Use customer-supplied encryption keys

Overview

This page describes how to use your own encryption key, referred to as a customer-supplied encryption key , with Cloud Storage. For other encryption options in Cloud Storage, see Data Encryption Options .

Generate your own encryption key

There are many ways to generate a Base64-encoded AES-256 encryption key. Here are several examples:

C++

For more information, see the Cloud Storage C++ API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  // Create a pseudo-random number generator (PRNG), this is included for 
 // demonstration purposes only. You should consult your security team about 
 // best practices to initialize PRNG. In particular, you should verify that 
 // the C++ library and operating system provide enough entropy to meet the 
 // security policies in your organization. 
 // Use the Mersenne-Twister Engine in this example: 
 //   https://en.cppreference.com/w/cpp/numeric/random/mersenne_twister_engine 
 // Any C++ PRNG can be used below, the choice is arbitrary. 
 using 
  
 GeneratorType 
  
 = 
  
 std 
 :: 
 mt19937_64 
 ; 
 // Create the default random device to fetch entropy. 
 std 
 :: 
 random_device 
  
 rd 
 ; 
 // Compute how much entropy we need to initialize the GeneratorType: 
 constexpr 
  
 auto 
  
 kRequiredEntropyWords 
  
 = 
  
 GeneratorType 
 :: 
 state_size 
  
 * 
  
 ( 
 GeneratorType 
 :: 
 word_size 
  
 / 
  
 std 
 :: 
 numeric_limits<unsigned 
  
 int 
> :: 
 digits 
 ); 
 // Capture the entropy bits into a vector. 
 std 
 :: 
 vector<std 
 :: 
 uint64_t 
>  
 entropy 
 ( 
 kRequiredEntropyWords 
 ); 
 std 
 :: 
 generate 
 ( 
 entropy 
 . 
 begin 
 (), 
  
 entropy 
 . 
 end 
 (), 
  
 [ 
& rd 
 ] 
  
 { 
  
 return 
  
 rd 
 (); 
  
 }); 
 // Create the PRNG with the fetched entropy. 
 std 
 :: 
 seed_seq 
  
 seed 
 ( 
 entropy 
 . 
 begin 
 (), 
  
 entropy 
 . 
 end 
 ()); 
 // initialized with enough entropy such that the encryption keys are not 
 // predictable. Note that the default constructor for all the generators in 
 // the C++ standard library produce predictable keys. 
 std 
 :: 
 mt19937_64 
  
 gen 
 ( 
 seed 
 ); 
 namespace 
  
 gcs 
  
 = 
  
 :: 
 google 
 :: 
 cloud 
 :: 
 storage 
 ; 
 gcs 
 :: 
 EncryptionKeyData 
  
 data 
  
 = 
  
 gcs 
 :: 
 CreateKeyFromGenerator 
 ( 
 gen 
 ); 
 std 
 :: 
 cout 
 << 
 "Base64 encoded key = " 
 << 
 data 
 . 
 key 
 << 
 " 
 \n 
 " 
 << 
 "Base64 encoded SHA256 of key = " 
 << 
 data 
 . 
 sha256 
 << 
 " 
 \n 
 " 
 ;

C#

For more information, see the Cloud Storage C# API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  using 
  
  Google.Cloud.Storage.V1 
 
 ; 
 using 
  
 System 
 ; 
 public 
  
 class 
  
 GenerateEncryptionKeySample 
 { 
  
 public 
  
 string 
  
 GenerateEncryptionKey 
 () 
  
 { 
  
 var 
  
 encryptionKey 
  
 = 
  
  EncryptionKey 
 
 . 
  Generate 
 
 (). 
  Base64Key 
 
 ; 
  
 Console 
 . 
 WriteLine 
 ( 
 $"Generated Base64-encoded AES-256 encryption key: {encryptionKey}" 
 ); 
  
 return 
  
 encryptionKey 
 ; 
  
 } 
 }

Go

For more information, see the Cloud Storage Go API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  import 
  
 ( 
  
 "crypto/rand" 
  
 "encoding/base64" 
  
 "fmt" 
  
 "io" 
 ) 
 // generateEncryptionKey generates a 256 bit (32 byte) AES encryption key and 
 // prints the base64 representation. 
 func 
  
 generateEncryptionKey 
 ( 
 w 
  
 io 
 . 
 Writer 
 ) 
  
 error 
  
 { 
  
 // This is included for demonstration purposes. You should generate your own 
  
 // key. Please remember that encryption keys should be handled with a 
  
 // comprehensive security policy. 
  
 key 
  
 := 
  
 make 
 ([] 
 byte 
 , 
  
 32 
 ) 
  
 if 
  
 _ 
 , 
  
 err 
  
 := 
  
 rand 
 . 
 Read 
 ( 
 key 
 ); 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "rand.Read: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 encryptionKey 
  
 := 
  
 base64 
 . 
 StdEncoding 
 . 
 EncodeToString 
 ( 
 key 
 ) 
  
 fmt 
 . 
 Fprintf 
 ( 
 w 
 , 
  
 "Generated base64-encoded encryption key: %v\n" 
 , 
  
 encryptionKey 
 ) 
  
 return 
  
 nil 
 }

Java

For more information, see the Cloud Storage Java API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  import 
  
 com.google.common.io.BaseEncoding 
 ; 
 import 
  
 java.security.SecureRandom 
 ; 
 public 
  
 class 
 GenerateEncryptionKey 
  
 { 
  
 /** 
 * Generates a 256 bit (32 byte) AES encryption key and prints the base64 representation. This is 
 * included for demonstration purposes only. You should generate your own key, and consult your 
 * security team about best practices. Please remember that encryption keys should be handled with 
 * a comprehensive security policy. 
 */ 
  
 public 
  
 static 
  
 void 
  
 generateEncryptionKey 
 () 
  
 { 
  
 byte 
 [] 
  
 key 
  
 = 
  
 new 
  
 byte 
 [ 
 32 
 ] 
 ; 
  
 new 
  
 SecureRandom 
 (). 
 nextBytes 
 ( 
 key 
 ); 
  
 String 
  
 encryptionKey 
  
 = 
  
 BaseEncoding 
 . 
 base64 
 (). 
 encode 
 ( 
 key 
 ); 
  
 System 
 . 
 out 
 . 
 println 
 ( 
 "Generated Base64-encoded AES-256 encryption key: " 
  
 + 
  
 encryptionKey 
 ); 
  
 } 
 }

Node.js

For more information, see the Cloud Storage Node.js API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  const 
  
 crypto 
  
 = 
  
 require 
 ( 
 'crypto' 
 ); 
 function 
  
 generateEncryptionKey 
 () 
  
 { 
  
 /** 
 * Generates a 256 bit (32 byte) AES encryption key and prints the base64 
 * representation. 
 * 
 * This is included for demonstration purposes. You should generate your own 
 * key. Please remember that encryption keys should be handled with a 
 * comprehensive security policy. 
 */ 
  
 const 
  
 buffer 
  
 = 
  
 crypto 
 . 
 randomBytes 
 ( 
 32 
 ); 
  
 const 
  
 encodedKey 
  
 = 
  
 buffer 
 . 
 toString 
 ( 
 'base64' 
 ); 
  
 console 
 . 
 log 
 ( 
 `Base 64 encoded encryption key: 
 ${ 
 encodedKey 
 } 
 ` 
 ); 
 } 
 generateEncryptionKey 
 ();

PHP

For more information, see the Cloud Storage PHP API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  /** 
 * Generate a base64 encoded encryption key for Google Cloud Storage. 
 */ 
 function generate_encryption_key(): void 
 { 
 $key = random_bytes(32); 
 $encodedKey = base64_encode($key); 
 printf('Your encryption key: %s' . PHP_EOL, $encodedKey); 
 }

Python

For more information, see the Cloud Storage Python API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  import 
  
 base64 
 import 
  
 os 
 def 
  
 generate_encryption_key 
 (): 
  
 """Generates a 256 bit (32 byte) AES encryption key and prints the 
 base64 representation. 
 This is included for demonstration purposes. You should generate your own 
 key. Please remember that encryption keys should be handled with a 
 comprehensive security policy. 
 """ 
 key 
 = 
 os 
 . 
 urandom 
 ( 
 32 
 ) 
 encoded_key 
 = 
 base64 
 . 
 b64encode 
 ( 
 key 
 ) 
 . 
 decode 
 ( 
 "utf-8" 
 ) 
 print 
 ( 
 f 
 "Base 64 encoded encryption key: 
 { 
 encoded_key 
 } 
 " 
 )

Ruby

For more information, see the Cloud Storage Ruby API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  def 
  
 generate_encryption_key 
  
 # Generates a 256 bit (32 byte) AES encryption key and prints the base64 representation. 
  
 # 
  
 # This is included for demonstration purposes. You should generate your own key. 
  
 # Please remember that encryption keys should be handled with a comprehensive security policy. 
  
 require 
  
 "base64" 
  
 require 
  
 "openssl" 
  
 encryption_key 
  
 = 
  
 OpenSSL 
 :: 
 Cipher 
 . 
 new 
 ( 
 "aes-256-cfb" 
 ) 
 . 
 encrypt 
 . 
 random_key 
  
 encoded_enc_key 
  
 = 
  
 Base64 
 . 
 encode64 
  
 encryption_key 
  
 puts 
  
 "Sample encryption key: 
 #{ 
 encoded_enc_key 
 } 
 " 
 end

Upload with your encryption key

To use customer-supplied encryption keys to upload an object:

Console

The Google Cloud console cannot be used to upload an object with a customer-supplied encryption key. Use the Google Cloud CLI or the client libraries instead.

Command line

Use the gcloud storage cp command with the --encryption-key flag:

gcloud storage cp SOURCE_DATA 
gs:// BUCKET_NAME 
/ OBJECT_NAME 
--encryption-key= YOUR_ENCRYPTION_KEY

Where:

SOURCE_DATA is the source location of the data you're encrypting. This can be any source location supported by the cp command. For example, a local file such as Desktop/dogs.png or another Cloud Storage object such as gs://my-bucket/pets/old-dog.png .
BUCKET_NAME is the name of the destination bucket for this copy command. For example, my-bucket .
OBJECT_NAME is the name of the final, encrypted object. For example, pets/new-dog.png .
YOUR_ENCRYPTION_KEY is the AES-256 key that you want to use for encrypting the uploaded object.

Client libraries

C++

For more information, see the Cloud Storage C++ API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  namespace 
  
 gcs 
  
 = 
  
 :: 
 google 
 :: 
 cloud 
 :: 
 storage 
 ; 
 using 
  
 :: 
 google 
 :: 
 cloud 
 :: 
 StatusOr 
 ; 
 []( 
 gcs 
 :: 
 Client 
  
 client 
 , 
  
 std 
 :: 
 string 
  
 const 
&  
 bucket_name 
 , 
  
 std 
 :: 
 string 
  
 const 
&  
 object_name 
 , 
  
 std 
 :: 
 string 
  
 const 
&  
 base64_aes256_key 
 ) 
  
 { 
  
 StatusOr<gcs 
 :: 
 ObjectMetadata 
>  
 object_metadata 
  
 = 
  
 client 
 . 
 InsertObject 
 ( 
  
 bucket_name 
 , 
  
 object_name 
 , 
  
 "top secret" 
 , 
  
 gcs 
 :: 
 EncryptionKey 
 :: 
 FromBase64Key 
 ( 
 base64_aes256_key 
 )); 
  
 if 
  
 ( 
 ! 
 object_metadata 
 ) 
  
 throw 
  
 std 
 :: 
 move 
 ( 
 object_metadata 
 ). 
 status 
 (); 
  
 std 
 :: 
 cout 
 << 
 "The object " 
 << 
 object_metadata 
 - 
> name 
 () 
 << 
 " was created in bucket " 
 << 
 object_metadata 
 - 
> bucket 
 () 
 << 
 " 
 \n 
 Full metadata: " 
 << 
 * 
 object_metadata 
 << 
 " 
 \n 
 " 
 ; 
 }

C#

For more information, see the Cloud Storage C# API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  using 
  
  Google.Cloud.Storage.V1 
 
 ; 
 using 
  
 System 
 ; 
 using 
  
 System.IO 
 ; 
 public 
  
 class 
  
 UploadEncryptedFileSample 
 { 
  
 public 
  
 void 
  
 UploadEncryptedFile 
 ( 
  
 string 
  
 key 
  
 = 
  
 "3eFsTXPvqi3BpT2ipFCGirslh1Jgc6ikjoAu2oQ5JcI=" 
 , 
  
 string 
  
 bucketName 
  
 = 
  
 "your-unique-bucket-name" 
 , 
  
 string 
  
 localPath 
  
 = 
  
 "my-local-path/my-file-name" 
 , 
  
 string 
  
 objectName 
  
 = 
  
 "my-file-name" 
 ) 
  
 { 
  
 var 
  
 storage 
  
 = 
  
  StorageClient 
 
 . 
  Create 
 
 (); 
  
 using 
  
 var 
  
 fileStream 
  
 = 
  
 File 
 . 
 OpenRead 
 ( 
 localPath 
 ); 
  
 storage 
 . 
 UploadObject 
 ( 
 bucketName 
 , 
  
 objectName 
 , 
  
 null 
 , 
  
 fileStream 
 , 
  
 new 
  
  UploadObjectOptions 
 
  
 { 
  
 EncryptionKey 
  
 = 
  
  EncryptionKey 
 
 . 
  Create 
 
 ( 
 Convert 
 . 
 FromBase64String 
 ( 
 key 
 )) 
  
 }); 
  
 Console 
 . 
 WriteLine 
 ( 
 $"Uploaded {objectName}." 
 ); 
  
 } 
 }

Go

For more information, see the Cloud Storage Go API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  import 
  
 ( 
  
 "context" 
  
 "fmt" 
  
 "io" 
  
 "time" 
  
 "cloud.google.com/go/storage" 
 ) 
 // uploadEncryptedFile writes an object using AES-256 encryption key. 
 func 
  
 uploadEncryptedFile 
 ( 
 w 
  
 io 
 . 
  Writer 
 
 , 
  
 bucket 
 , 
  
 object 
  
 string 
 , 
  
 secretKey 
  
 [] 
 byte 
 ) 
  
 error 
  
 { 
  
 // bucket := "bucket-name" 
  
 // object := "object-name" 
  
 // secretKey := []byte("secret-key") 
  
 ctx 
  
 := 
  
 context 
 . 
 Background 
 () 
  
 client 
 , 
  
 err 
  
 := 
  
 storage 
 . 
 NewClient 
 ( 
 ctx 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "storage.NewClient: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 defer 
  
 client 
 . 
 Close 
 () 
  
 ctx 
 , 
  
 cancel 
  
 := 
  
 context 
 . 
 WithTimeout 
 ( 
 ctx 
 , 
  
 time 
 . 
 Second 
 * 
 50 
 ) 
  
 defer 
  
 cancel 
 () 
  
 o 
  
 := 
  
 client 
 . 
  Bucket 
 
 ( 
 bucket 
 ). 
  Object 
 
 ( 
 object 
 ) 
  
 // Optional: set a generation-match precondition to avoid potential race 
  
 // conditions and data corruptions. The request to upload is aborted if the 
  
 // object's generation number does not match your precondition. 
  
 // For an object that does not yet exist, set the DoesNotExist precondition. 
  
 o 
  
 = 
  
 o 
 . 
 If 
 ( 
 storage 
 . 
  Conditions 
 
 { 
 DoesNotExist 
 : 
  
 true 
 }) 
  
 // If the live object already exists in your bucket, set instead a 
  
 // generation-match precondition using the live object's generation number. 
  
 // attrs, err := o.Attrs(ctx) 
  
 // if err != nil { 
  
 // 	return fmt.Errorf("object.Attrs: %w", err) 
  
 // } 
  
 // o = o.If(storage.Conditions{GenerationMatch: attrs.Generation}) 
  
 // Encrypt the object's contents. 
  
 wc 
  
 := 
  
 o 
 . 
  Key 
 
 ( 
 secretKey 
 ). 
  NewWriter 
 
 ( 
 ctx 
 ) 
  
 if 
  
 _ 
 , 
  
 err 
  
 := 
  
 wc 
 . 
  Write 
 
 ([] 
 byte 
 ( 
 "top secret" 
 )); 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "Writer.Write: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 if 
  
 err 
  
 := 
  
 wc 
 . 
 Close 
 (); 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "Writer.Close: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 fmt 
 . 
 Fprintf 
 ( 
 w 
 , 
  
 "Uploaded encrypted object %v.\n" 
 , 
  
 object 
 ) 
  
 return 
  
 nil 
 }

Java

For more information, see the Cloud Storage Java API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  import 
  
 com.google.cloud.storage. BlobId 
 
 ; 
 import 
  
 com.google.cloud.storage. BlobInfo 
 
 ; 
 import 
  
 com.google.cloud.storage. Storage 
 
 ; 
 import 
  
 com.google.cloud.storage. StorageOptions 
 
 ; 
 import 
  
 java.io.IOException 
 ; 
 import 
  
 java.nio.file.Files 
 ; 
 import 
  
 java.nio.file.Paths 
 ; 
 public 
  
 class 
 UploadEncryptedObject 
  
 { 
  
 public 
  
 static 
  
 void 
  
 uploadEncryptedObject 
 ( 
  
 String 
  
 projectId 
 , 
  
 String 
  
 bucketName 
 , 
  
 String 
  
 objectName 
 , 
  
 String 
  
 filePath 
 , 
  
 String 
  
 encryptionKey 
 ) 
  
 throws 
  
 IOException 
  
 { 
  
 // The ID of your GCP project 
  
 // String projectId = "your-project-id"; 
  
 // The ID of your GCS bucket 
  
 // String bucketName = "your-unique-bucket-name"; 
  
 // The ID of your GCS object 
  
 // String objectName = "your-object-name"; 
  
 // The path to your file to upload 
  
 // String filePath = "path/to/your/file" 
  
 // The key to encrypt the object with 
  
 // String encryptionKey = "TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g="; 
  
  Storage 
 
  
 storage 
  
 = 
  
  StorageOptions 
 
 . 
 newBuilder 
 (). 
 setProjectId 
 ( 
 projectId 
 ). 
 build 
 (). 
  getService 
 
 (); 
  
  BlobId 
 
  
 blobId 
  
 = 
  
  BlobId 
 
 . 
 of 
 ( 
 bucketName 
 , 
  
 objectName 
 ); 
  
  BlobInfo 
 
  
 blobInfo 
  
 = 
  
  BlobInfo 
 
 . 
 newBuilder 
 ( 
 blobId 
 ). 
 build 
 (); 
  
 // Optional: set a generation-match precondition to avoid potential race 
  
 // conditions and data corruptions. The request returns a 412 error if the 
  
 // preconditions are not met. 
  
  Storage 
 
 . 
 BlobTargetOption 
  
 precondition 
 ; 
  
 if 
  
 ( 
 storage 
 . 
  get 
 
 ( 
 bucketName 
 , 
  
 objectName 
 ) 
  
 == 
  
 null 
 ) 
  
 { 
  
 // For a target object that does not yet exist, set the DoesNotExist precondition. 
  
 // This will cause the request to fail if the object is created before the request runs. 
  
 precondition 
  
 = 
  
  Storage 
 
 . 
 BlobTargetOption 
 . 
 doesNotExist 
 (); 
  
 } 
  
 else 
  
 { 
  
 // If the destination already exists in your bucket, instead set a generation-match 
  
 // precondition. This will cause the request to fail if the existing object's generation 
  
 // changes before the request runs. 
  
 precondition 
  
 = 
  
  Storage 
 
 . 
 BlobTargetOption 
 . 
 generationMatch 
 ( 
  
 storage 
 . 
  get 
 
 ( 
 bucketName 
 , 
  
 objectName 
 ). 
 getGeneration 
 ()); 
  
 } 
  
 storage 
 . 
  create 
 
 ( 
  
 blobInfo 
 , 
  
 Files 
 . 
 readAllBytes 
 ( 
 Paths 
 . 
 get 
 ( 
 filePath 
 )), 
  
 Storage 
 . 
 BlobTargetOption 
 . 
 encryptionKey 
 ( 
 encryptionKey 
 ), 
  
 precondition 
 ); 
  
 System 
 . 
 out 
 . 
 println 
 ( 
  
 "File " 
  
 + 
  
 filePath 
  
 + 
  
 " uploaded to bucket " 
  
 + 
  
 bucketName 
  
 + 
  
 " as " 
  
 + 
  
 objectName 
  
 + 
  
 " with supplied encryption key" 
 ); 
  
 } 
 }

Node.js

For more information, see the Cloud Storage Node.js API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  /** 
 * TODO(developer): Uncomment the following lines before running the sample. 
 */ 
 // The ID of your GCS bucket 
 // const bucketName = 'your-unique-bucket-name'; 
 // The path to your file to upload 
 // const filePath = 'path/to/your/file'; 
 // The new ID for your GCS file 
 // const destFileName = 'your-new-file-name'; 
 // The key to encrypt the object with 
 // const key = 'TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g='; 
 // Imports the Google Cloud client library 
 const 
  
 { 
 Storage 
 } 
  
 = 
  
 require 
 ( 
 ' @google-cloud/storage 
' 
 ); 
 // Creates a client 
 const 
  
 storage 
  
 = 
  
 new 
  
 Storage 
 (); 
 async 
  
 function 
  
 uploadEncryptedFile 
 () 
  
 { 
  
 const 
  
 options 
  
 = 
  
 { 
  
 destination 
 : 
  
 destFileName 
 , 
  
 encryptionKey 
 : 
  
 Buffer 
 . 
 from 
 ( 
 key 
 , 
  
 ' base64 
' 
 ), 
  
 // Optional: 
  
 // Set a generation-match precondition to avoid potential race conditions 
  
 // and data corruptions. The request to upload is aborted if the object's 
  
 // generation number does not match your precondition. For a destination 
  
 // object that does not yet exist, set the ifGenerationMatch precondition to 0 
  
 // If the destination object already exists in your bucket, set instead a 
  
 // generation-match precondition using its generation number. 
  
 preconditionOpts 
 : 
  
 { 
 ifGenerationMatch 
 : 
  
 generationMatchPrecondition 
 }, 
  
 }; 
  
 await 
  
 storage 
 . 
 bucket 
 ( 
 bucketName 
 ). 
  upload 
 
 ( 
 filePath 
 , 
  
 options 
 ); 
  
 console 
 . 
 log 
 ( 
  
 `File 
 ${ 
 filePath 
 } 
 uploaded to gs:// 
 ${ 
 bucketName 
 } 
 / 
 ${ 
 destFileName 
 } 
 ` 
  
 ); 
 } 
 uploadEncryptedFile 
 (). 
 catch 
 ( 
 console 
 . 
 error 
 );

PHP

For more information, see the Cloud Storage PHP API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  use Google\Cloud\Storage\StorageClient; 
 /** 
 * Upload an encrypted file. 
 * 
 * @param string $bucketName The name of your Cloud Storage bucket. 
 *        (e.g. 'my-bucket') 
 * @param string $objectName The name of your Cloud Storage object. 
 *        (e.g. 'my-object') 
 * @param string $source The path to the file to upload. 
 *        (e.g. '/path/to/your/file') 
 * @param string $base64EncryptionKey The base64 encoded encryption key. 
 *        (e.g. 'TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g=') 
 */ 
 function upload_encrypted_object(string $bucketName, string $objectName, string $source, string $base64EncryptionKey): void 
 { 
 $storage = new StorageClient(); 
 $file = fopen($source, 'r'); 
 $bucket = $storage->bucket($bucketName); 
 $object = $bucket->upload($file, [ 
 'name' => $objectName, 
 'encryptionKey' => $base64EncryptionKey, 
 ]); 
 printf('Uploaded encrypted %s to gs://%s/%s' . PHP_EOL, 
 basename($source), $bucketName, $objectName); 
 }

Python

For more information, see the Cloud Storage Python API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  import 
  
 base64 
 from 
  
 google.cloud 
  
 import 
  storage 
 
 def 
  
 upload_encrypted_blob 
 ( 
 bucket_name 
 , 
 source_file_name 
 , 
 destination_blob_name 
 , 
 base64_encryption_key 
 , 
 ): 
  
 """Uploads a file to a Google Cloud Storage bucket using a custom 
 encryption key. 
 The file will be encrypted by Google Cloud Storage and only 
 retrievable using the provided encryption key. 
 """ 
 # bucket_name = "your-bucket-name" 
 # source_file_name = "local/path/to/file" 
 # destination_blob_name = "storage-object-name" 
 # base64_encryption_key = "TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g=" 
 storage_client 
 = 
  storage 
 
 . 
  Client 
 
 () 
 bucket 
 = 
 storage_client 
 . 
  bucket 
 
 ( 
 bucket_name 
 ) 
 # Encryption key must be an AES256 key represented as a bytestring with 
 # 32 bytes. Since it's passed in as a base64 encoded string, it needs 
 # to be decoded. 
 encryption_key 
 = 
 base64 
 . 
 b64decode 
 ( 
 base64_encryption_key 
 ) 
 blob 
 = 
 bucket 
 . 
 blob 
 ( 
 destination_blob_name 
 , 
 encryption_key 
 = 
 encryption_key 
 ) 
 # Optional: set a generation-match precondition to avoid potential race conditions 
 # and data corruptions. The request to upload is aborted if the object's 
 # generation number does not match your precondition. For a destination 
 # object that does not yet exist, set the if_generation_match precondition to 0. 
 # If the destination object already exists in your bucket, set instead a 
 # generation-match precondition using its generation number. 
 generation_match_precondition 
 = 
 0 
 blob 
 . 
  upload_from_filename 
 
 ( 
 source_file_name 
 , 
 if_generation_match 
 = 
 generation_match_precondition 
 ) 
 print 
 ( 
 f 
 "File 
 { 
 source_file_name 
 } 
 uploaded to 
 { 
 destination_blob_name 
 } 
 ." 
 )

Ruby

For more information, see the Cloud Storage Ruby API reference documentation .

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

  def 
  
 upload_encrypted_file 
  
 bucket_name 
 :, 
  
 local_file_path 
 :, 
  
 file_name 
 : 
  
 nil 
 , 
  
 encryption_key 
 : 
  
 # The ID of your GCS bucket 
  
 # bucket_name = "your-unique-bucket-name" 
  
 # The path to your file to upload 
  
 # local_file_path = "/local/path/to/file.txt" 
  
 # The ID of your GCS object 
  
 # file_name = "your-file-name" 
  
 # The encryption key used for securing the object must be a 32-byte key consisting of raw encrypted data. 
  
 # Key used should not be base64 encoded. 
  
 # encryption_key = "your-encryption-key" 
  
 require 
  
 "google/cloud/storage" 
  
 storage 
  
 = 
  
 Google 
 :: 
 Cloud 
 :: 
  Storage 
 
 . 
  new 
 
  
 bucket 
  
 = 
  
 storage 
 . 
 bucket 
  
 bucket_name 
 , 
  
 skip_lookup 
 : 
  
 true 
  
 file 
  
 = 
  
 bucket 
 . 
  create_file 
 
  
 local_file_path 
 , 
  
 file_name 
 , 
  
 encryption_key 
 : 
  
 encryption_key 
  
 puts 
  
 "Uploaded 
 #{ 
 file 
 . 
 name 
 } 
 with encryption key" 
 end

Use customer-supplied encryption keys

Generate your own encryption key

C++

C#

Go

Java

Node.js

PHP

Python

Ruby

Upload with your encryption key

Console

Command line

Client libraries

C++

C#

Go

Java

Node.js

PHP

Python

Ruby

REST APIs

JSON API

XML API

Download objects you've encrypted

Console

Command line

Client libraries

C++

C#

Go

Java

Node.js

PHP

Python

Ruby

REST APIs

JSON API

XML API

Rotate your encryption keys

Console

Command line

Client libraries

C++

C#

Go

Java

Node.js

PHP

Python

Ruby

REST APIs

JSON API

XML API

What's next