GCP Key Management

[bewalker]

Is there one “root keystore master key” per keystore or per cloud tenant or one for all GCP Cloud customers?

https://cloud.google.com/docs/security/encryption/default-encryption#key_management

[lawrencenelson]

Hi @bewalker,

Welcome to the Google Cloud Community!

It is not explicitly stated in the official documentation if the "Root Keystore Master Key" is specific per Keystore, per cloud tenant, or one for all customers so as to protect Google's security structure.

It is only indicated the the "Root Keystore Master Key" is stored in a peer-to-peer infrastructure called "Root Keystore Master Key distributor" and that one instance of the Root Keystore Master Key Distributor runs for every instance of Root Keystore.

I hope this helps. Thank you.