Back to Checks
gcp

Dataproc cluster is encrypted with a customer-managed encryption key (CMEK)

dataproc_encrypted_with_cmks_disabled
Service: dataprocSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:dataproc.googleapis.com/Cluster

Dataproc clusters use Customer-Managed Encryption Keys (CMEK) for VM persistent disk encryption. The finding determines whether a customer KMS key is configured for disk data instead of the default Google-managed keys.

Prowler logoProwlerprowler-provider-gcp

Risk

Without CMEK on Dataproc disks, keys remain provider-controlled, limiting rotation, revocation, and location control. This reduces containment if disks or snapshots are exposed and may block data sovereignty requirements, impacting confidentiality and incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks dataproc_encrypted_with_cmks_disabled

Recommendation

Enable CMEK for Dataproc disk, job-argument, and staging-bucket encryption.

  • Grant KMS access with least privilege to required service accounts
  • Enforce regular rotation and support revocation/disable procedures
  • Keep keys co-located with data and monitor KMS usage
  • Consider Cloud EKM for external key control

Remediation

Terraform

resource "google_dataproc_cluster" "<example_resource_name>" {
  name   = "<example_resource_name>"
  region = "<example_region>"

  cluster_config {
    encryption_config {
      gce_pd_kms_key_name = "projects/<example_project_id>/locations/<example_region>/keyRings/<example_keyring_name>/cryptoKeys/<example_key_name>" # FIX: Sets CMEK for persistent disks to pass the check
    }
  }
}

Other

1In Google Cloud Console, go to Dataproc > Clusters
2Click Create cluster
3In Cluster configuration, open Security (or Encryption)
4For Disk encryption key, select Customer-managed key and choose your Cloud KMS key
5Click Create
6Migrate workloads to the new cluster and delete the old non-CMEK cluster

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.dataproc.dataproc_client import dataproc_client


class dataproc_encrypted_with_cmks_disabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for cluster in dataproc_client.clusters:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=cluster,
                location=dataproc_client.region,
            )
            report.status = "PASS"
            report.status_extended = f"Dataproc cluster {cluster.name} is encrypted with customer managed encryption keys."
            if cluster.encryption_config.get("gcePdKmsKeyName") is None:
                report.status = "FAIL"
                report.status_extended = f"Dataproc cluster {cluster.name} is not encrypted with customer managed encryption keys."
            findings.append(report)

        return findings

References