BigQuery table uses a customer-managed key

Check ID: bigquery_table_cmk_encryption
Provider: GCP
Service: bigquery
Severity: HIGH
Categories: encryption
Resource type: bigquery.googleapis.com/Table

What this check verifies

BigQuery tables use customer-managed encryption keys (CMEK) for at-rest encryption. The evaluation identifies tables lacking a configured Cloud KMS key, indicating use of default Google-managed encryption instead.

Risk

Without CMEK, encryption keys are not under your control, reducing key custody and auditability. You can’t enforce region-bound keys, custom rotation, or revoke access by disabling a key, weakening confidentiality and compliance. A compromised account may retain data access without an external KMS gate.

Recommendation

Protect BigQuery tables with Cloud KMS CMEK to retain key ownership and control.

Set dataset/project default keys
Match key location to dataset region
Enforce least-privilege on KMS and monitor usage
Rotate keys and define revocation procedures
Apply org policies to require CMEK and restrict permissible key projects

Remediation

CLI
Terraform
Dashboard steps

bq cp -f —destination_kms_key projects/<KMS_PROJECT_ID>/locations/<LOCATION>/keyRings/<KEY_RING>/cryptoKeys/<KEY> <DATASET_ID>.<TABLE_ID> <DATASET_ID>.<TABLE_ID>

resource "google_bigquery_table" "<example_resource_name>" {
  dataset_id = "<DATASET_ID>"
  table_id   = "<TABLE_ID>"

  schema = jsonencode([
    { name = "id", type = "INT64", mode = "NULLABLE" }
  ])

  # Critical: enforce CMEK on the table using the specified KMS key
  encryption_configuration {
    kms_key_name = "projects/<KMS_PROJECT_ID>/locations/<LOCATION>/keyRings/<KEY_RING>/cryptoKeys/<KEY>"  # Enables CMK encryption
  }
}

In Google Cloud Console, go to BigQuery and open the Query editor

Run:

ALTER TABLE <DATASET_ID>.<TABLE_ID>
SET OPTIONS (kms_key_name = 'projects/<KMS_PROJECT_ID>/locations/<LOCATION>/keyRings/<KEY_RING>/cryptoKeys/<KEY>');

Click Run
Open the table Details and verify Customer-managed key shows the specified key

References

https://cloud.google.com/bigquery/docs/customer-managed-encryption

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = bigquery_table_cmk_encryption. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

BigQuery dataset is not publicly accessible Cloud SQL database instance has automated backups configured

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires