Cloud Monitoring encrypts all data at rest by using Google Cloud-powered encryption keys, and understanding where customer metadata is stored helps you prevent sensitive data exposure and meet data-security compliance requirements. Because Monitoring doesn't support customer-managed encryption keys (CMEK), this document explains where sensitive data can enter your metrics and configurations, and how to obscure or audit that data.
Encryption of data at rest
All data at rest within Cloud Monitoring is encrypted using Google Cloud-powered encryption keys. Cloud Monitoring doesn't support the use of customer-managed encryption keys (CMEK) for protecting your data at rest. By default, Monitoring doesn't store sensitive data and isn't intended to be used for Personally Identifiable Information (PII) or other private customer content.
However, there are places in Monitoring at which you can inadvertently insert sensitive customer data. Because Cloud Monitoring stores metadata and resource labels, customer data can make its way into Monitoring when you name configurations or perform metadata actions like labeling a resource, annotating an instance, or storing custom resources by using custom resource definitions (CRDs) in Google Kubernetes Engine.