Meta tags:
description= Learn about the options for encrypting disks on Google Cloud, including how to use your own encryption keys;
Headings (most frequently used words):
for, encryption, with, and, confidential, mode, hyperdisk, balanced, disk, supported, keys, volumes, in, types, managed, encrypt, disks, customer, about, stay, organized, collections, save, categorize, content, based, on, your, preferences, rotation, google, owned, cmeks, cmek, cloud, kms, autokey, supplied, view, type, what, next, snapshots, machine, regions, limitations, products, pricing, support, resources, engage,
Text of the page (most frequently used words):
create (133), and (130), vms (105), for (95), with (85), the (82), about (65), troubleshoot (62), disk (59), #manage (50), compute (49), instance (49), hyperdisk (46), keys (45), disks (45), use (43), engine (43), cloud (42), view (42), using (42), google (40), server (39), encryption (34), windows (33), mig (33), you (32), overview (32), configure (32), performance (30), resources (27), reservation (27), set (27), mode (26), machine (25), confidential (24), managed (23), your (23), balanced (22), from (22), images (21), sql (21), that (20), monitor (20), image (19), key (19), snapshots (19), access (19), network (19), encrypt (18), gpu (18), linux (17), policies (16), creation (16), reservations (16), instances (16), can (15), custom (15), type (15), management (15), groups (15), ssh (15), recommendations (15), configuration (15), customer (14), cmeks (14), storage (14), workload (14), host (14), load (14), virtual (14), apply (14), connect (14), see (13), kms (13), volumes (13), availability (13), based (13), snapshot (13), best (13), persistent (13), bulk (13), microsoft (13), cluster (13), data (12), sole (12), regional (12), resource (11), add (11), logs (11), delete (11), practices (11), workloads (11), stateful (11), support (10), information (10), more (10), autokey (10), enable (10), application (10), manually (10), service (10), choose (10), metadata (10), migs (10), machines (10), attached (10), migrate (10), zones (10), high (9), security (9), protect (9), owned (9), licenses (9), tenant (9), multiple (9), openshift (9), shutdown (9), time (9), start (9), hpc (9), license (8), uses (8), types (8), new (8), supplied (8), control (8), usage (8), import (8), cpu (8), login (8), optimize (8), internal (8), install (8), disaster (8), recovery (8), agent (8), existing (8), update (8), guest (8), boot (8), h4d (8), flexibility (8), dns (8), optimized (8), tpu (8), thumb (7), cseks (7), how (7), pools (7), regions (7), used (7), demand (7), instant (7), options (7), networking (7), commitments (7), startup (7), balancing (7), benchmark (7), idle (7), addresses (7), request (7), scale (7), deploy (7), back (7), mysql (7), zonal (7), remove (7), maintenance (7), templates (7), backup (7), events (6), other (6), are (6), send (6), volume (6), available (6), when (6), csek (6), created (6), operations (6), local (6), ssd (6), audit (6), default (6), migration (6), updates (6), files (6), nested (6), gpus (6), across (6), applications (6), group (6), run (6), failover (6), extension (6), change (6), transfer (6), customized (6), spot (6), code (5), samples (5), understand (5), details (5), learn (5), suspend (5), console (5), automatically (5), get (5), location (5), monitoring (5), databases (5), accounts (5), errors (5), future (5), drivers (5), virtualization (5), nvidia (5), placement (5), node (5), highly (5), build (5), multi (5), modify (5), capacity (5), schedules (5), symphony (5), email (5), scripts (5), manager (5), between (5), operating (5), systems (5), enhanced (5), capabilities (5), stop (5), tenancy (5), restore (5), workstation (5), faq (5), flex (5), português (4), español (4), all (4), down (4), content (4), don (4), supported (4), only (4), specify (4), standard (4), automatic (4), rotation (4), schedule (4), tools (4), distributed (4), authentication (4), issues (4), ubuntu (4), bandwidth (4), tcp (4), pmu (4), number (4), share (4), projects (4), upgrade (4), live (4), autoscaling (4), cross (4), region (4), requests (4), calendar (4), single (4), metrics (4), health (4), active (4), clusters (4), containers (4), container (4), database (4), postgresql (4), extensions (4), work (4), zone (4), resize (4), graceful (4), locations (4), plans (4), replication (4), review (4), bound (4), terms (3), need (3), this (3), apache (3), format (3), extreme (3), throughput (3), additional (3), deprecated (3), cmek (3), must (3), api (3), industry (3), always (3), guides (3), infrastructure (3), observability (3), analytics (3), troubleshooting (3), pro (3), serial (3), configurations (3), patterns (3), higher (3), discounts (3), cuds (3), manual (3), scalable (3), resilient (3), autoscale (3), balancer (3), prevent (3), project (3), policy (3), list (3), testing (3), ibm (3), spectrum (3), perform (3), deploying (3), plan (3), during (3), prepare (3), deployment (3), rhel (3), environment (3), certificates (3), query (3), state (3), disable (3), properties (3), account (3), increase (3), lifecycle (3), design (3), size (3), non (3), pool (3), move (3), creating (3), workstations (3), series (3), tpus (3), product (3), 한국어 (2), 日本語 (2), עברית (2), brasil (2), italiano (2), indonesia (2), français (2), américa (2), latina (2), deutsch (2), english (2), sign (2), site (2), youtube (2), center (2), started (2), system (2), pricing (2), products (2), last (2), updated (2), 2026 (2), utc (2), licensed (2), under (2), feedback (2), automate (2), next (2), resume (2), west4 (2), following (2), follow (2), steps (2), lets (2), without (2), extend (2), hardware (2), encrypting (2), instructions (2), alternatives (2), deprecation (2), caution (2), source (2), terraform (2), identity (2), iam (2), roles (2), practice (2), limits (2), clones (2), adds (2), encrypted (2), own (2), provide (2), after (2), over (2), protection (2), permissions (2), keks (2), one (2), customize (2), documentation (2), sdk (2), languages (2), frameworks (2), costs (2), solutions (2), hybrid (2), multicloud (2), pipelines (2), hosting (2), development (2), quota (2), commitment (2), consumption (2), full (2), registration (2), sles (2), export (2), port (2), collecting (2), nodes (2), report (2), arm (2), core (2), rdp (2), general (2), app (2), latency (2), analyze (2), visible (2), cores (2), committed (2), generation (2), underutilized (2), insights (2), utilization (2), globally (2), web (2), autohealing (2), iis (2), external (2), shared (2), reserve (2), autoscaler (2), autoscalers (2), activity (2), kubernetes (2), provider (2), place (2), running (2), directory (2), setting (2), services (2), redis (2), cloning (2), writer (2), alwayson (2), name (2), file (2), authenticate (2), method (2), synchronization (2), global (2), switch (2), byol (2), payg (2), byos (2), changes (2), families (2), guide (2), securing (2), event (2), simulate (2), topology (2), together (2), repairs (2), repair (2), check (2), failures (2), template (2), suspended (2), stopped (2), target (2), distribution (2), physical (2), cancel (2), once (2), limit (2), interfaces (2), ipv6 (2), static (2), decrease (2), basic (2), consistent (2), scoped (2), copy (2), appliances (2), asynchronous (2), names (2), mount (2), memory (2), credentials (2), organization (2), user (2), through (2), advanced (2), rdma (2), specific (2), preemptible (2), provisioning (2), models (2), rtx (2), vws (2), constraints (2), accelerator (2), apis (2), reference (2), technology (2), areas (2), close (2), subscribe, newsletter, our, third, decade, climate, action, join, cookies, privacy, tech, twitter, blog, engage, training, certification, architecture, getting, github, status, release, notes, community, forums, contact, sales, marketplace, easy, easytounderstand, solved, problem, solvedmyproblem, otherup, hard, hardtounderstand, incorrect, sample, incorrectinformationorsamplecode, missing, missingtheinformationsamplesineed, otherdown, tell, except, otherwise, noted, page, java, registered, trademark, oracle, its, affiliates, developers, creative, commons, attribution, specification, preview, what, limitations, south1, east5, east4, central1, europe, n2d, having, refactor, property, enabling, computing, doesn, same, applied, gcloud, cli, identifier, then, either, rings, generated, part, agents, decrypt, they, already, exist, granted, required, rotating, rotate, recommends, rotates, yearly, basis, potential, impact, compromised, hyperdisks, section, lists, offered, layer, each, option, known, outside, whenever, most, cases, working, have, them, behalf, gives, their, level, cryptographic, boundaries, also, life, cycles, instead, owning, managing, symmetric, these, track, recommended, however, providing, directly, but, encrypts, rest, save, categorize, preferences, stay, organized, collections, home, concurrent, operation, renewal, nvme, resizing, common, pay, viewing, output, diagnostic, sudoers, screenshots, generate, bug, blackwell, soft, lockups, bus, locks, rescue, inaccessible, dumps, kernel, panic, fstab, unresponsive, suspension, reboots, shutdowns, connectivity, tips, nics, dpdk, improve, resiliency, communication, reduce, compact, idpf, interface, irdma, driver, nic, threads, per, sustained, merge, split, renew, purchase, cost, savings, dynamic, overcommit, cpus, floating, reliable, udp, backends, routing, https, scaling, consuming, consume, combine, cud, allow, sharing, decisions, signals, serving, predictions, organize, labels, replica, states, observe, reports, tensorflow, inference, tensorrt5, learning, monte, carlo, methods, spark, forwarding, others, integrate, clustering, exchange, 2016, sharepoint, strategies, passive, inactive, setups, built, integrations, validation, were, deployed, transition, test, hammerdb, bucket, aws, ec2, pacemaker, s2d, block, netapp, hot, standby, drbd, architectures, client, private, address, mailjet, mailgun, sendgrid, sending, blue, green, deployments, lamp, joomla, asp, net, interactive, mongodb, flask, servers, mtls, random, generator, virtio, rng, accurate, protocol, ntp, append, els, restrictions, packages, deprecate, versions, family, trusted, red, hat, knowledgebase, functionality, risks, command, vpc, controls, kek, secure, expiration, shielded, attributes, predefined, handle, notices, process, faulty, unmanaged, affect, preserved, turn, off, alternate, fails, repairing, maintain, click, upgrades, override, selectively, applying, accelerate, out, outage, rebalance, reenable, proactive, redistribution, shape, distribute, define, info, accidental, deletion, spread, edit, rename, reset, restart, referrers, uuid, recover, corrupted, duplicate, alerts, backups, vss, regionally, different, considerations, synchronous, consistency, failback, replicate, make, provisioned, iops, evaluate, settings, help, symbolic, links, device, ram, attach, exapools, verify, ptr, record, failure, rates, tags, restrict, password, require, powershell, sac, securely, apps, root, vpn, bastion, iap, connection, browser, connections, networks, within, iso, imported, prerequisites, importing, exporting, bring, path, detach, reattach, constraint, accounting, provision, examples, slurm, reserved, team, slice, slices, scenarios, deterministic, base, requirements, ready, aci, configured, preempted, historical, alternative, similar, displays, ops, logging, subnet, public, has, gpudirect, enabled, ultra, minimum, platform, hostname, quickstarts, office, licensing, premium, strategy, gemini, bare, metal, accelerators, platforms, scores, purpose, discover, free, skip, main,
Text of the page (random words):
deploying microsoft exchange server 2016 on compute engine windows server perform an in place upgrade of windows server run windows server failover clustering ibm spectrum symphony integrate ibm spectrum symphony with google cloud install the compute engine symphony provider install the google kubernetes symphony provider troubleshoot ibm spectrum symphony others load testing distributed load testing using kubernetes ssh port forwarding and load testing analytics monte carlo methods using apache spark machine learning run tensorflow inference workloads with tensorrt5 and nvidia t4 gpu monitor monitor logs view audit logs view usage reports view compute engine operations migrate from activity logs to audit logs view activity logs monitor resources monitor vm and sole tenant node usage observe and monitor vms monitor gpu performance monitor gpu performance on linux vms monitor gpu performance on windows vms monitor disks monitor disk health monitor the replica states of regional disks monitor disks list of metrics for pools monitor pools monitor reservations organize resources using labels scale autoscale groups of vms about autoscaling groups of vms create and manage autoscalers scale based on cpu utilization scale based on predictions scale based on load balancing serving capacity scale based on monitoring metrics scale based on schedules use an autoscaling policy with multiple signals manage autoscalers understand autoscaler decisions view autoscaler logs autoscale node groups reserve vm capacity choose a reservation type sharing reservations best practices for shared reservations allow a project to share reservations on demand reservations about on demand reservations create an on demand reservation for a single project for multiple projects combine an on demand reservation with a cud modify an on demand reservation delete an on demand reservation future reservations about future reservations create a reservation request for a single project for multiple projects modify a reservation request delete a reservation request future reservations in calendar mode about future reservations in calendar mode create a reservation request in calendar mode delete a reservation request in calendar mode view reservations or reservation requests consume a reservation prevent vms from consuming reservations load balancing about load balancing and scaling add an instance group to a load balancer request routing to a multi region external https load balancer cross region load balancing for microsoft iis backends set up internal tcp udp load balancing build reliable and scalable applications use autohealing for highly available applications use load balancing for highly available applications use autoscaling for highly scalable applications globally autoscale a web service on compute engine patterns for scalable and resilient applications patterns for using floating ip addresses on compute engine optimize resource utilization use recommendations to manage resources apply machine type recommendations to vms configure machine type recommendations apply machine type recommendations to migs view and apply idle resources recommendations view and understand vm insights view and understand mig insights manage idle vm recommendations idle vm recommendations overview view and apply idle vm recommendations configure idle vm recommendations manage reservation recommendations reservation recommendations overview view and apply idle reservation recommendations view and apply underutilized reservation recommendations configure idle reservation recommendations configure underutilized reservation recommendations overcommit cpus on sole tenant vms manual live migration about manual live migration manually live migrate vms share sole tenant node groups next generation dynamic resource management cost savings get discounts for committed usage about commitments and committed use discounts cuds resource based cuds purchase resource based commitments without attached reservations with attached reservations for os licenses manage resource based commitments renew commitments automatically extend commitment terms merge and split commitments upgrade commitments share resource based cuds across projects get discounts for sustained usage disk performance optimize hyperdisk performance optimize persistent disk performance optimize local ssd performance workload performance set the number of threads per core customize the number of visible cpu cores analyze the cpu performance using the pmu pmu overview enable the pmu in vms manage the pmu in vms network performance network bandwidth use google virtual nic use irdma network driver use idpf network interface configure a vm with higher bandwidth reduce latency by using compact placement policies optimize tcp network communication optimize tcp network performance optimize tcp network resiliency benchmark higher bandwidth vms optimize app latency with load balancing use dpdk to improve network performance network performance and gpu vms networking and gpu machines use higher network bandwidth patterns for using multiple host nics troubleshoot general tips troubleshoot connectivity troubleshoot rdp troubleshoot ssh troubleshoot os login troubleshoot vms troubleshoot vm operations troubleshoot vm creation troubleshoot resource availability errors troubleshoot bulk api vm creation troubleshoot vm reboots and shutdowns troubleshoot vm suspension troubleshoot vm updates troubleshoot unresponsive vms troubleshoot vm startup troubleshoot fstab errors troubleshoot kernel panic collecting core dumps rescue an inaccessible vm troubleshoot cpu bus locks troubleshoot cpu soft lockups troubleshoot vm configurations troubleshoot arm vms troubleshoot gpu vms troubleshoot nvidia gpu errors generate a nvidia bug report for blackwell gpus troubleshoot nested virtualization troubleshoot using vm screenshots troubleshoot sole tenant nodes troubleshoot vm performance issues troubleshoot sudoers files troubleshoot windows vms troubleshoot windows vms collecting diagnostic information troubleshoot using the serial console troubleshoot using the serial console viewing serial port output troubleshoot instance groups troubleshoot managed instance groups migs troubleshoot os management troubleshoot licenses troubleshoot image import and export troubleshooting sles pay as you go registration troubleshooting ubuntu pro registration troubleshoot metadata server troubleshoot metadata server troubleshoot networking issues troubleshoot common networking issues troubleshoot network drivers troubleshoot vm performance issues troubleshoot storage troubleshoot disk creation troubleshoot full disks and disk resizing troubleshoot disk encryption troubleshoot nvme disks troubleshoot instant snapshots troubleshoot standard snapshots troubleshoot reservations and commitments troubleshoot reservation creation troubleshoot reservation consumption troubleshooting reservation monitoring troubleshoot reservation updates troubleshoot future reservation creation and updates troubleshoot automatic commitment renewal troubleshoot quota errors troubleshoot concurrent operation quota errors troubleshoot workload authentication troubleshoot default service accounts troubleshoot workload to workload authentication ai and ml application development application hosting compute data analytics and pipelines databases distributed hybrid and multicloud industry solutions migration networking observability and monitoring security storage access and resources management costs and usage management infrastructure as code sdk languages frameworks and tools home documentation compute compute engine guides send feedback about disk encryption stay organized with collections save and categorize content based on your preferences by default compute engine encrypts customer content at rest compute engine automatically uses google owned and google managed encryption keys to encrypt your data however you can customize the encryption compute engine uses for your resources by providing key encryption keys keks key encryption keys don t directly encrypt your data but encrypt the google owned and managed keys that compute engine uses to encrypt your data to provide key encryption keys choose one of the following options recommended use customer managed encryption keys cmeks in cloud kms with compute engine using cloud kms keys gives you control over their protection level location rotation schedule usage and access permissions and cryptographic boundaries using cloud kms also lets you track key usage view audit logs and control key life cycles instead of google owning and managing the symmetric key encryption keys keks that protect your data you control and manage these keys in cloud kms you can create cmeks manually or you can use cloud kms autokey to have them created automatically on your behalf in most cases after you create a cmek encrypted disk you don t need to specify the key when working with the disk deprecated you can manage your own key encryption keys outside of compute engine and provide the key whenever you create or manage a disk this option is known as customer supplied encryption keys cseks when you manage csek encrypted resources you must always specify the key you used when encrypting the resource caution customer supplied encryption keys csek for compute engine are deprecated for more information and instructions on alternatives see csek deprecation in compute engine for more information about each encryption type see customer managed encryption keys and customer supplied encryption keys to add an additional layer of security to your hyperdisk balanced disks enable confidential mode confidential mode adds hardware based encryption to your hyperdisk balanced disks supported disk types this section lists the supported encryption types for disks and other storage options offered by compute engine persistent disk volumes support google owned and managed keys cmeks and cseks google cloud hyperdisk support cmeks and google owned and managed keys you can t use cseks to encrypt hyperdisks local ssd disks only support google owned and managed keys you can t use cseks or cmeks to encrypt local ssd disks disk clones and machine images support google owned and managed keys cmeks and cseks standard snapshots and instant snapshots support google owned and managed keys cmeks and cseks rotation for google owned and managed keys and cmeks compute engine rotates the google owned and managed keys used to protect your data on a yearly basis key rotation is an industry best practice for data security that limits the potential impact of a compromised key if you use cmeks google recommends that you enable automatic rotation for your resources for more information on rotating your keys see rotate your cloud kms encryption key for a disk or standard snapshot cmek with cloud kms autokey if you choose to use cloud kms keys to protect your compute engine resources you can either create cmeks manually or use cloud kms autokey to create the keys with autokey key rings and keys are generated on demand as part of resource creation in compute engine service agents that use the keys for encrypt and decrypt operations are created if they don t already exist and are granted the required identity and access management iam roles for more information see autokey overview to learn how to use cmeks created by cloud kms autokey to protect your compute engine resources see using autokey with compute engine resources snapshots when using autokey to create keys to protect your compute engine resources autokey doesn t create new keys for snapshots you must encrypt a snapshot with the same key used to encrypt the source disk if you create a snapshot using the google cloud console the encryption key used by the disk is automatically applied to the snapshot if you create a snapshot using the gcloud cli terraform or the compute engine api you must get the resource identifier of the key used to encrypt the disk and then use that key to encrypt the snapshot encrypt disks with customer managed encryption keys for more information about how to use manually created customer managed encryption keys cmek to encrypt disks and other compute engine resources see protect resources by using cloud key management service keys encrypt disks with customer supplied encryption keys caution customer supplied encryption keys csek for compute engine are deprecated for more information and instructions on alternatives see csek deprecation in compute engine to learn how to use customer supplied encryption keys csek to encrypt disks and other compute engine resources see encrypting disks with customer supplied encryption keys view a disk s encryption type to view a disk s encryption type follow the steps in view information about a disk s encryption confidential mode for hyperdisk balanced if you use confidential computing you can extend the hardware based encryption to your hyperdisk balanced volumes by enabling confidential mode confidential mode for your hyperdisk balanced volumes lets you enable additional security without having to refactor the application confidential mode is a property that you can specify when you create a new hyperdisk balanced volume hyperdisk balanced volumes in confidential mode can only be used with confidential vms to create a hyperdisk balanced volume in confidential mode follow the steps in create a hyperdisk balanced volume in confidential mode supported machine types for hyperdisk balanced volumes in confidential mode hyperdisk balanced volumes in confidential mode can only be used with confidential vms that use the n2d machine type supported regions for hyperdisk balanced volumes in confidential mode confidential mode for hyperdisk balanced volumes is available in the following regions europe west4 us central1 us east4 us east5 us south1 us west4 limitations for hyperdisk balanced volumes in confidential mode hyperdisk extreme hyperdisk throughput hyperdisk ml and hyperdisk balanced high availability don t support confidential mode you can t suspend or resume a vm that uses hyperdisk balanced volumes in confidential mode you can t use hyperdisk storage pools with hyperdisk balanced volumes in confidential mode you can t create a machine image or a custom image from a hyperdisk balanced volume in confidential mode what s next to learn how to automate the creation of cmeks see cloud kms with autokey preview to learn how to create cmeks see create encryption keys with cloud kms encrypt a disk with customer managed encryption keys cmeks to create a hyperdisk balanced volume in confidential mode see create a hyperdisk balanced volume in confidential mode learn more about the format and specification for cseks send feedback except as otherwise noted the content of this page is licensed under the creative commons attribution 4 0 license and code samples are licensed under the apache 2 0 license for details see t...
|
