Arcade Trail: Data Engineering and Security

GSP079 — Getting Started with Cloud KMS

Estimated time: 15 minutes

# 🚀 Getting Started with Cloud KMS > ⚠️ **Disclaimer:** This is an independent, community-made walkthrough created for educational purposes, hands-on practice, and Google Cloud certification preparation. This guide is designed to help learners understand Google Cloud Key Management Service (Cloud KMS), encryption workflows, IAM permissions, and Cloud Storage through practical exercises. Always attempt the lab yourself first and follow Google Cloud Skills Boost / Qwiklabs Terms of Service. This

clear
CYAN=$(tput setaf 6)
BOLD=$(tput bold)
RESET=$(tput sgr0)
GREEN=$(tput setaf 2)
YELLOW=$(tput setaf 3)

echo "${CYAN}${BOLD}"
echo "   ____       _     _ _            __   ___             "
echo "  / __ \     | |   (_) |          / _| / _ \            "
echo " | |  | |_ __| |__  _| |_   ___  | |_ | | | |_ __  ___  "
echo " | |  | | '__| '_ \| | __| / _ \ |  _|| | | | '_ \/ __| "
echo " | |__| | |  | |_) | | |_ | (_) || |  | |_| | |_) \__ \ "
echo "  \____/|_|  |_.__/|_|\__| \___/ |_|   \___/| .__/|___/ "
echo "                                            | |         "
echo "                                            |_|         "
echo "${RESET}"
echo "${CYAN}====================================================${RESET}"
echo "${GREEN}${BOLD}Command 1 of 2: KMS Setup & Single File Encryption${RESET}"
echo "${CYAN}====================================================${RESET}"
echo ""

export PROJECT_ID=$(gcloud config get-value project)
export BUCKET_NAME="${PROJECT_ID}-kms_lab"
export KEYRING_NAME="labkey"
export CRYPTOKEY_NAME="qwiklab"

echo "${YELLOW}Task 1: Creating Cloud Storage Bucket (${BUCKET_NAME})...${RESET}"
gcloud storage buckets create gs://${BUCKET_NAME} --quiet

echo "${YELLOW}Task 2: Fetching sample financial document...${RESET}"
gcloud storage cp gs://${PROJECT_ID}-kms-lab-data/finance-dept/inbox/1.txt . --quiet
    
echo "${YELLOW}Task 3: Enabling Cloud KMS API...${RESET}"
gcloud services enable cloudkms.googleapis.com --quiet
sleep 15

echo "${YELLOW}Task 4: Creating KeyRing (${KEYRING_NAME}) & CryptoKey (${CRYPTOKEY_NAME})...${RESET}"
gcloud kms keyrings create $KEYRING_NAME --location global
gcloud kms keys create $CRYPTOKEY_NAME --location global --keyring $KEYRING_NAME --purpose encryption

echo "${YELLOW}Task 5: Encrypting sample document via KMS API...${RESET}"
export PLAINTEXT=$(cat 1.txt | base64 -w0)
curl -s "https://cloudkms.googleapis.com/v1/projects/$PROJECT_ID/locations/global/keyRings/$KEYRING_NAME/cryptoKeys/$CRYPTOKEY_NAME:encrypt" -d "{\"plaintext\":\"$PLAINTEXT\"}" -H "Authorization:Bearer $(gcloud auth application-default print-access-token)" -H "Content-Type:application/json" | jq .ciphertext -r > 1.encrypted
    
echo "${YELLOW}Task 5: Uploading encrypted document to Cloud Storage...${RESET}"
gcloud storage cp 1.encrypted gs://${BUCKET_NAME} --quiet

echo "${GREEN}Command 1 Complete. You can now click 'Check my progress' for Tasks 1, 4, and 5.${RESET}"

CYAN=$(tput setaf 6)
GREEN=$(tput setaf 2)
YELLOW=$(tput setaf 3)
BOLD=$(tput bold)
RESET=$(tput sgr0)

echo "${CYAN}====================================================${RESET}"
echo "${GREEN}${BOLD}Command 2 of 2: IAM & Batch Encryption${RESET}"
echo "${CYAN}====================================================${RESET}"

export PROJECT_ID=$(gcloud config get-value project)
export BUCKET_NAME="${PROJECT_ID}-kms_lab"
export KEYRING_NAME="labkey"
export CRYPTOKEY_NAME="qwiklab"
    
echo "${YELLOW}Task 6: Assigning KMS IAM Permissions...${RESET}"
export USER_EMAIL=$(gcloud auth list --limit=1 2>/dev/null | grep '@' | awk '{print $2}')
gcloud kms keyrings add-iam-policy-binding $KEYRING_NAME --location global --member user:$USER_EMAIL --role roles/cloudkms.admin --quiet
gcloud kms keyrings add-iam-policy-binding $KEYRING_NAME --location global --member user:$USER_EMAIL --role roles/cloudkms.cryptoKeyEncrypterDecrypter --quiet
sleep 10

echo "${YELLOW}Task 7: Fetching full finance department dataset...${RESET}"
gcloud storage cp -r gs://${PROJECT_ID}-kms-lab-data/finance-dept . --quiet

echo "${YELLOW}Task 7: Batch encrypting all documents...${RESET}"
export MYDIR="finance-dept"
export FILES=$(find $MYDIR -type f -not -name "*.encrypted")
for file in $FILES; do
  export FILE_PLAINTEXT=$(cat $file | base64 -w0)
  curl -s "https://cloudkms.googleapis.com/v1/projects/$PROJECT_ID/locations/global/keyRings/$KEYRING_NAME/cryptoKeys/$CRYPTOKEY_NAME:encrypt" \
    -d "{\"plaintext\":\"$FILE_PLAINTEXT\"}" \
    -H "Authorization:Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type:application/json" \
  | jq .ciphertext -r > $file.encrypted
done

echo "${YELLOW}Task 7: Uploading batch encrypted documents to Cloud Storage...${RESET}"
gcloud storage cp finance-dept/inbox/*.encrypted gs://${BUCKET_NAME}/finance-dept/inbox --quiet

echo ""
echo "${GREEN}${BOLD}🎉 AUTOMATION COMPLETED SUCCESSFULLY 🎉${RESET}"
echo "${CYAN}You can now safely click the remaining 'Check my progress' buttons in your lab manual.${RESET}"