CMEK requirements

Ensure that the CMEK you plan to use for encrypting your Cloudera environment meets the following requirements.

• CMEK needs to be in the same region as the environment.

• The key must have the following permissions for the compute and cloud sql service agents:

  Cloud KMS CryptoKey Encrypter/Decrypter

The following instructions describe how to create a CMEK that meets these requirements.