Skip to main content
To enhance the security of your Infisical projects, you can now encrypt your secrets using an external Key Management Service (KMS). When external KMS is configured for your project, all encryption and decryption operations will be handled by the chosen KMS. This guide will walk you through the steps needed to configure external KMS support with Google Cloud KMS.

​
Prerequisites

Before you begin, you’ll first need to set up a GCP Service Account, add a KMS key and set the required permissions.
1

Create a GCP Service Account

  1. Navigate to the Create Service Account page in your GCP Console. GCP Service Account Creation
  2. Give the service account a suitable name and description. Then click Create and Continue.
  3. Under Grant this service account access to project, click Select a role and select the Cloud KMS Viewer and Cloud KMS CryptoKey Encrypter/Decrypter* roles, then click Continue. GCP Service Account Permissions
  4. You can skip the Grant users access to this service account options.
  5. Click Done.
  6. You should see the service account in the list of service accounts. Click it to view the service account details.
  7. Select the Keys tab, click Add Key, select Create new key, select JSON as the key type, then click Create.
  8. You’ll be prompted to download a JSON file that we will need later on.
Remember to keep the JSON file in a secure location. It will be used to authenticate your GCP service account.Once you have successfully set up GCP KMS with Infisical, you should permanently delete the JSON file.
2

Add a GCP KMS Key

  1. Navigate to the KMS page in your GCP Console.
If you haven’t used GCP KMS before, you’ll be redirected to the Cloud Key Management Service (KMS) API page.Click Enable to enable the KMS API, then continue the steps below.It may take a few minutes for the API to be enabled and KMS section of the Cloud Console to become viewable.
  1. In the KMS section, click Create Key Ring. GCP Create Key Ring
  2. Give the key ring a Name and select a Region, then click Create.
We don’t currently support multi-region key rings.
  1. On the “Create Key” page, give the key a Name and set the Protection Level based on your requirements (or use default Software), then click Continue.
  2. Under Key Material, select Generated Key, then click Continue.
  3. Under Purpose, select Symmetric encrypt/decrypt, then click Continue.
  4. For Key Rotation Period, select Never (manual rotation), then click Continue followed by Create.
  5. You should see the key in the list of keys. We’re now ready to set it up in Infisical.

​
Setup GCP KMS in the organization settings

Next, you’ll need to follow the steps listed below to add GCP KMS for your organization.
1

Open the Encryption settings

Go to Settings, select Encryption, then select Add KMS.Open encryption org settings
2

Select GCP KMS

Select Encryption ProviderChoose GCP KMS from the list of encryption providers.
3

Provide the inputs for GCP KMS

GCP Create KMS ModalSelecting GCP as the provider will require you input the following fields.
​
string
required
Name for referencing the GCP KMS key within the organization.
​
string
Short description of the GCP KMS key.
​
dropdown
required
The GCP region where the GCP KMS key ring is located.
​
file
required
Upload the JSON file you downloaded earlier when creating the GCP service account.
​
dropdown
required
This field will be populated with the list of GCP KMS keys in the selected region. Select the key you created earlier.
4

Save the configuration

Select Save to apply the settings.
You now have a GCP KMS Key configured at the organization level. You can assign these GCP KMS keys to existing Infisical projects from the project’s Settings page.

​
Assign GCP KMS key to an existing project

To assign the GCP KMS key you added to your organization, follow the steps below.
1

Open the project's Encryption settings

Open the project, go to Settings, and select Encryption.Open encryption project settings
2

Select the key under Key Management

Select encryption project settingsChoose the GCP KMS key you configured earlier.
3

Save the change

Once you have selected the KMS of choice, select Save.