Check ID: compute_instance_encryption_with_csek_enabled
Provider: GCP
Service: compute
Severity: HIGH
Categories: encryption
Resource type: compute.googleapis.com/Instance

​
What this check verifies

Compute Engine VM disks use Customer-Supplied Encryption Keys (CSEK) rather than provider-managed keys. The finding flags instances where any attached disk is not protected with the customer-provided key.

​
Risk

Without CSEK, encryption depends on provider-managed keys, reducing control over key lifecycle and access. This weakens confidentiality, impedes separation of duties, and can delay key revocation, increasing exposure to unauthorized data access and regulatory gaps.

​
Recommendation

Use CSEK for VM disks that require full control over data-at-rest keys. Apply least privilege to key custodians, store keys in hardened vaults/HSMs, enforce rotation and rapid revocation, and document recovery procedures. Combine with defense in depth (network and IAM controls) to limit blast radius.

​
Remediation

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-medium"
  zone         = "<example_zone>"

  boot_disk {
    initialize_params { image = "debian-cloud/debian-12" }
    # Critical: enables Customer-Supplied Encryption Key (CSEK) for the boot disk
    disk_encryption_key { raw_key = "<BASE64_32BYTE_KEY>" }  # base64-encoded AES-256 key
  }

  network_interface { network = "default" }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_encryption_with_csek_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks