Securing cloud storage files with KMS
Tags: gcp, googlecloud, beginners, tutorial
Published: 2020-07-05 02:25:09


Cloud Key Management Service (KMS) allows us to create, import & manage cryptographic keys and also perform cryptographic operations in a single centralized cloud service the same way on-premises. By using [Cloud KMS](https://cloud.google.com/kms), [Cloud HSM](https://cloud.google.com/hsm), or [Cloud External Key Manager](https://cloud.google.com/kms/docs/ekm) or [Customer-Managed Encryption Keys](https://cloud.google.com/storage/docs/encryption/customer-managed-keys) (CMEK integrations)  we can encrypt, decrypt, and verify.

In this post, we are going to deal with [Cloud KMS](https://cloud.google.com/kms), [Cloud Storage](https://cloud.google.com/storage), [Cloud SDK](https://cloud.google.com/sdk). Also, learn about encryption and manage encryption keys using KMS. So, let’s a drive-in. Sign-in to Google Cloud Platform [(GCP) Console](https://console.cloud.google.com/) and Create a new project and activate our Cloud Shell.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/2i21w0xzae8wcwml1lgy.png)

Click `Continue`

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/9np4zdtt0e7dj5hlqcbf.png)
 
## Create a Cloud Storage Bucket

Create Cloud Storage Bucket, we can do that using [gsutil](https://cloud.google.com/storage/docs/gsutil), remember bucket names are globally unique. Run the following command in Cloud Shell to set a variable to our bucket name:

```bash
export CLOUD_STORAGE_BUCKET_NAME=put_our_unique_bucket_name
```

Now, just hit the following command, to create a new cloud storage bucket,

```bash
gsutil mb gs://${CLOUD_STORAGE_BUCKET_NAME}
```

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/cdj1yx5cvmts0h5l3ppa.jpg)


## Create a sample data

Create a simple file so that we can encrypt & decrypt that file, Open Cloud Shell and create a new file, Here, I’m using `Vim` console-based text editor. If we want, we can download the source file from another location. To create a new file, run the following command:

```bash
vi hello.txt
```

Input: to insert content press `i`,

```
Hello! From Cloud Storage KMS. We are going to encrypt and decrypt this file using Cloud KMS.
```

**Note:** To save that `hello.txt` file press `Ctrl+c` and type `:wq` . To read that file content hit below commands,

```bash
cat hello.txt
```

**Output:**

```bash
Hello! From Cloud Storage KMS. We are going to encrypt and decrypt this file using Cloud KMS.
```


## Enable Cloud KMS Service

Before using Cloud KMS, we must need to enable that service. It could be done from [Cloud Console UI](https://console.cloud.google.com/apis/api/cloudkms.googleapis.com) and another is from gcloud CLI command. To enable the Cloud KMS Service, run the following command in our Cloud Shell:

```bash
gcloud services enable cloudkms.googleapis.com
```

Optional, this only needs to be done once per project

```bash
gcloud services enable cloudkms.googleapis.com \
    --project "${GOOGLE_CLOUD_PROJECT}"
```

## Create KeyRing and CryptoKey

In order to encrypt & decrypt data, we need to create a KeyRing and a CryptoKey. KeyRings are useful for Grouping keys. To create KeyRing for a global region:

```bash
gcloud kms keyrings create "our-keyring" --location "global"
```

Note: If we want to view that newly created key then [Open Web UI](https://console.cloud.google.com/iam-admin/kms). 

Next, using the new KeyRing, create a CryptoKey

```bash
gcloud kms keys create "our-cryptokey" \
    --location "global" \
    --keyring "our-keyring" \
    --purpose "encryption"
```

From Web UI We can view that Keys,

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/21kpbihku3xsvlxg74by.jpg)


Click on `our-keyring` then we are able to see `our-cryptokey`, which is group together


![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/t1j2wckwvj5vvq7qz34f.jpg)


## Encrypt our file

Encrypt the `hello.txt` file contents using Cloud KMS. Here, I’m using the gcloud command-line tool. But we can also encrypt data using the [Cloud KMS API](https://cloud.google.com/kms/docs/reference/rest/).

```bash
gcloud kms encrypt --location "global" \
    --keyring "our-keyring" --key "our-cryptokey" \
    --plaintext-file ./hello.txt \
    --ciphertext-file ./hello.enc
```

This will create a `hello.enc` file which will be encrypted. To open that encrypt file run:

```bash
cat hello.enc
```

**Output:** Cloud be like an unreadable hash like “6B!h>X7^RR*IRt;_*b~0IrP1<)]'ǞЉt c”

Now, we can upload that encrypted file to the Cloud Storage, run the following command

```bash
gsutil cp ./hello.enc gs://${CLOUD_STORAGE_BUCKET_NAME}
```

We can view our encrypted file which actually uploaded,

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/zbkklklcfjunxsnbl6hm.jpg)

## Decrypt our file

If we want to decrypt that `hello.enc`. Or, we have already encrypted data then we can copy that from Cloud Storage bucket by the following command,

```bash
gsutil cp gs://${CLOUD_STORAGE_BUCKET_NAME}/hello.enc . 
```

Note: In this case, we don’t have to do that because we already have our `hello.enc` file.

Now, We can decrypt that file by the following command below,

```bash
gcloud kms decrypt --location "global" \
    --keyring "our-keyring" --key "our-cryptokey" \
    --ciphertext-file ./hello.enc \
    --plaintext-file ./hello-decryped.txt
```

To open that `hello-decryped.txt` file run following command

```bash
cat hello-decryped.txt
```

**Output:**

```bash
Hello! From Cloud Storage KMS. We are going to encrypt and decrypt this file using Cloud KMS.
```

## Cleanup environment

To delete cloud storage bucket, which we created earlier, run the following command

```bash
gsutil rm -r gs://${CLOUD_STORAGE_BUCKET_NAME}
```

Note: Cloud KMS resources can’t be deleted. However, we can destroy that by the following command

```bash
gcloud kms keys versions destroy "1" \
    --location "global" \
    --key "our-cryptokey" \
    --keyring "our-keyring"
```
 
## Congratulations

We have successfully encrypted and decrypt data using Cloud KMS and stored encrypted data in Cloud Storage. Thanks for time & passion. Feel free to ask me anything.


Say Hi to me on [Twitter](https://twitter.com/eng_sadhan), [Linkedin](https://www.linkedin.com/in/csesadhan/), and [Medium](https://medium.com/@csesadhan) where I keep on sharing interesting updates.


[Original Post](https://medium.com/@csesadhan/securing-cloud-storage-files-with-kms-73d48403cbd5)