Back to Checks
gcp

VM instance has all disks encrypted with Customer-Supplied Encryption Keys (CSEK)

compute_instance_encryption_with_csek_enabled
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:compute.googleapis.com/Instance

Compute Engine VM disks use Customer-Supplied Encryption Keys (CSEK) rather than provider-managed keys. The finding flags instances where any attached disk is not protected with the customer-provided key.

Prowler logoProwlerprowler-provider-gcp

Risk

Without CSEK, encryption depends on provider-managed keys, reducing control over key lifecycle and access. This weakens confidentiality, impedes separation of duties, and can delay key revocation, increasing exposure to unauthorized data access and regulatory gaps.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_encryption_with_csek_enabled

Recommendation

Use CSEK for VM disks that require full control over data-at-rest keys. Apply least privilege to key custodians, store keys in hardened vaults/HSMs, enforce rotation and rapid revocation, and document recovery procedures. Combine with defense in depth (network and IAM controls) to limit blast radius.

Remediation

Terraform

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-medium"
  zone         = "<example_zone>"

  boot_disk {
    initialize_params { image = "debian-cloud/debian-12" }
    # Critical: enables Customer-Supplied Encryption Key (CSEK) for the boot disk
    disk_encryption_key { raw_key = "<BASE64_32BYTE_KEY>" }  # base64-encoded AES-256 key
  }

  network_interface { network = "default" }
}

Other

1In Google Cloud Console, go to Compute Engine > VM instances
2Click Create instance (you must recreate VMs to use CSEK on boot disks)
3In Boot disk, click Change
4Expand Encryption and select Customer-supplied key
5Paste your base64-encoded 256-bit key and click Select
6If adding additional disks: in Additional disks, add a disk and set Encryption to Customer-supplied key with the same key
7Click Create to launch the VM with all disks encrypted using CSEK
8Migrate workload from the old VM and delete it when done

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_encryption_with_csek_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "FAIL"
            report.status_extended = f"The VM Instance {instance.name} has the following unencrypted disks: '{', '.join([i[0] for i in instance.disks_encryption if not i[1]])}'."
            if all([i[1] for i in instance.disks_encryption]):
                report.status = "PASS"
                report.status_extended = (
                    f"The VM Instance {instance.name} has every disk encrypted."
                )
            findings.append(report)

        return findings

References