Core concept
Keys in key rings. IAM-controlled. Auto-rotation. External Key Manager (EKM) for keys outside GCP.
Advertisement
How it works
Charged per key + operation. HSM more expensive. Bring Your Own Key supported.
Advertisement
Trade-offs + gotchas
CMEK for GCS, BigQuery, Cloud SQL, everything. Compliance-required key mgmt.