Check ID: dataproc_encrypted_with_cmks_disabled
Provider: GCP
Service: dataproc
Severity: MEDIUM
Categories: encryption
Resource type: dataproc.googleapis.com/Cluster

​
What this check verifies

Dataproc clusters use Customer-Managed Encryption Keys (CMEK) for VM persistent disk encryption. The finding determines whether a customer KMS key is configured for disk data instead of the default Google-managed keys.

​
Risk

Without CMEK on Dataproc disks, keys remain provider-controlled, limiting rotation, revocation, and location control. This reduces containment if disks or snapshots are exposed and may block data sovereignty requirements, impacting confidentiality and incident response.

​
Recommendation

Enable CMEK for Dataproc disk, job-argument, and staging-bucket encryption.
  • Grant KMS access with least privilege to required service accounts
  • Enforce regular rotation and support revocation/disable procedures
  • Keep keys co-located with data and monitor KMS usage
  • Consider Cloud EKM for external key control

​
Remediation

resource "google_dataproc_cluster" "<example_resource_name>" {
  name   = "<example_resource_name>"
  region = "<example_region>"

  cluster_config {
    encryption_config {
      gce_pd_kms_key_name = "projects/<example_project_id>/locations/<example_region>/keyRings/<example_keyring_name>/cryptoKeys/<example_key_name>" # FIX: Sets CMEK for persistent disks to pass the check
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = dataproc_encrypted_with_cmks_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks