Skip to main content
Checks that GCP KMS encryption keys are rotated within 90 days.

​
About

When you connect Google Cloud Platform (GCP) to DSALTA, the platform retrieves the list of resources in your environment using read-only API access. DSALTA then checks whether this configuration is in place. If it is not, DSALTA activates this check so you can remediate it.

​
Why This Matters

Data stored without encryption can be read by anyone who gains access to the underlying storage — through a misconfiguration, a stolen disk, or improper decommissioning. Encryption at rest renders that data useless without the key and is required by SOC 2, ISO 27001, HIPAA, and PCI DSS.

​
How to Fix

Before you begin
  • Ensure you have the appropriate admin role on the GCP project and access to Cloud KMS.
Encrypt with a customer-managed key (CMEK)
  1. Sign in to the Google Cloud Console and open the relevant service.
  2. For Cloud SQL / Storage / BigQuery / Spanner / Bigtable, open the resource settings and choose Customer-managed encryption key (CMEK).
  3. Select or create a key in Cloud KMS in the same region as the resource.
  4. Apply and save. (Google-managed encryption is on by default; CMEK gives you key control.)
Once encryption is configured, DSALTA retrieves the change on the next sync and sets the check status to Passing.

​
Frequently Asked Questions

This check runs automatically every 24 hours while the Google Cloud Platform (GCP) integration is connected. You can also trigger a manual sync from Integrations in the sidebar.
A failing check appears in your Data Library → Tests dashboard. Work through the steps above; once the underlying configuration is fixed, the status updates automatically on the next sync.
Yes. If it does not apply to your environment, mark it as Not Applicable with a justification. The exclusion is documented for auditors.
No. DSALTA uses read-only API access and never modifies, creates, or deletes resources. All remediation is performed by your team directly in Google Cloud Platform (GCP).