Using Fortanix Data Security Manager with Google Cloud EKM Interface

New call-to-action

1.0  Introduction

This article describes how to integrate Fortanix Data Security Manager (DSM) with Google Cloud Platform (GCP) services. It also contains the information that a user needs to:

  • Enable the Cloud Key Management Service (KMS) API in your GCP project
  • Obtain GCP service account email address
  • Import the Google Advanced Encryption Standard (AES) Key in Fortanix DSM
  • Complete the GCP setup

Fortanix DSM supports the following customer-managed encryption keys (CMEK) integration services on the Google cloud:

Refer to the Cloud EKM documentation for the complete list.

Why Use Fortanix Data Security Manager With Google Cloud EKM

Google Cloud’s External Key Manager allows services running in the Google Cloud Platform (GCP), namely Big Query and Google Compute Engine (GCE) to use an encryption key managed in an external key management service and controlled entirely by the customer.

To read more about the announcement of Google Cloud External Key Manager (EKM) and the Fortanix DSM integration, read the Google and Fortanix announcement blogs.

Fortanix DSM protects all your data on-premises as well as in the cloud. It provides end-to-end security for keys and data (at-rest, in-transit, and in-use) protected with layers of defense including Fortanix Runtime Encryption®, Intel® SGX and FIPS-validated hardware; Only authorized users can access keys.

2.0  Terminology References

Fortanix Data Security Manager (DSM)

Fortanix DSM is the cloud solution secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as secrets, such as passwords, API keys, tokens, or any blob of data.

GCP - Google Cloud Platform

Google Cloud Platform is a suite of public cloud computing services offered by Google. The platform includes a range of hosted services for compute, storage, and application development that run on Google hardware. Google Cloud Platform services can be accessed by software developers, cloud administrators, and other enterprises IT professionals over the public internet or through a dedicated network connection.

Google KMS - Google Key Management Service

Google Cloud Key Management Service (KMS) is a cloud service for managing encryption keys for other Google cloud services that enterprises can use to implement cryptographic functions. For more information, see Google Cloud Key Management Service.

AES - Advanced Encryption Standard

Google uses the Advanced Encryption Standard (AES) algorithm to encrypt data at rest. AES is widely used because:

  1. Both AES256 and AES128 are recommended by the National Institute of Standards and Technology (NIST) for long-term storage use (as of November 2015).
  2. AES is often included as part of customer compliance requirements. For more information please see Advanced Encryption Standard.

SGX - Software Guard Extensions

Intel’s Software Guard Extensions (SGX) is a set of extensions to the Intel architecture that aims to provide integrity and confidentiality guarantees to security-sensitive computation performed on a computer where all the privileged software (kernel, hypervisor, and so on) is potentially malicious.

FIPS - Federal Information Processing Standards

FIPS is a set of standards that describe document processing, encryption algorithms, and other information technology standards for use within non-military government agencies and by government contractors and vendors who work with the agencies.

3.0  Prerequisites

  • Fortanix Data Security Manager
  • GCP Services
  • Google Cloud Project
  • AES key
The AES key can either be imported or created in Fortanix DSM.

4.0  Using Fortanix Data Security Manager with GCP Service


With Google Cloud Platform (GCP) External Key Manager, administrators use Fortanix DSM to store cryptographic keys for the purpose of encrypting/decrypting GCP workloads including BigQuery and Google Compute Engine (GCE).

While the free trial deployment supports us-west2 region, production deployments of Fortanix DSM support any GCP regions. 

Please keep in mind that is a test instance and not supported for production use. Supported use for production workloads requires engaging Fortanix and Google Cloud. Please email for more information.

Enable KMS API in Your GCP project

See Google documentation for steps on how to enable Google External Key Manager API in your GCP project.

Obtain Your Google Service Account Email Address

Fortanix DSM requires the identity of the GCP service account in your Google cloud project. This is usually an email address of the form:


In the example above, PROJECT-NUMBER is the project number of your Google Cloud Platform project.

You can look up the Service Account email address from the GCP Service Account page.

Obtaining Access in Fortanix Data Security Manager

Create an account in Fortanix DSM if you do not have one already. See the Fortanix DSM Getting Started guide for more information.

Create/Import an AES Key

In your Fortanix DSM console, follow the process below to create/import an AES encryption key:

  1. Click the Security Objects SecurityObjects.png tab (Figure 1).
  2. Click NewSecurity.png to create a new Security Object.


Figure 1: Security Objects tab in Fortanix DSM

In the Add New Security Object form, you can create or import an AES key. See the example below to import an AES key (Figure 2):


Figure 2: Create/Import AES key

  1. Type a name for the Security Object (Key).
  2. Click Import to set the option to import an AES key.
  3. Click AES for the type of key to import.
  4. Select an option for the key-value format.
  5. Click UPLOAD A FILE to upload your AES key.
Make sure the new key has “encrypt” and “decrypt” key operations allowed.

To generate a new AES key, follow the instruction below (Figure 3):


Figure 3: Generate a New AES key

  1. Type a name for the Security Object (Key).
  2. Click Generate to set the option to generate an AES key.
  3. Click AES for the type of key to import.
  4. Type a value for the key size, in the Key size
  5. Select the permitted key operations for this key.
  6. Assign a group for the key.
  7. Select Audit log to enable audit logging. This will inform you about all the audit logging for this security object. it is an optional field.
  8. Click Generate to generate the AES key.
Make sure the new key has “encrypt” and “decrypt” key operations allowed.

Create an App in Fortanix Data Security Manager

To create an application in Fortanix DSM, specify the Google service account email as the application name and the Google Service Account as the authentication method.

  1. In the Fortanix DSM account, click the Applications AppTab.png tab (Figure 4).
  2. Create a new Fortanix DSM app using the button NewSecurity.png (Figure 4).


                         Figure 4: Create New Application

  3. In the Adding new app form (Figure 5 and Figure 6), do the following:
    1. In the App name field, type the name of the service account email you acquired before. 
      The app name must match the email address of an existing Google Service Account.
        GCP_appNameError.png                                                   Figure 5: Name of the Application
    2. In the Authentication method, click Google Service Account
      Ensure that the new application has access to the AES key.
    3. Select the access justification reason for wrapping or unwrapping the key.
      GCP_Access_Justification_default.png                              Figure 6: Access Justification Reason (default selection)
        GCP_Access_Justification_Reason.png                               Figure 7: Access Justification (select reason)
      The user can allow access to wrap/unwarp keys for the following types of access justifications options:
      Selecting the allowed key justification reasons below defines an access policy for the app.
      • Accept All: Select Accept All to allow access for all the justification reasons provided below. You can also customize your selection and select specific justification criteria for access.
        • Customer-initiated support – Support initiated from the customer, for example, Case Number: ####.
        • Customer-initiated access – Customer or a third-party authorized by customer's IAM policy perform any access to the customer's data.
        • Google-initiated service – Google-initiated access, for example, to perform system management and troubleshooting which includes:
          • Backup and recovery from outages and system failures
          • Investigation to confirm that the customer is not affected by suspected service issues
          • Remediation of technical issues, such as storage failure or data corruption
        • Google-initiated review – Google-initiated access for security, fraud, abuse, or compliance purposes including:
          • Ensuring the safety and security of customer accounts and content
          • Confirming whether the content is affected by an event that may impact account security (for example, malware infections)
          • Confirming whether the customer is using Google services in compliance with Google Terms of Service
          • Investigating complaints by other users and customers, or other signals of abusive activity
          • Checking that Google services are being used consistently with relevant compliance regimes (for example, anti-money laundering regulations)
        • Google-initiated system operation – Google-initiated access for security, fraud, abuse, or compliance purposes.
        • Third-party data request – Customer-initiated access by Google to respond to a legal request or legal process, including when responding to legal process from the customer that requires Google to access the customer's own content. Note that Access Transparency logs, in this case, may not be available if Google cannot legally inform the customer of such a request or process.
        • Unspecified reason – Indicates the actor accessing the data provided no access reason for the request. This may have been due to a transient error, a bug, or some other unexpected circumstance.
        • No justification reason expected – Indicates no reason is expected for this key request as the service in question has never integrated with Key Access Justification or is still in the pre-GA state and therefore may still have residual methods that call the External Key Manager but does not provide a justification.
        • Modified customer-initiated access – A customer uses their account to perform any access which is authorized by their own IAM policy; however, a Google administrator has reset the superuser account associated with the user’s organization within the last 7 days.
      • Allow missing justification: Select this option to allow access even if a justification reason is not provided.
    4.  Assign the new application to a group or create a new group if there are no existing groups already.
      GCP_AssigntoGroup.png                                                           Figure 8: Assign to group
    5. Click Save to create the new application.

Add Authentication Method for an Existing App

You can also change the authentication method for an existing app to Google Service Account from the detailed view of an app.

  1. In the detailed view of an app, click the INFO tab and in the API Key section click the Change authentication method drop-down menu.
    GCP4.png                                                Figure 9: Change the authentication method
  2. Select Google Service Account and click SAVE to save the setting.
    GCP_ChangeAuth.png                                                Figure 10: Change authentication method
  3. In the CONFIGURE AUTHENTICATION METHOD window, select the key justification reasons, and click UPDATE.
    The app name must match the email address of an existing Google Service Account.
      GCP_ChangeAuthUpdate.png                                                         Figure 11: Select key justification reason
  4. The application is updated with the new authentication method.
    GCP7.png                                            Figure 12: Authentication method updated

Edit Key Justification Reason for an Existing App

You also have an option to edit the key justification reason for an existing app.

  1. In the detailed view of an app, click the INFO tab and in the Google Service Account section, click the SHOW INSTRUCTIONS button.
    GCP8.png                                         Figure 13: Edit existing key justification reason
  2. In the GOOGLE SERVICE ACCOUNT window, click the EDIT button.
    GCP9.png                                           Figure 14: Edit existing key justification reason
  3. Edit the allowed justification reason and click SAVE AND CLOSE to save the new updates.
    GCP_UpdateAuth.png                                                    Figure 15: Edit key justification reason

Enable GCP Service to Access AES Key in Fortanix Data Security Manager

GCP services would need to know a URL that allows the service to access a key stored in Fortanix DSM. This is known as the external_key_uri .

1.  Replace <key_id > in the below URL with the UUID of the AES key to obtain the external_key_uri:<key_id >

2.  To obtain the UUID of the AES key, click the Security Objects SecurityObjects.png  tab, and then click the new AES key which you created/imported.


Figure 16: Security Objects page

3. In the AES key detailed view, copy the UUID of the AES Key using the Copy Copy.png icon.


Figure 17: AES Key UUID

4. Replace the <Key_id > with the UUID in the below URL, for example:

5. Use the resource URL above to complete the GCP setup.

5.0  References

1. Google Cloud Key Management Service

2. GCP Key Manager Service API

3. Fortanix DSM Getting started 

4. Advanced Encryption Standard

5. Enable Billing in GCP

New call-to-action


Please sign in to leave a comment.

Was this article helpful?
0 out of 0 found this helpful