Overview

• Labs are timed and cannot be paused. The timer starts when you click Start Lab.

• The included cloud terminal is preconfigured with the gcloud SDK.

• Use the terminal to execute commands and then click Check my progress to verify your work.

Challenge scenario

You are a system administrator at a large enterprise company. Your compliance team has informed you that you need to start encrypting data at rest with your own key (customer-supplied encryption key or CSEK). Your task is to create a persistent disk with encryption using the CSEK and attach that persistent disk to a VM instance.

Click Check my progress to verify the objective.

Create and attach a CSEK-encrypted persistent disk to the VM instance.

---

Solution of Lab

curl -LO raw.githubusercontent.com/ePlus-DEV/storage/refs/heads/main/labs/encrypt-a-persistent-disk-with-a-customer-supplied-key-solution/lab.sh
source lab.sh

Script Alternative

export PROJECT_ID=$(gcloud config get-value project) ZONE=$(gcloud compute instances list --limit=1 --format="value(zone)") VM_NAME=$(gcloud compute instances list --limit=1 --format="value(name)") BASE64_KEY=$(head -c 32 /dev/urandom | base64)
gcloud compute disks create csek-encrypted-disk --size=200GB --zone=$ZONE --csek-key-file=<(echo "[{\"uri\": \"https://www.googleapis.com/compute/v1/projects/$PROJECT_ID/zones/$ZONE/disks/csek-encrypted-disk\", \"key\": \"$BASE64_KEY\", \"key-type\": \"raw\"}]")
gcloud compute instances attach-disk $VM_NAME --disk=csek-encrypted-disk --zone=$ZONE --csek-key-file=<(echo "[{\"uri\": \"https://www.googleapis.com/compute/v1/projects/$PROJECT_ID/zones/$ZONE/disks/csek-encrypted-disk\", \"key\": \"$BASE64_KEY\", \"key-type\": \"raw\"}]")