CMEK organization policies

Google Cloud offers two organization policy constraints to help ensure CMEK usage across an organization:

• constraints/gcp.restrictNonCmekServices is used to require CMEK protection.
• constraints/gcp.restrictCmekCryptoKeyProjects is used to limit which Cloud KMS keys are used for CMEK protection.

CMEK organization policies only apply to newly created resources within supported Google Cloud services.

Required roles

To ensure that each user has the necessary permissions to check organization policies when creating resources, ask your administrator to grant the Organization Policy Viewer (roles/orgpolicy.policyViewer) IAM role to each user on your organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the permissions required to check organization policies when creating resources. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to check organization policies when creating resources:

• To view full organization policy details: orgpolicy.policy.get
• To check organization policy when creating resources: orgpolicy.policies.check

Your administrator might also be able to give each user these permissions with custom roles or other predefined roles.

When organization policies are active, the orgpolicy.policies.check permission is required for Google Cloud console users who create resources that are protected by CMEK keys. Users without this permission can create CMEK-protected resources using the Google Cloud console, but they can select a CMEK key that isn't allowed by the restrictCmekCryptoKeyProjects constraint. When a key that does not meet this constraint is selected, resource creation eventually fails.

Require CMEK protection

To require CMEK protection for your organization, configure the constraints/gcp.restrictNonCmekServices organization policy.

As a list constraint, the accepted values for this constraint are Google Cloud service names (for example, bigquery.googleapis.com). Use this constraint by providing a list of Google Cloud service names and setting the constraint to Deny. This configuration blocks the creation of resources in these services if the resource is not protected by CMEK. In other words, requests to create a resource in the service don't succeed without specifying a Cloud KMS key. Additionally, this constraint blocks the removal of CMEK protection from resources in these services. This constraint can only be applied to supported services.

Limit the use of Cloud KMS keys for CMEK

To limit which Cloud KMS keys are used for CMEK protection, configure the constraints/gcp.restrictCmekCryptoKeyProjects constraint.

As a list constraint, the accepted values are resource hierarchy indicators (for example, projects/PROJECT_ID, under:folders/FOLDER_ID, and under:organizations/ORGANIZATION_ID). Use this constraint by configuring a list of resource hierarchy indicators and setting the constraint to Allow. This configuration restricts supported services so that CMEK keys can be chosen only from the listed projects, folders, and organizations. Requests to create CMEK-protected resources in configured services don't succeed without a Cloud KMS key from one of the allowed resources. Where configured, this constraint applies to all supported services.

Supported services