---
names: 
  full: "Google Dataproc Cluster is not encrypted using Customer-Managed Encryption Key"
  contextual: "Cluster is not encrypted using Customer-Managed Encryption Key"
description: "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) \
 associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. \ 
 This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and \ 
 key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key \ 
 encryption key (KEK). Google still controls the data encryption key (DEK)."
type: COMPLIANCE_POLICY
categories:
  - "SECURITY"
frameworkMappings:
  - /frameworks/cis-gcp-v3.0.0/08/01
  - /frameworks/cloudaware/resource-security/secure-access
similarPolicies:
  cloudConformity:
    - url: "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/Dataproc/enable-encryption-with-cmks-for-dataproc-clusters.html"
      name: "Enable Dataproc Cluster Encryption with Customer-Managed Keys"
