Reading a KMS encrypted file from Google Cloud Dataflow - google-cloud-platform

I went through this Google Cloud Documentation, which mentions that :-
Dataflow can access sources and sinks that are protected by Cloud KMS keys without you having to specify the Cloud KMS key of those sources and sinks, as long as you are not creating new objects.
I have a few questions regarding this:
Q.1. Does this mean we don't need to decrypt the encrypted source file within our Beam code ? Does Dataflow has this functionality built-in?
Q.2. If the source file is encrypted, will the output file from Dataflow be encrypted by default with the same key (let us say we have a symmetric key) ?
Q.3. What are the objects that are being referred here?
PS: I want to read from an encrypted AVRO file placed in the GCS bucket, apply my Apache Beam Transforms from my code and write an encrypted file back to the bucket.

Cloud Dataflow is a fully managed service where if encryption is not specified, it automatically applies Cloud KMS encryption. Cloud KMS is cloud hosted key management service that can manage both symmetric and asymmetric cryptographic keys.
When Cloud KMS is used with Cloud Dataflow, it allows you to encrypt the data that is to be processed in the Dataflow pipeline. Using Cloud KMS, the data that is temporarily stored in temporary storage like Persistent Disk can be encrypted to get end-to-end protection of data. You need not to decrypt the source file within the beam code as data from the sources is encrypted and decryption will be done automatically by the Dataflow.
If you are using a symmetric key, then a single key can be used for both encryption and decryption of the data which is managed by Cloud KMS stored in ciphertext. If you are using an asymmetric key, then a public key will be used to encrypt the data and a private key will be used to decrypt the data. You need to provide Cloud KMS CryptoKey Encrypter/Decrypter role to the Dataflow service account before performing encryption and decryption. Cloud KMS automatically determines the key for decryption based on the provided ciphertext so no need to take extra care for decryption.
The objects that you have mentioned which are encrypted by the Cloud KMS can be tables in BigQuery, files in Cloud Storage and different data in the sources and sinks.
For more information you can check this blog.

Related

Encryption of s3 object

I am storing data in file in aws s3 and already enabled SSE. but i am curious to know is there a way to encrypt the data so when someone download the file so they cant see the content?? I am just new to AWS and it would be great if somw one give the input
Use the AWS Key Management Service (AWS KMS) to encrypt the data prior to uploading it to an Amazon S3 bucket. Then the data will remain encrypted until it's decrypted using the key. YOu can find an example here (for Java SDK)
https://github.com/awsdocs/aws-doc-sdk-examples/blob/main/javav2/example_code/s3/src/main/java/com/example/s3/KMSEncryptionExample.java
already enabled SSE.
SSE encrypts the content on S3, but an authenticated client cloud access the content in plain, the encryption is done under the hood and the client is unable to access the ciphertext (encrypted form)
You can use the default s3 key or a custom KMS key (CMS) , where the client need explicit access to decrypt the content.
download the file so they cant see the content??
Then the content needs to be encrypted before the upload. AWS provides some support for the client-side encryption but the client is free to implement its own encryption strategy and the key management.
To solve trouble with managing the keys on the client side, it's often more practical to stick with SSE and allow access to S3 or the used CMS (key) only to identities that must access the content.

Uploading Custom Private Keys for use in Google Cloud KMS

Topic - Google Cloud KMS and support for custom keys
I was exploring the documentation for the google cloud KMS. It mentions that the Cloud KMS is more of management service that helps controlling and managing the DEKs which are used by google in 2 ways
CMEK - Allowing google to create KEK and us to manage the rotation and other aspects
CMEK - Allowing to import your own key which will act as KEK on top of google DEK.
From what I understand and seen, cloud KMS allows control over the key that encrypts the DEK.
Does Google Cloud KMS also support storing our custom private keys (CSEK) for encryption and usage/signing.
Customer-supplied Encryption Keys (CSEK) are a feature of Google Cloud Storage and Google Compute Engine.Google uses the encryption key supplied by the customer to protect the Google-generated keys used to encrypt and decrypt the user’s data [1].
When a customer supplied a CSEK (Customer Supplied Encryption Key) Cloud storage does not store the CSEK key permanently on the google server or manage the key. You have to provide the key for each cloud storage operation, and your key is purged from Google’s servers after the operation is complete. Cloud Storage stores only a cryptographic hash of the key so that in the future if the customer again supplies the key, it can be validated against the hash. But the key cannot be recovered from this hash, and the hash cannot be used to decrypt the data [2].
In Case of Google Compute Engine also, Google does not store your keys on it’s servers and cannot access your protected data unless you provide the key. If you by mistake forget or lose your key, there is no way for Google to recover the key or to recover any data encrypted with the lost key. For instance when you delete a persistent disk, google discards the cipher keys, rendering the data irretrievable [3].
Useful Links:
[1] https://cloud.google.com/security/encryption/customer-supplied-encryption-keys
[2] https://cloud.google.com/storage/docs/encryption/customer-supplied-keys
[3] https://cloud.google.com/compute/docs/disks/customer-supplied-encryption

Is it possible have client side encryptions while exporting cloudsql data to cloud storage

I am trying to export data to cloud storage buckets. I am trying to understand:
If I can leverage the client side encryption either using Customer Managed or Customer Supplied encryption keys.
I don't see any option in gcloud sql export sql command to supply keys which is mentioned in docs [https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys#add-object-key][1]
Will the objects in the buckets get encrypted by default or should I pass the encryption-key ref in the export command!!
And I also have a query:
while exporting data to buckets, can we connect to databases without any issues or is it better to export database out of business hours?
Server-side encryption: encryption that occurs after Cloud Storage receives your data, but before the data is written to disk and stored.
Client-side encryption: encryption that occurs before data is sent to Cloud Storage. Such data arrives at Cloud Storage already encrypted but also undergoes server-side encryption.
Details:
Client-side encryption for data to be exported is done using your own tools prior to sending it to Cloud Storage. Data that you encrypt on the client side then arrives at Cloud Storage in an encrypted state, however Cloud Storage has no knowledge of the keys you used to encrypt the data.
When Cloud Storage receives your data, it is encrypted a second time through the server-side encryption, which Cloud Storage manages. When you retrieve your data, Cloud Storage removes the server-side layer of encryption, but you must decrypt the client-side layer yourself.
Do keep in mind that If you use customer-supplied encryption keys or client-side encryption, you must securely manage your keys and ensure that they are not lost. If you lose your keys, you are no longer able to read your data, and you continue to be charged for storage of your objects until you delete them.

AWS: Is it possible to retrieve the content of key that stored in KMS?

If the answer is no, how to deal with the data encryption when migrating your data from aws cloud to another cloud someday?
e.g. S3 object that has been encrypted by SSE-S3
Its not possible. From docs:
By default, AWS KMS creates the key material for a CMK. You cannot extract, export, view, or manage this key material.
The exception is when you import your own keys into KMS. Since you import the key material, you can use the same one in the other provider if it supports importing keys.
When you copy your objects to other storage provider, AWS will transparently decrypt them. The new provider will have to encrypt your data using their own keys.
So basically, the migration involves, decryption of your data, transfer of the data to a new provider, and encryption using a new key.
The only way to transport encrypted data from s3 is if you use SSE-C in S3, which stands for customer-provided encryption. In this case you are fully responsible for encryption and decryption of your files. AWS and the new provider only store the encrypted files:
Using server-side encryption with customer-provided encryption keys (SSE-C) allows you to set your own encryption keys.
Typically, data is not encrypted using the keys stored in a Key Management Service (KMS).
Instead, when a file needs to be encrypted:
A random encryption key is generated that is specific to that file only
The file is encrypted using that key
The key is then encrypted using the keys stored in the KMS and the encrypted key is stored with the encrypted data
Later, when the file needs to be decrypted:
The encrypted key is decrypted using the KMS
The file is decrypted using the decrypted key
Thus, if you wish to move encrypted data to a different system, you merely need to decrypt the file-specific encryption keys using the KMS and re-encrypt them using the new KMS. The encrypted files can then be copied to the new system without needing to be decrypted.
Here's a picture from Server-side encryption with KMS managed keys (SSE-KMS) - AWS Certified Solutions Architect - Associate Guide [Book]:

Why doesn't AWS KMS encrypt/decrypt need data key?

I am reading AWS encrypt cli document from https://docs.aws.amazon.com/cli/latest/reference/kms/encrypt.html and https://docs.aws.amazon.com/cli/latest/reference/kms/decrypt.html. I found that I am able to encrypt/decrypt without creating a data key. When I read https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html, it says that I need to use KMS CMK to generate a data key which is used to encrypt my data.
So I am confused about whether I need a data key at all?
CMK is designed to encrypt/decrypt the data keys. Therefore, there is a limit of 4 KB on the amount of plaintext that can be encrypted in a direct call to the encrypt function. You can easily test this by passing in message larger than 4 KB.
These operations are designed to encrypt and decrypt data keys. They use an AWS KMS customer master key (CMK) in the encryption operations and they cannot accept more than 4 KB (4096 bytes) of data. Although you might use them to encrypt small amounts of data, such as a password or RSA key, they are not designed to encrypt application data.
You are likely using a default CMK that was created by another AWS service that uses KMS encryption.
Of course all encryption and decryption operations require a key. If you did not explicitly create one for your application, then you are using the current default key.
Ensure that KMS Customer Master Keys (CMKs) are used by your AWS services and resources instead of default KMS keys, in order to have full control over data encryption/decryption process and meet compliance requirements. A KMS default master key is used by an AWS service such as RDS, EBS, Lambda, Elastic Transcoder, Redshift, SES, SQS, CloudWatch, EFS, S3 or Workspaces when no other key is defined to encrypt a resource for that service. The default key cannot be modified to ensure its availability, durability and security. On the other side, a KMS Customer Master Key (CMK) provides the ability to create, rotate, disable, enable and audit the encryption key used to protect the data.
See https://www.cloudconformity.com/knowledge-base/aws/KMS/default-key-usage.html