> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Use GCP KMS for Infisical encryption

> Learn how to manage encryption using GCP KMS

To enhance the security of your Infisical projects, you can now encrypt your secrets using an external Key Management Service (KMS).
When external KMS is configured for your project, all encryption and decryption operations will be handled by the chosen KMS.
This guide will walk you through the steps needed to configure external KMS support with Google Cloud KMS.

## Prerequisites

Before you begin, you'll first need to set up a GCP Service Account, add a KMS key and set the required permissions.

**1. Create a GCP Service Account**

1. Navigate to the [Create Service Account](https://console.cloud.google.com/iam-admin/serviceaccounts/create) page in your GCP Console.

   ![GCP Service Account Creation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/gcp/service-account-form.png)

2. Give the service account a suitable **name** and **description**. Then click **Create and Continue**.

3. Under **Grant this service account access to project**, click **Select a role** and select the
   **Cloud KMS Viewer** and **Cloud KMS CryptoKey Encrypter/Decrypter**\* roles, then click **Continue**.

   ![GCP Service Account Permissions](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/gcp/service-account-permissions.png)

4. You can skip the **Grant users access to this service account** options.

5. Click Done.

6. You should see the service account in the list of service accounts. Click it to view the service account details.

7. Select the **Keys** tab, click **Add Key**, select **Create new key**, select **JSON** as the key type, then click **Create**.

8. You'll be prompted to download a JSON file that we will need later on.

> [!NOTE]
>
> Remember to keep the JSON file in a secure location. It will be used to authenticate your GCP service account.
>
> Once you have successfully set up GCP KMS with Infisical, you should permanently delete the JSON file.

**2. Add a GCP KMS Key**

1. Navigate to the [KMS](https://console.cloud.google.com/security/kms) page in your GCP Console.

> [!NOTE]
>
> If you haven't used GCP KMS before, you'll be redirected to the **Cloud Key Management Service (KMS) API** page.
>
> Click **Enable** to enable the KMS API, then continue the steps below.
>
> It may take a few minutes for the API to be enabled and KMS section of the Cloud Console to become viewable.

2. In the KMS section, click **Create Key Ring**.

   ![GCP Create Key Ring](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/gcp/keyring-create.png)

3. Give the key ring a **Name** and select a **Region**, then click **Create**.

> [!NOTE]
>
> We don't currently support multi-region key rings.

4. On the "Create Key" page, give the key a **Name** and set the **Protection Level** based on your requirements (or use default *Software*), then click **Continue**.

5. Under **Key Material**, select **Generated Key**, then click **Continue**.

6. Under **Purpose**, select **Symmetric encrypt/decrypt**, then click **Continue**.

7. For **Key Rotation Period**, select **Never (manual rotation)**, then click **Continue** followed by **Create**.

8. You should see the key in the list of keys. We're now ready to set it up in Infisical.

## Setup GCP KMS in the organization settings

Next, you'll need to follow the steps listed below to add GCP KMS for your organization.

**1. Open the Encryption settings**

Go to **Settings**, select **Encryption**, then select **Add KMS**.

![Open encryption org settings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/encryption-org-settings.png)

**2. Select GCP KMS**

![Select Encryption Provider](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/encryption-modal-provider-select.png)

Choose **GCP KMS** from the list of encryption providers.

**3. Provide the inputs for GCP KMS**

![GCP Create KMS Modal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/gcp/gcp-add-modal-filled.png)

Selecting GCP as the provider will require you input the following fields.

**Alias** `string` *required*

Name for referencing the GCP KMS key within the organization.

**Description** `string`

Short description of the GCP KMS key.

**GCP Region** `dropdown` *required*

The GCP region where the GCP KMS key ring is located.

**Service Account Credential JSON** `file` *required*

Upload the JSON file you downloaded earlier when creating the GCP service account.

**GCP Key Name** `dropdown` *required*

This field will be populated with the list of GCP KMS keys in the selected region. Select the key you created earlier.

**4. Save the configuration**

Select **Save** to apply the settings.

You now have a GCP KMS Key configured at the organization level. You can assign these GCP KMS keys to existing Infisical projects from the project's **Settings** page.

## Assign GCP KMS key to an existing project

To assign the GCP KMS key you added to your organization, follow the steps below.

**1. Open the project's Encryption settings**

Open the project, go to **Settings**, and select **Encryption**.

![Open encryption project
settings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/gcp/project-settings.png)

**2. Select the key under Key Management**

![Select encryption project
settings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/gcp/select-gcp-kms-in-project.png)

Choose the GCP KMS key you configured earlier.

**3. Save the change**

Once you have selected the KMS of choice, select **Save**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.