> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Bigtable cluster backup encrypted with cmks remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "Bigtable Cluster Backups Should Be Encrypted With Customer Managed Keys" for GCP using GCP console, follow these steps: 1. Open the Google Cloud Console and select the project where your Bigtable cluster is located. 2. Go to the Cloud Bigtable section of the console and select your Bigtable instance. 3. Click on the "Backups" tab and select the backup that you want to encrypt with a customer-managed key. 4. Click on the "Edit" button next to the backup. 5. In the "Encryption" section, select "Customer-managed key" from the drop-down menu. 6. Click on the "Select a key" button and choose the customer-managed key that you want to use to encrypt the backup. 7. Click on the "Save" button to save the changes. 8. Repeat steps 3-7 for all the backups associated with your Bigtable cluster. By following these steps, you will remediate the misconfiguration by encrypting your Bigtable cluster backups with customer-managed keys. # To remediate the misconfiguration of Bigtable Cluster Backups not being encrypted with customer-managed keys, you can follow the below steps using GCP CLI: 1. Create a new key ring: ``` gcloud kms keyrings create [KEYRING_NAME] --location=[LOCATION] ``` Replace `[KEYRING_NAME]` with the name of the key ring you want to create and `[LOCATION]` with the location where you want to create the key ring. 2. Create a new key: ``` gcloud kms keys create [KEY_NAME] --keyring=[KEYRING_NAME] --location=[LOCATION] --purpose=encryption ``` Replace `[KEY_NAME]` with the name of the key you want to create and `[KEYRING_NAME]` and `[LOCATION]` with the name of the key ring and location where you created the key ring in step 1. 3. Grant the Cloud Key Management Service (KMS) service account permission to access the key: ``` gcloud kms keys add-iam-policy-binding [KEY_NAME] --keyring=[KEYRING_NAME] --location=[LOCATION] --member=serviceAccount:cloudkms@[PROJECT_ID].iam.gserviceaccount.com --role=roles/cloudkms.cryptoKeyEncrypterDecrypter ``` Replace `[KEY_NAME]`, `[KEYRING_NAME]`, `[LOCATION]`, and `[PROJECT_ID]` with the name of the key, key ring, location, and project ID where you created the key ring. 4. Enable encryption for Bigtable backups: ``` gcloud beta bigtable clusters update [CLUSTER_ID] --backup-encryption-key=[KEY_NAME] --backup-encryption-key-version=1 ``` Replace `[CLUSTER_ID]` with the ID of the Bigtable cluster you want to update, `[KEY_NAME]` with the name of the key you created in step 2, and `1` with the version number of the key. After following these steps, all new backups for the Bigtable cluster will be encrypted with the customer-managed key. To remediate the misconfiguration of Bigtable Cluster Backups Should Be Encrypted With Customer Managed Keys in GCP, you can follow the below steps using Python: 1. First, create a customer-managed encryption key (CMEK) in the Cloud Key Management Service (KMS) using the following code: ```python theme={null} from google.cloud import kms_v1 from google.cloud.kms_v1 import enums def create_key(project_id, location_id, key_ring_id, key_id): client = kms_v1.KeyManagementServiceClient() parent = client.key_ring_path(project_id, location_id, key_ring_id) purpose = enums.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT algorithm = enums.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION crypto_key = { 'purpose': purpose, 'version_template': { 'algorithm': algorithm } } response = client.create_crypto_key(parent, key_id, crypto_key) print('Created key: {}'.format(response.name)) ``` 2. Next, enable encryption for your Bigtable cluster backups using the CMEK you just created: ```python theme={null} from google.cloud import bigtable_admin_v2 from google.cloud.bigtable_admin_v2 import enums def enable_backup_encryption(project_id, instance_id, cluster_id, key_name): client = bigtable_admin_v2.BigtableTableAdminClient() cluster_name = client.cluster_path(project_id, instance_id, cluster_id) encryption_config = { 'encryption_type': enums.EncryptionInfo.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION, 'encryption_info': { 'kms_key_name': key_name } } cluster = client.get_cluster(cluster_name) cluster.encryption_config = encryption_config update_mask = { 'paths': [ 'encryption_config' ] } client.update_cluster(cluster, update_mask) ``` 3. Finally, verify that encryption is enabled for your Bigtable cluster backups: ```python theme={null} from google.cloud.bigtable import Client def verify_encryption_enabled(project_id, instance_id, cluster_id): client = Client(project=project_id, admin=True) cluster = client.instance(instance_id).cluster(cluster_id) if cluster.encryption_config.encryption_type == enums.EncryptionInfo.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION: print('Encryption is enabled for cluster backups.') else: print('Encryption is not enabled for cluster backups.') ``` Note: Make sure to replace `project_id`, `location_id`, `key_ring_id`, `key_id`, `instance_id`, `cluster_id`, and `key_name` with your own values. By following these steps, you can remediate the misconfiguration of Bigtable Cluster Backups Should Be Encrypted With Customer Managed Keys in GCP using Python. ```hcl theme={null} # Customer-managed Cloud KMS key used to encrypt Bigtable backups resource "google_kms_crypto_key" "bigtable_backup_cmek" { name = "BIGTABLE_BACKUP_CMEK_NAME" # e.g. "bigtable-backup-cmek" key_ring = "PROJECTS/PROJECT_ID/LOCATIONS/LOCATION/KEYRINGS/KEY_RING_NAME" rotation_period = "2592000s" # 30 days; adjust as needed } # Allow Bigtable service account to use the CMK for encryption/decryption # Replace PROJECT_NUMBER with your numeric project ID resource "google_kms_crypto_key_iam_member" "bigtable_backup_cmek_user" { crypto_key_id = google_kms_crypto_key.bigtable_backup_cmek.id role = "roles/cloudkms.cryptoKeyEncrypterDecrypter" member = "serviceAccount:service-PROJECT_NUMBER@gcp-sa-bigtable.iam.gserviceaccount.com" } # Bigtable backup encrypted with the CMK resource "google_bigtable_backup" "backup" { name = "BIGTABLE_BACKUP_NAME" # substitute your backup name instance_name = "BIGTABLE_INSTANCE_NAME" # e.g. "my-instance" cluster = "BIGTABLE_CLUSTER_NAME" # e.g. "my-cluster" table = "BIGTABLE_TABLE_NAME" # e.g. "my-table" expire_time = "YYYY-MM-DDThh:mm:ssZ" # RFC3339; set per your retention # CMEK for the backup kms_key_name = google_kms_crypto_key.bigtable_backup_cmek.id } ``` Changing `kms_key_name` on an existing `google_bigtable_backup` forces replacement of the backup; existing backup data will not be re-encrypted in place and the original backup will be destroyed when Terraform applies the replacement. To verify, `terraform plan` should show each affected `google_bigtable_backup` gaining `kms_key_name = (known after apply)` and that this change requires replacement for backups that previously had no CMEK configured.