Link Search Menu Expand Document

Unencrypted compute disk.

Explanation

By default, Compute Engine encrypts all data at rest. Compute Engine handles and manages this encryption for you without any additional actions on your part.

If the disk_encryption_key block is included in the resource declaration then it must include a raw_key or kms_key_self_link.

To use the default offering of Google managed keys, do not include a disk_encryption_key block at all.

Insecure Example

The following example will fail the GCP001 check.

resource "google_compute_disk" "my-disk" {
	# ... 
	disk_encryption_key {}
	# ...
}

Secure Example

The following example will pass the GCP001 check.

resource "google_compute_disk" "my-disk" {
	disk_encryption_key {
		kms_key_self_link = "something"
	}
}

resource "google_compute_disk" "another-my-disk" {
	disk_encryption_key {
		raw_key = "something"
	}
}