdb, bucket, aws, ec2, pacemaker, s2d, block, netapp, hot, standby, drbd, architectures, client, private, address, mailjet, mailgun, sendgrid, sending, blue, green, deployments, lamp, joomla, asp, net, interactive, mongodb, flask, servers, mtls, random, generator, virtio, rng, accurate, protocol, ntp, append, els, restrictions, packages, deprecate, versions, family, trusted, red, hat, knowledgebase, functionality, risks, command, vpc, controls, kek, secure, expiration, shielded, attributes, predefined, handle, notices, process, faulty, unmanaged, affect, preserved, turn, off, alternate, fails, repairing, maintain, click, upgrades, override, selectively, applying, accelerate, out, outage, rebalance, reenable, proactive, redistribution, shape, distribute, define, info, accidental, deletion, spread, edit, rename, reset, restart, referrers, uuid, recover, corrupted, duplicate, alerts, backups, vss, regionally, different, considerations, synchronous, consistency, failback, replicate, make, provisioned, iops, evaluate, settings, help, symbolic, links, device, ram, attach, exapools, verify, ptr, record, failure, rates, tags, restrict, password, require, powershell, sac, securely, apps, root, vpn, bastion, iap, connection, browser, connections, networks, within, iso, imported, prerequisites, importing, exporting, bring, path, detach, reattach, constraint, accounting, provision, examples, slurm, reserved, team, slice, slices, scenarios, deterministic, base, requirements, ready, aci, configured, preempted, historical, alternative, similar, displays, ops, logging, subnet, public, has, gpudirect, enabled, ultra, minimum, platform, hostname, quickstarts, office, licensing, premium, strategy, gemini, bare, metal, accelerators, platforms, scores, purpose, discover, free, skip, main,
Text of the page (random words):
ndows set up alwayson availability groups using an internal load balancer set up alwayson availability groups using a distributed network name set up a failover cluster vm that uses s2d set up a failover cluster vm with multi writer disks configure linux set up a sql server cluster on linux with always on availability groups and pacemaker set up a sql server failover cluster on linux with multi writer disks migrate migrate a sql server database from aws ec2 to compute engine migrate a sql server database from windows to linux disaster recovery disaster recovery for microsoft sql server disaster recovery for microsoft sql server on persistent disk disaster recovery for microsoft sql server on hyperdisk deploying microsoft sql server for multi regional disaster recovery back up sql server databases to a google cloud storage bucket back up sql server databases using instant snapshots cloning a microsoft sql server database on compute engine load test sql server using hammerdb redis deployment options for redis on google cloud containers containers on compute engine deploy containers on vms and managed instance groups configure options to run your container transition from the container startup agent prepare for the shutdown of the container startup agent prevent the creation of vms that use the container metadata migrate containers that were deployed on vms during vm creation openshift workloads openshift on google cloud overview plan for openshift on google cloud overview of cluster services for openshift automatic configuration validation for openshift clusters built in integrations for openshift best practices for high availability with openshift disaster recovery for openshift on google cloud disaster recovery strategies for active passive and active inactive setups with openshift microsoft windows windows workloads best practices for windows server vms setting up active directory best practices for running active directory on google cloud deploy microsoft sharepoint server on compute engine deploying microsoft exchange server 2016 on compute engine windows server perform an in place upgrade of windows server run windows server failover clustering ibm spectrum symphony integrate ibm spectrum symphony with google cloud install the compute engine symphony provider install the google kubernetes symphony provider troubleshoot ibm spectrum symphony others load testing distributed load testing using kubernetes ssh port forwarding and load testing analytics monte carlo methods using apache spark machine learning run tensorflow inference workloads with tensorrt5 and nvidia t4 gpu monitor monitor logs view audit logs view usage reports view compute engine operations migrate from activity logs to audit logs view activity logs monitor resources monitor vm and sole tenant node usage observe and monitor vms monitor gpu performance monitor gpu performance on linux vms monitor gpu performance on windows vms monitor disks monitor disk health monitor the replica states of regional disks monitor disks list of metrics for pools monitor pools monitor reservations organize resources using labels scale autoscale groups of vms about autoscaling groups of vms create and manage autoscalers scale based on cpu utilization scale based on predictions scale based on load balancing serving capacity scale based on monitoring metrics scale based on schedules use an autoscaling policy with multiple signals manage autoscalers understand autoscaler decisions view autoscaler logs autoscale node groups reserve vm capacity choose a reservation type sharing reservations best practices for shared reservations allow a project to share reservations on demand reservations about on demand reservations create an on demand reservation for a single project for multiple projects combine an on demand reservation with a cud modify an on demand reservation delete an on demand reservation future reservations about future reservations create a reservation request for a single project for multiple projects modify a reservation request delete a reservation request future reservations in calendar mode about future reservations in calendar mode create a reservation request in calendar mode delete a reservation request in calendar mode view reservations or reservation requests consume a reservation prevent vms from consuming reservations load balancing about load balancing and scaling add an instance group to a load balancer request routing to a multi region external https load balancer cross region load balancing for microsoft iis backends set up internal tcp udp load balancing build reliable and scalable applications use autohealing for highly available applications use load balancing for highly available applications use autoscaling for highly scalable applications globally autoscale a web service on compute engine patterns for scalable and resilient applications patterns for using floating ip addresses on compute engine optimize resource utilization use recommendations to manage resources apply machine type recommendations to vms configure machine type recommendations apply machine type recommendations to migs view and apply idle resources recommendations view and understand vm insights view and understand mig insights manage idle vm recommendations idle vm recommendations overview view and apply idle vm recommendations configure idle vm recommendations manage reservation recommendations reservation recommendations overview view and apply idle reservation recommendations view and apply underutilized reservation recommendations configure idle reservation recommendations configure underutilized reservation recommendations overcommit cpus on sole tenant vms manual live migration about manual live migration manually live migrate vms share sole tenant node groups next generation dynamic resource management cost savings get discounts for committed usage about commitments and committed use discounts cuds resource based cuds purchase resource based commitments without attached reservations with attached reservations for os licenses manage resource based commitments renew commitments automatically extend commitment terms merge and split commitments upgrade commitments share resource based cuds across projects get discounts for sustained usage disk performance optimize hyperdisk performance optimize persistent disk performance optimize local ssd performance workload performance set the number of threads per core customize the number of visible cpu cores analyze the cpu performance using the pmu pmu overview enable the pmu in vms manage the pmu in vms network performance network bandwidth use google virtual nic use irdma network driver use idpf network interface configure a vm with higher bandwidth reduce latency by using compact placement policies optimize tcp network communication optimize tcp network performance optimize tcp network resiliency benchmark higher bandwidth vms optimize app latency with load balancing use dpdk to improve network performance network performance and gpu vms networking and gpu machines use higher network bandwidth patterns for using multiple host nics troubleshoot general tips troubleshoot connectivity troubleshoot rdp troubleshoot ssh troubleshoot os login troubleshoot vms troubleshoot vm operations troubleshoot vm creation troubleshoot resource availability errors troubleshoot bulk api vm creation troubleshoot vm reboots and shutdowns troubleshoot vm suspension troubleshoot vm updates troubleshoot unresponsive vms troubleshoot vm startup troubleshoot fstab errors troubleshoot kernel panic collecting core dumps rescue an inaccessible vm troubleshoot cpu bus locks troubleshoot cpu soft lockups troubleshoot vm configurations troubleshoot arm vms troubleshoot gpu vms troubleshoot nvidia gpu errors generate a nvidia bug report for blackwell gpus troubleshoot nested virtualization troubleshoot using vm screenshots troubleshoot sole tenant nodes troubleshoot vm performance issues troubleshoot sudoers files troubleshoot windows vms troubleshoot windows vms collecting diagnostic information troubleshoot using the serial console troubleshoot using the serial console viewing serial port output troubleshoot instance groups troubleshoot managed instance groups migs troubleshoot os management troubleshoot licenses troubleshoot image import and export troubleshooting sles pay as you go registration troubleshooting ubuntu pro registration troubleshoot metadata server troubleshoot metadata server troubleshoot networking issues troubleshoot common networking issues troubleshoot network drivers troubleshoot vm performance issues troubleshoot storage troubleshoot disk creation troubleshoot full disks and disk resizing troubleshoot disk encryption troubleshoot nvme disks troubleshoot instant snapshots troubleshoot standard snapshots troubleshoot reservations and commitments troubleshoot reservation creation troubleshoot reservation consumption troubleshooting reservation monitoring troubleshoot reservation updates troubleshoot future reservation creation and updates troubleshoot automatic commitment renewal troubleshoot quota errors troubleshoot concurrent operation quota errors troubleshoot workload authentication troubleshoot default service accounts troubleshoot workload to workload authentication ai and ml application development application hosting compute data analytics and pipelines databases distributed hybrid and multicloud industry solutions migration networking observability and monitoring security storage access and resources management costs and usage management infrastructure as code sdk languages frameworks and tools home documentation compute compute engine guides send feedback about disk encryption stay organized with collections save and categorize content based on your preferences by default compute engine encrypts customer content at rest compute engine automatically uses google owned and google managed encryption keys to encrypt your data however you can customize the encryption compute engine uses for your resources by providing key encryption keys keks key encryption keys don t directly encrypt your data but encrypt the google owned and managed keys that compute engine uses to encrypt your data to provide key encryption keys choose one of the following options recommended use customer managed encryption keys cmeks in cloud kms with compute engine using cloud kms keys gives you control over their protection level location rotation schedule usage and access permissions and cryptographic boundaries using cloud kms also lets you track key usage view audit logs and control key life cycles instead of google owning and managing the symmetric key encryption keys keks that protect your data you control and manage these keys in cloud kms you can create cmeks manually or you can use cloud kms autokey to have them created automatically on your behalf in most cases after you create a cmek encrypted disk you don t need to specify the key when working with the disk deprecated you can manage your own key encryption keys outside of compute engine and provide the key whenever you create or manage a disk this option is known as customer supplied encryption keys cseks when you manage csek encrypted resources you must always specify the key you used when encrypting the resource caution customer supplied encryption keys csek for compute engine are deprecated for more information and instructions on alternatives see csek deprecation in compute engine for more information about each encryption type see customer managed encryption keys and customer supplied encryption keys to add an additional layer of security to your hyperdisk balanced disks enable confidential mode confidential mode adds hardware based encryption to your hyperdisk balanced disks supported disk types this section lists the supported encryption types for disks and other storage options offered by compute engine persistent disk volumes support google owned and managed keys cmeks and cseks google cloud hyperdisk support cmeks and google owned and managed keys you can t use cseks to encrypt hyperdisks local ssd disks only support google owned and managed keys you can t use cseks or cmeks to encrypt local ssd disks disk clones and machine images support google owned and managed keys cmeks and cseks standard snapshots and instant snapshots support google owned and managed keys cmeks and cseks rotation for google owned and managed keys and cmeks compute engine rotates the google owned and managed keys used to protect your data on a yearly basis key rotation is an industry best practice for data security that limits the potential impact of a compromised key if you use cmeks google recommends that you enable automatic rotation for your resources for more information on rotating your keys see rotate your cloud kms encryption key for a disk or standard snapshot cmek with cloud kms autokey if you choose to use cloud kms keys to protect your compute engine resources you can either create cmeks manually or use cloud kms autokey to create the keys with autokey key rings and keys are generated on demand as part of resource creation in compute engine service agents that use the keys for encrypt and decrypt operations are created if they don t already exist and are granted the required identity and access management iam roles for more information see autokey overview to learn how to use cmeks created by cloud kms autokey to protect your compute engine resources see using autokey with compute engine resources snapshots when using autokey to create keys to protect your compute engine resources autokey doesn t create new keys for snapshots you must encrypt a snapshot with the same key used to encrypt the source disk if you create a snapshot using the google cloud console the encryption key used by the disk is automatically applied to the snapshot if you create a snapshot using the gcloud cli terraform or the compute engine api you must get the resource identifier of the key used to encrypt the disk and then use that key to encrypt the snapshot encrypt disks with customer managed encryption keys for more information about how to use manually created customer managed encryption keys cmek to encrypt disks and other compute engine resources see protect resources by using cloud key management service keys encrypt disks with customer supplied encryption keys caution customer supplied encryption keys csek for compute engine are deprecated for more information and instructions on alternatives see csek deprecation in compute engine to learn how to use customer supplied encryption keys csek to encrypt disks and other compute engine resources see encrypting disks with customer supplied encryption keys view a disk s encryption type to view a disk s encryption type follow the steps in view information about a disk s encryption confidential mode for hyperdisk balanced if you use confidential computing you can extend the hardware ba...
|
