BigQuery dataset uses a customer-managed key

Check ID: bigquery_dataset_cmk_encryption
Provider: GCP
Service: bigquery
Severity: HIGH
Categories: encryption
Resource type: bigquery.googleapis.com/Dataset

What this check verifies

BigQuery datasets use Customer-Managed Encryption Keys (CMEK) rather than Google-managed encryption. The evaluation identifies datasets configured to use a customer-managed key for data-at-rest protection.

Risk

Without CMEK, organizations lose cryptographic control of data at rest, weakening confidentiality and access governance. Lack of custom key rotation, revocation (kill switch), and location control hinders incident response and may conflict with data-sovereignty requirements.

Recommendation

Protect datasets with CMEK via Cloud KMS:

Set a dataset or project default key
Align key location with dataset region
Enforce least privilege and separation of duties on key usage
Rotate keys and define revocation procedures
Audit key usage and use org policies to require CMEK

Remediation

CLI
Terraform
Dashboard steps

bq update —default_kms_key projects/<KMS_PROJECT_ID>/locations/<LOCATION>/keyRings/<KEY_RING>/cryptoKeys/<KEY_NAME> —dataset <DATASET_ID>

resource "google_bigquery_dataset" "<example_resource_name>" {
  dataset_id = "<example_resource_id>"
  location   = "<LOCATION>"

  # Critical: apply CMEK at the dataset level so the check passes
  default_encryption_configuration {
    kms_key_name = "projects/<KMS_PROJECT_ID>/locations/<LOCATION>/keyRings/<KEY_RING>/cryptoKeys/<KEY_NAME>" # Critical: sets CMEK
  }
}

References

https://cloud.google.com/bigquery/docs/customer-managed-encryption

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = bigquery_dataset_cmk_encryption. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Project has the Container Analysis API enabled BigQuery dataset is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires