Google Cloud: Create a Customer Managed Encryption Key - Teradata VantageCloud Lake

Lake - Configure and Manage Your Environment and Organization
Deployment
VantageCloud
Edition
Lake
Product
Teradata VantageCloud Lake
Release Number
Published
February 2025
ft:locale
en-US
ft:lastEdition
2025-10-24
dita:mapPath
erj1683672627920.ditamap
dita:ditavalPath
pny1626732985837.ditaval
dita:id
erj1683672627920
Customer managed encryption keys (CMEK) allow you to control encryption keys to protect your organization's data. You choose the rotation schedule and the granularity of access.

You can use symmetric, single regions CMEK as well as the default cloud provider managed encryption keys.

Limitations

  • CMEK is not available with all Lake services. For those services data is secured at-rest with the cloud provider managed encryption keys.
  • Multi-region keys, HSM-based keys, and asymmetric keys are not supported.
  • You can only configure CMEK during provisioning. It cannot be enabled on an existing environment.
  1. Create a key in your Google account.
    1. Sign in to https://console.cloud.google.com.
    2. Select your project then Key management.
    3. Create a key ring.
      • Make sure the region is the same region where you are creating your Lake environment.
      • Teradata recommends Software as the protection level.
      • Teradata recommends manual rotation for keys.
        Important: You can choose automatic rotation, but automatic rotation for the CMEK does not produce automatic rotation for the Lake environment, as the CMEK is only rotated during upgrades. You should coordinate your key rotation process and make sure the new CMEK key version is submitted in the VantageCloud Lake Console under Settings > Storage Encryption > Rotate Key before the upgrade.
      • Select other options based on your organization requirements.
    4. Save the resource name for the key in a secure location. You need this value to complete provisioning the Lake environment.
  2. Follow the instructions in Step 1: Sign On and Create Your First Environment to create the Lake environment; then return here.

    3. Complete within 14 Days after Creating the Environment

  3. Copy and securely store the service accounts in the IAM policy bindings. You need these in later steps.
    GCP_CMEK.png
  4. Bind the IAM policies, you copied to the key in Google Cloud KMS.
    These steps were accurate when written. Consult Google documentation if they have changed.
    1. From the Google Cloud KMS, select Key then Permissions.
    2. Select View Principals, then Grant Access, then Add principals.
      Add the accounts without the serviceAccount prefix.
    3. Select the Cloud KMS Cryptokey Encrypter/Decrypter role and Save.
  5. Return to the Lake console, check the box I understand that I must complete this step before finalizing the setup and select Complete setup.