Use customer-managed encryption keys (CMEK)
By default, Colab Enterprise encrypts customer content at rest. Colab Enterprise handles encryption for you without any additional actions on your part. This option is called Google default encryption.
If you want to control your encryption keys, then you can use customer-managed encryption keys (CMEKs) in Cloud KMS with CMEK-integrated services including Colab Enterprise. Using Cloud KMS keys gives you control over their protection level, location, rotation schedule, usage and access permissions, and cryptographic boundaries. Using Cloud KMS also lets you view audit logs and control key lifecycles. Instead of Google owning and managing the symmetric key encryption keys (KEKs) that protect your data, you control and manage these keys in Cloud KMS.
After you set up your resources with CMEKs, the experience of accessing your Colab Enterprise resources is similar to using Google default encryption. For more information about your encryption options, see Customer-managed encryption keys (CMEK).
This guide describes how to use CMEK for Colab Enterprise.
For more information about how to use CMEK for Gemini Enterprise Agent Platform, see the Agent Platform CMEK page.
CMEK for Colab Enterprise
You can use CMEK to encrypt Colab Enterprise runtimes, notebook files (notebooks), and Data Science Agent data.
Runtimes
When you run code in a Colab Enterprise notebook, a runtime runs the code on one or more virtual machine (VM) instances managed by Colab Enterprise. When you enable CMEK for your Colab Enterprise runtimes, the key that you designate, rather than a key managed by Google, is used to encrypt data on these VMs. The CMEK key encrypts the following kinds of data:
- The copy of your code on the VMs.
- Any data that gets loaded by your code.
- Any temporary data that gets saved to the local disk by your code.
You can start, stop, and upgrade your runtime without affecting its CMEK encryption.
In general, the CMEK key does not encrypt metadata associated with your operation, like the runtime's name or your notebook's name and region. This metadata is always encrypted using Google's default encryption mechanism.
Notebooks
Colab Enterprise notebooks are stored in Dataform repositories. When you create a notebook, Colab Enterprise automatically creates a hidden Dataform repository where the notebook is stored. Because the repository is hidden, you can't modify its encryption settings as you would with other Dataform repositories.
To use CMEK for your notebooks, you must set a default Dataform CMEK key for the Google Cloud project that will contain your notebooks. After you set a default Dataform CMEK key, Dataform applies the key to all new repositories created in the Google Cloud project by default, including any hidden repositories created for storing your notebooks.
The default Dataform CMEK key isn't applied to existing repositories. Therefore, if you already have notebooks in that project, they won't be encrypted by the default Dataform CMEK key. To use CMEK with a notebook that was created before you set your project's default Dataform CMEK key, you can save the notebook file as a new Colab Enterprise notebook.
To learn more about default Dataform CMEK keys, see Use Dataform default CMEK keys.
To use CMEK for your notebooks, see Set a default Dataform CMEK key.
Data Science Agent
The Data Science Agent automatically uses the Cloud KMS key configured on your default runtime template to encrypt session data at rest, such as conversation history. You don't need to configure CMEK separately for the Data Science Agent.
Key changes and removals for the Data Science Agent
When you change or remove the CMEK key on your default runtime template (or delete a CMEK-configured default runtime template), the encryption settings are applied to the Data Science Agent when you start a new session. The impact on your Data Science Agent data and session depends on the type of change: