Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AWN-194636 #92

Merged
merged 2 commits into from
Apr 4, 2023
Merged

AWN-194636 #92

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9c6ae74
added dataflow folder and guide?
laiba-zaman Mar 31, 2023
80f7777
Update dataflow-jobs-encryption.md
laiba-zaman Mar 31, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions en/google/dataflow/dataflow-jobs-encryption.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
[![CloudSploit](https://cloudsploit.com/img/logo-new-big-text-100.png "CloudSploit")](https://cloudsploit.com)

# GOOGLE / Dataflow / Dataflow Jobs Encryption

## Quick Info

| | |
|-|-|
| **Plugin Title** | Dataflow Jobs Encryption |
| **Cloud** | GOOGLE |
| **Category** | Datflow |
| **Description** | Ensure that Google Dataflow jobs are encrypted with desired encryption level. |
| **More Info** | Google encrypts all jobs in Dataflow by default. Protecting source and sinks data for Dataflow batch pipeline with CMEK gives user more granular access to encryption and decryption process.|
| **GOOGLE Link** | https://cloud.google.com/dataflow/docs/guides/customer-managed-encryption-keys |
| **Recommended Action** | Use desired encryption level to encrypt Dataflow jobs. |

## Detailed Remediation Steps
1. Open the Dataflow monitoring UI.\
[Go to the Dataflow Web UI](https://console.cloud.google.com/dataflow)
2. Select Create job from template.
3. In the Encryption section, select Customer-managed key.

Note: The drop-down menu Select a customer-managed key only shows keys with the regional scope global or the region you selected in the Regional endpoint drop-down menu. In order to minimize Cloud KMS operation latency and improve system availability, we recommend choosing regional keys.

The first time you attempt to run a job with a particular Cloud KMS key, your Compute Engine service account and/or Dataflow service account might not have been granted the permissions to encrypt and decrypt using that key. In this case, a warning message appears to prompt you to grant the permission to your service account.