---
title: "Google Cloud Platform Keyring KMS Cloud Native Key Management"
slug: "fortanix-dsm-gcp-kms-cnkms-keyring-setup-user-guide"
updated: 2026-07-24T10:43:00Z
published: 2026-07-24T10:43:00Z
canonical: "support.fortanix.com/fortanix-dsm-gcp-kms-cnkms-keyring-setup-user-guide"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Platform Keyring KMS Cloud Native Key Management

## 1.0 Introduction

This article describes how to perform native key lifecycle management in Google Cloud Platform (GCP) Key Management Service (KMS) using Fortanix-Data-Security-Manager (DSM) Cloud Native Key Management Service (CNKMS).

The Fortanix solution for GCP KMS offers complete CNKMS, as explained in this article, as well as Bring Your Own Key (BYOK), with complete lifecycle management for automation.

## 2.0 Getting Started with Fortanix Cloud Data Control

*To understand which solution between CNKMS, BYOK, or Bring Your Own Encryption (BYOE) is right for you, refer to* [*Fortanix DSM - Cloud Data Control - Getting Started*](/v1/docs/fortanix-dsm-cloud-data-control-getting-started)*.*

## 3.0 Fortanix CNKMS Workflows Overview

- **Generate key**: Navigate to a CDC group, select "**Generate in GCP**", select a supported algorithm type and key size, and click **Generate** to generate the key in the GCP Key Management Service (KMS) key repository.
- **Disable/Enable**: Navigate to the detailed view of the key in the GCP CDC group and disable or enable it from Fortanix DSM.

## 4.0 Fortanix DSM GCP KMS Security Objects

After the GCP CDC group connects to GCP KMS using the provided connection details, the keys from GCP KMS are stored in the Fortanix DSM GCP CDC group as virtual keys. A virtual key is a reference that includes key information and attributes but does not contain the actual key material, which remains securely stored in the key ring of the location and project provided in the GCP KMS.

### 4.1 Create a Key in GCP KMS Group - Generate Key

Perform the following steps to create a key in Fortanix DSM user interface (UI):

1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object.
2. In the **Add New Security Object** form:
  1. Enter a name for the Security Object (Key).
  2. Select the **This is an HSM/external KMS object** check box to filter the groups to show only GCP KMS groups in the **Select group** list.
  3. In the GCP KMS group list, select the GCP CDC group into which the keys will be generated. The keys will be generated into the region that was selected in the GCP KMS group.
  4. Select **GENERATE IN GCP** to initiate the generate key in the GCP KMS workflow.
  5. Enter the required **GCP key name**. This name will be stored in the GCP Key Ring and used to correlate different versions of a key. All versions will share the same GCP key name.
  6. Select the required **GCP protection level** type.
    - **Software**: The key material is managed by Cloud KMS and protected in Google-managed software.
    - **HSM**: The key material is managed by Cloud KMS and protected in FIPS 140-2 Level 3 certified hardware security modules (HSMs).
  7. In the **Choose a type** section, select the key type for the new GCP KMS key.

> [!NOTE]
> NOTE
> 
> - For Fortanix DSM, the allowed key type for a GCP KMS keys generated using the Generate Key workflow in Fortanix DSM are AES 256 and RSA (2048, 3072, and 4096).
> - These key types can further be restricted by setting a cryptographic policy for the account or group. *For more information about the crypto policy, refer to the* [*User's Guide: Group Cryptographic Policy*](/v1/docs/users-guide-group-cryptographic-policy) *and* [*User's Guide: Account Cryptographic Policy*](/v1/docs/users-guide-account-cryptographic-policy)*.*
> - The key types can also be restricted by setting a key metadata policy for the group. *For more information about the Key metadata policy*, *refer to the* [*User's Guide: Group Key Metadata Policy*](/v1/docs/users-guide-key-metadata-policy) *and* [*User's Guide: Account Key Metadata Policy*](/v1/docs/users-guide-account-key-metadata-policy)*.*
> - When generating an RSA key in the GCP-backed group, ensure the following:
>   - If you select **Sign** and **Verify** as key operations in the **Key operations permitted** section, you can select only one of the following **Signature** padding policies in the **Padding policy** section:
>     - **PKCS1v15**, or
>     - **PSS**
>   - If you select **Encrypt** and **Decrypt** as key operations in the **Key operations permitted** section, you can select only **OAEP** as the **Encryption** padding policy in the **Padding policy** section.
>   - RSA keys can be created using either **Sign**/**Verify** or **Encrypt**/**Decrypt** key operations. GCP KMS does not support both key operation sets simultaneously.
  8. Enter the **Key size**.
  9. Select the permitted key operations under the **Key operations** **permitted** section.
  10. Add custom attributes using **ADD ATTRIBUTE**.

> [!NOTE]
> NOTE
> 
> The custom attributes also depend on the Key metadata policy for the group. If the GCP KMS group has a key metadata policy configured with restrictions for custom attributes, then these rules will be applied while creating the security object.
  11. To store audit logs for the object in the group, enable the toggle for **Keep detailed log for the object**. The initial state of the toggle is based on the parent Crypto policy if any.

1. Click **GENERATE** to generate the key in GCP KMS.

The new GCP KMS key is created and represented with a special symbol ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/CDC_Azure_SOs_Active_State - Copy(5).png) to denote it is of type HSM/External KMS. In the detailed view of the GCP key you will notice the following things:

- The group to which it belongs (in the **Group** field). It also shows if the group is mapped to a GCP KMS or not using the special icon ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (1812)(13).png).
- How the key was created (in the **Created by** field). If it is a GCP KMS key, this field shows the group that created this key. It also shows minor details such as if the group is “Connected” or “Not Connected”.
- The new GCP KMS key is in an **Enabled** state by default which means that all the Encrypt and Decrypt operations can be performed on the actual key in the GCP KMS according to the key permissions. Click the toggle for **Enabled** to disable it. This will disable the GCP KMS key temporarily.
- The new key will be added to the Security Objects table.

> [!NOTE]
> TIP
> 
> - You can also access the new key from the Group detailed view from the **SECURITY OBJECTS** tab.
> - You can also add a new key from the Group detailed view from the **SECURITY OBJECTS** tab, click **ADD SECURITY OBJECT**, and follow ***Steps 2-3*** above.

### 4.2 Sync Keys

Perform the following steps to edit the GCP connection details:

1. Go to the GCP group detailed view.
2. Click the **HSM/KMS** tab.
3. Click **SYNC KEYS** to import the new virtual keys.

Fortanix DSM will then connect to GCP, fetch all available keys, and store them as virtual keys.

> [!NOTE]
> NOTE
> 
> - When keys are synced with GCP KMS, the metadata of the existing keys for the configured service account and region are downloaded and represented as virtual keys in Fortanix DSM. The actual key material for those keys is always stored in GCP KMS.
> - Clicking **SYNC KEYS** only returns the keys from GCP KMS that are not present in Fortanix DSM. That is, every click will append only new keys to Fortanix DSM.
> - The time taken to sync keys from the GCP KMS to Fortanix DSM is a function of the number of keys in the GCP KMS and the network latency between the GCP location and Fortanix DSM. It can take several minutes if there are hundreds of keys and there is significant network latency

### 4.3 Attributes/Tags Tab

This tab contains all the attributes and tags of the GCP key. A tag serves as an optional metadata label for a GCP resource. You can add new tags using **NEW TAG** and add custom attributes using **ADD CUSTOM ATTRIBUTE**. These custom attributes are user-defined security object attributes that augment the security object's metadata.

### 4.4 GCP Key Details

This tab displays details of the **GCP key name** and **GCP protection level**. *For more For more information about GCP protection level, refer to the* [*Google documentation*](https://cloud.google.com/kms/docs/reference/rest/v1/ProtectionLevel).

### 4.5 Security Objects Table View

After you add new GCP keys, navigate to the **Security Objects** menu item in the DSM left navigation panel to view all the security objects from all the groups (GCP and non-GCP).

In the table, you will notice that every key belongs to a group and some keys which are virtual keys added from a GCP, belongs to a group with a special symbol ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (1812)(14).png). The table shows all keys, whether they belong to a GCP CDC group or not.

### 4.6 Delete a Key in GCP CDC Group

**DELETE KEY** will be enabled only after the key has been permanently deleted from GCP. When you click **DELETE KEY**, Fortanix DSM will remove the virtual key permanently.

Perform the following steps to delete a virtual key:

1. Select the GCP key that you want to delete.
2. In the detailed view of the security object, scroll down and click **DELETE KEY**.

## 5.0 Rotate a Key in GCP CDC Group

The following section elaborates on key rotation in a GCP CDC group. A key rotation occurs when you aim to retire an encryption key and substitute it by generating a new cryptographic key.

> [!NOTE]
> NOTE
> 
> When performing key rotation in GCP KMS, including normal rotation, linked key rotation, or rotate to DSM key, specifying the Key ring name is no longer required. The rotated key automatically inherits the following details from the previous key version:
> 
> - Key Ring Name
> - GCP Key Name
> - GCP Protection Level

### 5.1 Rotating GCP Native Key* with Another Native Key

**Native key is one where the key material was generated by GCP KMS.*

When you rotate a virtual key in a GCP CDC group, the action will rotate the key inside the GCP KMS by generating another new version of the key within the configured GCP KMS.

Perform the following steps to rotate a key in GCP:

1. Navigate to the **Security Objects** menu item in the DSM left navigation panel to go to the detailed view of a GCP virtual key and click **ROTATE KEY**.
2. In the **KEY ROTATION** window, **Generate new key** is selected by default.
3. Click **ROTATE KEY** to rotate a virtual key.
4. On the next screen, select both check boxes to confirm your understanding about the action. Click **PROCEED**.

A new rotated key is now generated.

### 5.2 Rotating GCP Native Key to Fortanix DSM Owned Keys

When a GCP virtual key whose key material is owned by GCP KMS is rotated, the user is given the option to rotate the virtual key with a Fortanix DSM backed key. When the user selects this option and performs the rotation, a new virtual key is created, with the corresponding key in GCP KMS, which has the key material of the Fortanix DSM-backed key. As a result, the GCP virtual key is backed by a Fortanix DSM source key.

Perform the following steps to rotate a virtual key with Fortanix DSM backed key:

1. Navigate to the **Security Objects** menu item in the DSM left navigation panel to go to the detailed view of a GCP virtual key and click **ROTATE KEY**.
2. In the **Key Rotation** window, **Generate new key** is selected by default.
3. Select the **Rotate to DSM key** check box.
4. Select the Fortanix DSM group that contains the source key and then select the required source key from the respective drop down menu.
5. Click **ROTATE KEY**.
6. On the next screen, select both check boxes to confirm your understanding about the action. Click **PROCEED**.

The virtual key has been rotated and is now backed by the source key. To confirm, go to the detailed view of the newly rotated GCP virtual key and click the **GCP KEY DETAILS** tab. You will notice that the **SOURCE** field now shows **FortanixHSM** instead of *External*.

## 6.0 GCP Key Ring Group Setup and BYOK

*For more information on how to set up a GCP Key Ring group in Fortanix DSM, refer to the* [*Fortanix DSM - Google Cloud Platform Keyring KMS Group Setup*](https://support.fortanix.com/docs/fortanix-data-security-manager-gcp-kms-keyring-setup-user-guide)*.*

*For more information on how to perform BYOK key lifecycle management in GCP Key Ring using Fortanix DSM, refer to the* [*Fortanix DSM - Google Cloud Platform Keyring KMS Bring Your Own Key*](https://support.fortanix.com/docs/users-guide-google-cloud-kms)*.*

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.