> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Bigtable cluster table encrypted with cmks remediation ### Triage and Remediation ### Remediation To remediate the issue of Bigtable Cluster Tables not being encrypted with Customer Managed Keys in GCP, follow the below steps: 1. Open the Google Cloud Console and navigate to the Bigtable instance that you want to remediate. 2. Click on the "Encryption" tab from the left-hand side menu. 3. Under the "Encryption at rest" section, click on the "Edit" button. 4. Select "Customer-managed key" as the encryption type. 5. Click on the "Select key" button and choose an existing key or create a new one. 6. Click on the "Save" button to apply the changes. 7. Once the encryption type is updated, you need to enable the encryption for each table in the Bigtable cluster. 8. Click on the "Tables" tab from the left-hand side menu and select the table that you want to encrypt. 9. Click on the "Edit" button and select "Customer-managed key" as the encryption type. 10. Click on the "Select key" button and choose the same key that you selected in step 5. 11. Click on the "Save" button to apply the changes. 12. Repeat steps 8-11 for each table in the Bigtable cluster. By following the above steps, you can remediate the issue of Bigtable Cluster Tables not being encrypted with Customer Managed Keys in GCP. # To remediate this misconfiguration, you can follow the below steps: 1. Open the Cloud Shell in your GCP console. 2. Run the following command to check if the Bigtable cluster tables are encrypted with customer-managed keys: ``` gcloud bigtable tables describe [TABLE_ID] --cluster=[CLUSTER_ID] --project=[PROJECT_ID] --instance=[INSTANCE_ID] ``` Replace `[TABLE_ID]`, `[CLUSTER_ID]`, `[PROJECT_ID]`, and `[INSTANCE_ID]` with the actual values. 3. If the output shows that the tables are not encrypted with customer-managed keys, then you need to create a new key ring and key for encryption. Run the following commands to create a new key ring and key: ``` gcloud kms keyrings create [KEYRING_NAME] --location=[LOCATION] --project=[PROJECT_ID] gcloud kms keys create [KEY_NAME] --keyring=[KEYRING_NAME] --location=[LOCATION] --purpose=encryption --project=[PROJECT_ID] ``` Replace `[KEYRING_NAME]`, `[LOCATION]`, `[PROJECT_ID]`, and `[KEY_NAME]` with the actual values. 4. After creating the key ring and key, you need to set the encryption for the Bigtable cluster tables. Run the following command to set the encryption: ``` gcloud bigtable tables set-iam-policy [TABLE_ID] --cluster=[CLUSTER_ID] --project=[PROJECT_ID] --instance=[INSTANCE_ID] --member="serviceAccount:[SERVICE_ACCOUNT_EMAIL]" --role="roles/bigtable.encryptionKeyEncrypterDecrypter" --condition="encryption.encryptionKeyName=[KEY_NAME]" ``` Replace `[TABLE_ID]`, `[CLUSTER_ID]`, `[PROJECT_ID]`, `[INSTANCE_ID]`, `[SERVICE_ACCOUNT_EMAIL]`, and `[KEY_NAME]` with the actual values. 5. Verify that the tables are now encrypted with the customer-managed keys by running the following command again: ``` gcloud bigtable tables describe [TABLE_ID] --cluster=[CLUSTER_ID] --project=[PROJECT_ID] --instance=[INSTANCE_ID] ``` The output should show that the tables are now encrypted with the customer-managed keys. By following these steps, you can remediate the misconfiguration in GCP using GCP CLI. To remediate the misconfiguration "Bigtable Cluster Tables Should Be Encrypted With Customer Managed Keys" in GCP using Python, follow these steps: 1. Open the Cloud Shell in the GCP Console. 2. Install the Google Cloud Bigtable Python client library by running the following command: ``` pip install google-cloud-bigtable ``` 3. Create a new key ring in the Cloud Key Management Service (KMS) by running the following command: ``` gcloud kms keyrings create --location ``` Replace `` with the name of your key ring and `` with the location where you want to store the key ring. 4. Create a new key in the key ring by running the following command: ``` gcloud kms keys create --keyring --location --purpose encryption ``` Replace `` with the name of your key. 5. Enable the Cloud Bigtable API by running the following command: ``` gcloud services enable bigtable.googleapis.com ``` 6. Use the following Python script to update the encryption configuration of your Bigtable cluster tables to use customer-managed keys: ```python theme={null} from google.cloud import bigtable from google.cloud.bigtable import enums from google.cloud.bigtable.admin import v2 # Set the project and instance IDs project_id = 'your-project-id' instance_id = 'your-instance-id' cluster_id = 'your-cluster-id' location_id = 'your-location-id' key_ring_name = 'your-key-ring-name' key_name = 'your-key-name' # Create a Bigtable client client = bigtable.Client(project=project_id) # Create a Bigtable instance admin client instance_admin_client = v2.BigtableInstanceAdminClient() # Get the instance object instance = client.instance(instance_id) # Get the cluster object cluster = instance.cluster(cluster_id) # Create the encryption configuration object encryption_config = v2.EncryptionConfig( kms_key_name=f"projects/{project_id}/locations/{location_id}/keyRings/{key_ring_name}/cryptoKeys/{key_name}", encryption_type=enums.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION ) # Update the cluster with the new encryption configuration operation = instance_admin_client.update_cluster_encryption( request={ "name": cluster.name, "encryption_config": encryption_config } ) # Wait for the operation to complete operation.result() ``` Replace the placeholders with your own project ID, instance ID, cluster ID, location ID, key ring name, and key name. 7. Run the Python script to update the encryption configuration of your Bigtable cluster tables to use customer-managed keys. After completing these steps, your Bigtable cluster tables will be encrypted with customer-managed keys. ```hcl theme={null} resource "google_kms_key_ring" "bigtable_cmek_ring" { name = "BIGTABLE_CMEK_KEY_RING_NAME" # replace with desired key ring name location = "KMS_KEY_LOCATION" # e.g. "us-central1" project = "PROJECT_ID" # replace with your project ID } resource "google_kms_crypto_key" "bigtable_cmek" { name = "BIGTABLE_CMEK_KEY_NAME" # replace with desired key name key_ring = google_kms_key_ring.bigtable_cmek_ring.id rotation_period = "2592000s" # 30 days; adjust as needed purpose = "ENCRYPT_DECRYPT" } resource "google_bigtable_instance" "bigtable" { name = "BIGTABLE_INSTANCE_ID" # replace with your instance ID project = "PROJECT_ID" # replace with your project ID display_name = "BIGTABLE_INSTANCE_DISPLAY_NAME" # human‑readable name instance_type = "PRODUCTION" # or "DEVELOPMENT" # NOTE: Setting kms_key_name on a cluster forces replacement of that cluster. # Existing clusters/tables must be migrated to a new CMEK‑backed instance/cluster. cluster { cluster_id = "BIGTABLE_CLUSTER_ID" # replace with your cluster ID zone = "BIGTABLE_ZONE" # e.g. "us-central1-b" num_nodes = 3 # adjust as needed storage_type = "SSD" kms_key_name = google_kms_crypto_key.bigtable_cmek.id } } resource "google_bigtable_table" "table" { name = "BIGTABLE_TABLE_ID" # replace with your table ID instance_name = google_bigtable_instance.bigtable.name } ``` Bigtable CMEK is configured on the cluster (via `kms_key_name`), not on the table itself; all tables in that cluster are then encrypted with the customer-managed key. Changing `kms_key_name` on an existing cluster forces its replacement, which is effectively a data‑migration event and must be planned carefully. To verify in Terraform, `terraform plan` should show the `google_bigtable_instance` cluster being created with `kms_key_name = google_kms_crypto_key.bigtable_cmek.id` (or the cluster being replaced to add this field), and the table resource continuing to reference that instance.