Cloud KMS release notes

Preview: Cloud KMS supports quantum-safe key import. You can use the following quantum-safe import methods:

• HPKE_KEM_XWING_HKDF_SHA256_AES_256_GCM
• HPKE_KEM_ML_KEM_768_HKDF_SHA256_AES_256_GCM
• HPKE_KEM_ML_KEM_1024_HKDF_SHA256_AES_256_GCM

For more information about quantum-safe key import, see Quantum-safe key import.

Cloud KMS Autokey with same-project key storage (formerly known as Autokey for delegated key management) is generally available. Autokey with same-project key storage can be used on its own or alongside Autokey with dedicated-project key storage (formerly known as Autokey for centralized key management).

For more information, see Enable Cloud KMS Autokey. To learn how to set guardrails to constrain how Autokey is used in your organization, see Control Autokey usage.

Cloud KMS supports the following post-quantum computing (PQC) signing algorithms in General Availability:

• PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256
• PQ_SIGN_ML_DSA_44
• PQ_SIGN_ML_DSA_44_EXTERNAL_MU
• PQ_SIGN_ML_DSA_65
• PQ_SIGN_ML_DSA_65_EXTERNAL_MU
• PQ_SIGN_ML_DSA_87
• PQ_SIGN_ML_DSA_87_EXTERNAL_MU
• PQ_SIGN_SLH_DSA_SHA2_128S

For more information about supported algorithms, see PQC signing algorithms. For more information about PQC signing, see Post-quantum cryptography (PQC) digital signature.

The Cloud KMS overview dashboard Asymmetric PQC insights chart is generally available. You can use the Asymmetric PQC insights chart and details view to identify how many and which of your asymmetric keys are susceptible to attacks from future quantum computers. This information is an important input into your quantum computing modernization planning and process.

For more information about the Asymmetric PQC insights chart, see View asymmetric post-quantum cryptography (PQC) insights.

The Cloud KMS Encryption metrics dashboard and project-level key tracking are generally available. You can use the Encryption metrics dashboard to review summaries and details of your keys used in customer-managed encryption key (CMEK) integrations and the resources that they protect. The Encryption metrics dashboard and the key Usage tracking tab support both centralized key management using a dedicated key project and delegated key management using keys stored in the same projects as the resources that they protect.

For more information about the Encryption metrics dashboard, see View encryption metrics. For more information about project-level key tracking, see View key usage.

Cloud KMS deletion of keys and key versions is generally available. Keys and key versions must meet deletion criteria before they can be deleted. Names of deleted keys can't be reused.

For more information, including deletion criteria, see Delete Cloud KMS resources.

Cloud KMS Autokey for projects is available in Public Preview. Autokey for projects lets you enable Cloud KMS Autokey for delegated key management. In delegated key management, keys created by Autokey are created in the same project as the resources they protect. This option is suitable for your organization if project administrators are in charge of key management for the projects they manage.

You can still use Cloud KMS Autokey for centralized key management in a folder, where all keys that protect resources in that folder are created in a dedicated key project. You can also use centralized key management in a folder, with certain projects within that folder configured to use delegated key management and same-project keys instead of creating keys in the dedicated key project.

You can enable Autokey for projects on individual projects or on all projects within a folder. For more information, see Enable Cloud KMS Autokey.

Cloud KMS is available in the following region:

• asia-southeast3

For more information, see Cloud KMS locations.

Single-tenant Cloud HSM is now generally available. With Single-tenant Cloud HSM, you can create and manage dedicated single-tenant instances. Each instance is a cluster of partitions on HSMs in a single Cloud KMS region. Google manages the HSMs, but you have administrative control over your instance.

Single-tenant Cloud HSM is available in the following locations:

• us-central1
• us-east4
• europe-west1
• europe-west4

Creating a managing an instance requires quorum approval with two-factor authentication using keys that you create and secure outside of Google Cloud. Single-tenant Cloud HSM instances incur additional costs.

For more information about Single-tenant Cloud HSM, see Single-tenant Cloud HSM. To learn how to create and maintain a Single-tenant Cloud HSM instance, see Create and manage a Single-tenant Cloud HSM instance. To see pricing details for Single-tenant Cloud HSM, see Pricing for Single-tenant Cloud HSM.

Cloud KMS now supports key encapsulation mechanisms (KEMs) for sharing secrets in Preview. KEMs are designed to be resistant to post-quantum attacks. You can use the following KEM algorithms:

• ML_KEM_768
• ML_KEM_1024
• KEM_XWING

For more information about key encapsulation mechanisms, see Key encapsulation mechanisms. To learn how to use key encapsulation mechanisms to share secrets, see Encapsulate and decapsulate using KEMs.

Cloud HSM for Google Workspace now lets you use Cloud HSM keys for client-side encryption (CSE) to protect sensitive workloads in Google Workspace. For more information about Cloud HSM for Google Workspace, including how to get started, see Onboard to Cloud HSM for Google Workspace.

To help you get the right Cloud KMS keys on-demand, for consistent alignment with recommended encryption practices, Cloud KMS Autokey now has a free tier. The free tier covers the following usage:

• 100 free active key versions monthly
• 10,000 free cryptographic operations monthly

The free tier only applies to keys created using Cloud KMS Autokey. Key administration operations including key rotation are always free. For more details, see Cloud Key Management Service pricing

Cloud KMS is available in the following region:

• europe-north2

For more information, see Cloud KMS locations.

Cloud KMS now supports the following post-quantum computing (PQC) algorithms for digital signatures in Public Preview:

• PQ_SIGN_ML_DSA_65: Module-lattice-based digital signature algorithm
• PQ_SIGN_SLH_DSA_SHA2_128S: Stateless hash-based digital signature algorithm

To Retrieve a public key for a PQC key, you must use the gcloud CLI or the Cloud KMS REST API.

• For the gcloud CLI, use the --public-key-format nist-pqc flag.
• For the REST API, use the public_key_format=NIST_PQC header parameter.

For more information about PQC algorithms, see PQC signing algorithms. For more information about PQC digital signatures, see Post-quantum cryptography (PQC) digital signature.

Cloud KMS is available in the following region:

• northamerica-south1

For more information, see Cloud KMS locations.

You can now use custom constraints with Organization Policy to provide more granular control over specific fields for some Cloud KMS resources. For more information, see Create custom organization policy constraints for Cloud KMS.

Cloud KMS with Autokey is now in General Availability for Cloud Storage, Compute Engine, BigQuery, Secret Manager, Cloud SQL, and Spanner.

Autokey simplifies creating and using customer-managed encryption keys (CMEKs) by automating provisioning and assignment. With Autokey, key rings, keys, and service accounts don't need to be planned and provisioned before they're needed. Instead, Autokey generates keys on demand as resources are created.

Using keys generated by Autokey can help you consistently align with industry standards and recommended practices for data security, including the HSM protection level, separation of duties, key rotation, location, and key specificity. Keys requested using Autokey function identically to other Cloud HSM keys with the same settings. For more information, see Autokey overview.

As previously announced, Cloud KMS has changed the default duration of the scheduled for destruction period from 24 hours to 30 days.

As of February 1, 2024, newly created CryptoKeys use the new default duration of 30 days, unless a different duration is specified during key creation. For more information about key destruction, see Destroy and restore key versions.

Owners of existing CryptoKeys that had used the default duration were given until May 1, 2024 to opt out from automatically updating those keys to use the new default duration. Existing CryptoKeys that were not opted out have been updated to use the new default duration of 30 days. No further action is required from you.

Cloud KMS with Autokey is now in Preview for Cloud Storage, Compute Engine, BigQuery, and Secret Manager.

Autokey simplifies creating and using customer-managed encryption keys (CMEKs) by automating provisioning and assignment. With Autokey, key rings, keys, and service accounts don't need to be planned and provisioned before they're needed. Instead, Autokey generates keys on demand as resources are created.

Using keys generated by Autokey can help you consistently align with industry standards and recommended practices for data security, including the HSM protection level, separation of duties, key rotation, location, and key specificity. Keys requested using Autokey function identically to other Cloud HSM keys with the same settings.

For more information, see Autokey overview.

Cloud KMS has two new organization policy constraints that you can use to control key version destruction. These constraints became available on November 1, 2023.

For more information, see Control key version destruction.

Cloud KMS now supports asymmetric signing and validation using ECDSA on the Curve25519 in PureEdDSA mode, which takes raw data as input instead of hashed data.

For more information on this and other algorithms supported by Cloud KMS, see Key purposes and algorithms.

Bare Metal Rack HSM is generally available for customers with specific business and technical requirements in limited regions.

Bare Metal Rack HSM is an infrastructure-as-a-service offering that lets you deploy large numbers of customer-owned hardware security modules (HSMs) in PCI-compliant facilities next to your Google Cloud workloads. This product helps to accelerate migration of your payment applications to Google Cloud.

For more information, including to compare Bare Metal Rack HSM with Bare Metal HSM, see Bare Metal Rack HSM.

Certificate bundles for verifying attestations for Cloud HSM keys are deprecated. You can no longer download certificate bundles as of March 20, 2024.

Certificate bundles have been replaced by certificate chains. To learn how to use certificate chains to verify attestations for Cloud HSM keys, see Verifying the attestation manually.

Cloud KMS is available in the following region:

• africa-south1

For more information, see Cloud KMS locations.

Bare Metal HSM is generally available for customers with specific business and technical requirements in limited regions.

Bare Metal HSM is an infrastructure-as-a-service offering that lets you deploy customer-owned hardware security modules (HSMs) in PCI-compliant facilities next to your Google Cloud workloads. This product helps to accelerate migration of your payment applications to Google Cloud.

For more information, see Bare Metal HSM.

Cloud KMS is available in the following region:

• me-central2

For more information, see Cloud KMS locations.

Cloud KMS is available in the following region:

• europe-west10

For more information, see Cloud KMS locations.

The Key Usage dashboard in the Google Cloud console and the new KMS Inventory REST API are now generally available.

For more information about the Key Usage dashboard, see View key usage.

For more information about the KMS Inventory REST API, see KMS Inventory API.

For example curl commands using the KMS Inventory REST API, see View key usage and View keys by project.

Cloud HSM resources are now available in the following regions:

• europe-west12
• me-central1

For information about which locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see Cloud KMS locations.

Cloud KMS is available in the following region:

• me-central1

For more information, see Cloud KMS locations.

Cloud EKM now supports coordinated external keys.

Coordinated external keys let you create and manage keys in a compatible external key management system from Cloud KMS over a VPC network. For more information, see EKM key management from Cloud KMS.

Thales CipherTrust Cloud Key Manager is the first external key management partner system that is compatible with EKM key management from Cloud KMS.

Cloud KMS is available in the following region:

• europe-west12

For more information, see Cloud KMS locations.

Cloud KMS and Cloud EKM resources are available in the in (India) multi-regional location. Cloud HSM resources are not available in this location.

For information about which Google Cloud Locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see Cloud KMS Locations.

The Key Usage dashboard in the Google Cloud console and the new KMS Inventory REST API are now in Preview.

For more information about the Key Usage dashboard, see View key usage.

For more information about the KMS Inventory REST API, see KMS Inventory API.

For example curl commands using the KMS Inventory REST API, see View key usage and View keys by project.

Cloud HSM resources are now available in the following regions:

• europe-southwest1
• europe-west9
• me-west1

For information about which locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see Cloud KMS locations.

Cloud KMS is available in the following region:

• me-west1

For more information, see Cloud KMS locations.

Customers enrolled in Key Access Justifications will now see justifications listed in Cloud Audit Logs for Cloud KMS.

Cloud EKM now supports Dataproc Metastore. For more information, see Cloud External Key Manager.

Cloud KMS is available in the following region:

us-south1

For more information, see Cloud KMS locations.

Cloud KMS is available in the following region:

• us-east5

For more information, see Cloud KMS locations.

Cloud KMS is available in the following region:

• europe-southwest1

For more information, see Cloud KMS locations.

Cloud KMS is available in the following region:

• europe-west9

For more information, see Cloud KMS locations.

Two new organization policy constraints are now available in Preview to help ensure CMEK usage across an organization:

• constraints/gcp.restrictNonCmekServices requires CMEK protection.
• constraints/gcp.restrictCmekCryptoKeyProjects limits which Cloud KMS keys are used for CMEK protection.

To learn more, see CMEK organization policies.

Cloud EKM now supports Cloud Bigtable and Log Storage in Cloud Logging. For more information, see Cloud External Key Manager.

Using Cloud EKM with a Virtual Private Network is now generally available. This means you can access your external key manager with a private endpoint.

See Using Cloud EKM with VPC to learn more.

Cloud HSM resources are now available in the following regions:

• asia1
• eur3
• eur4
• nam3
• nam4
• nam6
• nam9

For information about which locations are supported by Cloud KMS, Cloud HSM, and Cloud EKM, see Cloud KMS locations.

Virtru is now available as a supported Cloud EKM partner. See Supported key managers to learn more.

You can now use Cloud EKM with a Virtual Private Network (preview). This means you can access your external key manager with a private endpoint.

See Using Cloud EKM with VPC to learn more.

Cloud EKM now supports Cloud Run, Dataproc, and Vertex AI. For more information, see Cloud External Key Manager.

Cloud HSM is now available in the Melbourne (australia-southeast2) region.

Asymmetric keys for Cloud EKM are now generally available (GA).

The Cloud EKM cryptographic requests quota has been increased from 10 QPS to 100 QPS. If you use quotas to determine how much you are billed, this change could increase the amount you spend on Cloud KMS. See Cloud EKM quotas for more details.

Cloud KMS is now available in the Santiago (southamerica-west1) region.

You can now attest HSM keys using certificate chains via gcloud command-line tool, Cloud Console, or Cloud KMS API. See Verifying attestations to learn more.

Cloud KMS now provides a library that conforms to the PKCS #11 standard, which enables working with existing applications that use the PKCS #11 API. See Library for PKCS #11 to learn more.

Re-importing previously destroyed keys is now supported in Cloud KMS.

You can now retrieve random bytes from the random number generator in Cloud HSM. See Generating random bytes to learn more.

MAC keys are now supported by Cloud KMS. See Creating and validating MAC digital signatures to learn more.

Cloud KMS now supports a configurable variable soft deletion window for cryptographic keys.

Cloud EKM now supports Artifact Registry, Logs Router in Cloud Logging, and Cloud Spanner. For more information, see Cloud External Key Manager.

Several fields related to verifying end-to-end data integrity for cryptographic operations are generally available (GA).

The Cloud KMS and Cloud HSM SLA has been updated.

Cloud EKM now supports Dataflow Appliance and Pub/Sub. For more information, see Cloud External Key Manager.

The europe-central2 region in Warsaw is now available. See Cloud KMS locations for more details.

Cloud EKM adds support for Dataflow shuffle and Secret Manager. For more information, see Cloud External Key Manager.

Cloud EKM now supports Cloud SQL and GKE. For more information, see Cloud External Key Manager.

Cloud HSM resources are available in the us-west4 and asia-southeast2 regions. Cloud KMS resources were already available in these regions.