Encrypt user data
Stay organized with collections Save and categorize content based on your preferences.

Here's how to send encrypted data in audience member ingestion requests.

Set up the Google Cloud command line interface

Install and initialize the Google Cloud command line interface.
To ensure your gcloud components are up to date, run the following command.
```
gcloud components update
```
To select or create a new Google Cloud project and enable the Cloud Key Management Service, click Enable Cloud KMS.
Tip: We recommend using a separate project for your Cloud KMS resources that doesn't contain any other Google Cloud resources.
Enable Cloud KMS
To set your project in your environment, use the gcloud config set command. To check if the project is already set in your environment, run gcloud config list.
If no project is set, or you want to use a different project for your key, run gcloud config set:
```
gcloud config set project PROJECT_ID
```

Create a key

For more information, see the Key Management Service documentation.

Create a key ring.

gcloud kms keyrings create KEY_RING_NAME \
    --location KEY_RING_LOCATION

For more information, Create a key ring.

Create a key in the key ring. The ROTATION_PERIOD indicates the interval to rotate the key, and the NEXT_ROTATION_TIME indicates the date and time when the first rotation should occur.
For example, to rotate the key every 30 days and perform the first rotation in 1 week, set ROTATION_PERIOD to 30d and NEXT_ROTATION_TIME to $(date --utc --date="next week" --iso-8601=seconds).
```
gcloud kms keys create KEY_NAME \
    --keyring KEY_RING_NAME \
    --location KEY_RING_LOCATION \
    --purpose "encryption" \
    --rotation-period ROTATION_PERIOD \
    --next-rotation-time "NEXT_ROTATION_TIME"
```
For more information, see the Create a key.

Create a workload identity pool provider

This section is a short overview of Workload Identity Federation. For more information, see the Workload Identity Federation documentation.

Create a workload identity pool (WIP). The location for the pool must be global.

gcloud iam workload-identity-pools create WIP_ID \
   --location=global \
   --display-name="WIP_DISPLAY_NAME" \
   --description="WIP_DESCRIPTION"

For more information, see Manage workload identity pools and providers.

Create a workload identity pool provider. The --attribute-condition argument verifies that the caller is a match service account.

gcloud iam workload-identity-pools providers create-oidc PROVIDER_ID \
   --location=global \
   --workload-identity-pool=WIP_ID \
   --display-name="PROVIDER_DISPLAY_NAME" \
   --description="PROVIDER_DESCRIPTION" \
   --attribute-mapping="google.subject=assertion.sub,google.groups=[\"PROVIDER_ID\"]" \
   --attribute-condition="assertion.swname == '_SPACE' &&
     'STABLE' in assertion.submods._space.support_attributes &&
     ['[email protected]'].exists(
         a, a in assertion.google_service_accounts) &&
     'ECDSA_P256_SHA256:6b1f357b59e9407fb017ca0e3e783b2bd5acbfea6c83dd82971a4150df5b25f9'
     in assertion.submods.container.image_signatures.map(sig, sig.signature_algorithm+':'+sig.key_id)" \
   --issuer-uri="https://computing.googleapis.com" \
   --allowed-audiences="https://sts.googleapis.com"

Grant the key decrypter role to the WIP provider.

# Grants the role to the WIP provider.
gcloud kms keys add-iam-policy-binding KEY_NAME \
    --keyring KEY_RING_NAME \
    --location KEY_RING_LOCATION \
    --member "principalSet://iam.googleapis.com/projects/PROJECT_ID/locations/global/workloadIdentityPools/WIP_ID/group/PROVIDER_ID" \
    --role "roles/cloudkms.cryptoKeyDecrypter"

Encrypt data

Encryption in the Data Manager API requires a data encryption key (DEK). A DEK is a symmetric key that you use to encrypt data. Your DEK is encrypted using your Google Cloud KMS key. You send the encrypted DEK as part of the request.

To prepare the data in the request for encryption, follow the same formatting and hashing guidelines you'd use for unencrypted data.

Don't encrypt unhashed values. For example, the region_code or postal_code of an AddressInfo.

Once the data for each field is formatted and hashed, encrypt the hashed value using the following steps:

Encode the hash bytes using Base64 encoding.
Encrypt the Base64-encoded hash using your DEK.
Encode the output from the encryption process using either hex or Base64 encoding.
Use the encoded value for the field.
Set the encryption_info and encoding on the request.

To complete the last step, modify the IngestAudienceMembersRequest to indicate you encrypted your data:

Set the encryption_info field.
Set the encoding field to the encoding used to encode the encrypted field values.

Here's a snippet of a request with the encryption and encoding fields set:

{
  ...
  "encryptionInfo": {
    "gcpWrappedKeyInfo": {
      "kekUri": "gcp-kms://projects/PROJECT_ID/locations/KEY_RING_LOCATION/keyRings/KEY_RING_NAME/cryptoKeys/KEY_NAME",
      "wipProvider": "projects/PROJECT_ID/locations/global/workloadIdentityPools/WIP_ID/providers/PROVIDER_ID",
      "keyType": "XCHACHA20_POLY1305",
      "encryptedDek": "ENCRYPTED_DEK"
    }
  },
  "encoding": "ENCODING"
}

To use the Data Manager API library and utilities to construct and send a request, see the IngestAudienceMembersWithEncryption code sample for Java or the ingest_audience_members_with_encryption code sample for Python.