To use customer-supplied encryption keys (CSEK) for encrypting data on Cloud Storage, follow these steps: Generate an Encryption Key: Generate a 256-bit AES encryption key. This key should be base64- encoded. sh Copy code
openssl rand -base64 32
Upload Object with CSEK: Use the gsutil command-line tool to upload the object to Cloud Storage, specifying the location of the encryption key using the -o option. gsutil -o "GSUtil:encryption_key=" cp [LOCAL_OBJECT_PATH] gs://[BUCKET_NAME]/ Verify Encryption: After uploading the object, you can verify that it is encrypted using the provided CSEK by checking the object's metadata. gsutil stat gs://[BUCKET_NAME]/[OBJECT_NAME] Key Management: Ensure that the encryption key is securely stored and managed. It should not be hard-coded in scripts or applications. By using the gsutil tool and specifying the encryption key, you ensure that the object is encrypted using the customer-supplied encryption key during the upload process.
Reference:: Customer-Supplied Encryption Keys (CSEK) Documentation gsutil Command Line Tool Documentation