MEDIUMCIS 5.3

Ensure GCS bucket encryption uses CMEK

Buckets should be encrypted with customer-managed encryption keys for key control.

Security Impact

Google-managed keys don't provide control over key lifecycle or access.

How to Remediate

Create a Cloud KMS key and configure bucket default encryption to use it.

Affected Resources

storage.googleapis.com/Bucketcloudkms.googleapis.com/CryptoKey

Compliance Frameworks

CIS GCP v1.3.0SOC 2PCI-DSSHIPAA

How TigerGate Helps

TigerGate continuously monitors your GCP environment to detect and alert on this misconfiguration. Here's what our platform does for this specific check:

  • Continuous Scanning

    Automatically scans all Google Cloud Storage resources across your GCP projects every hour

  • Instant Alerts

    Get notified via Slack, email, or webhooks when this misconfiguration is detected

  • One-Click Remediation

    Fix this issue directly from the TigerGate dashboard with our guided remediation

  • Compliance Evidence

    Automatically collect audit evidence for CIS GCP v1.3.0, SOC 2, PCI-DSS compliance

  • Drift Detection

    Get alerted if this configuration drifts back to an insecure state after remediation

Check Details

Check ID
gcp-storage-3
Service
Google Cloud Storage
Category
Encryption
Severity
MEDIUM
CIS Benchmark
5.3

Automate This Check

TigerGate automatically scans your GCP environment for this and 79+ other security checks.

Start Free Trial

Related Google Cloud Storage Checks

View all checks
gcp-storage-1critical

Ensure GCS buckets are not publicly accessible

gcp-storage-2medium

Ensure uniform bucket-level access is enabled

gcp-storage-4medium

Ensure GCS bucket logging is enabled

gcp-storage-5medium

Ensure GCS bucket versioning is enabled

gcp-storage-6low

Ensure GCS bucket lifecycle policies are configured