We will assume you have a default project where you are a project owner and billing is enabled called PROJECT_ID. We will demonstrate another best practice of separation of concerns (SoC) by setting up everything using the user jen-admin in PROJECT_ID, but delegating the encryption/decryption operations to a service account operating in a separate EXTERNAL_PROJECT_ID. Learn more about How to Encrypt Google Cloud Storage with CSEK