Google Cloud Compliance ControlsGoogle Cloud AlloyDB for PostgreSQL
AlloyDB clusters should use customer-managed encryption keys (CMEK) for encryption
Alloy DB clusters should use customer-managed encryption key (CMEK) for encryption. The check reads the `encryptionType` in `encryption_info` of each `gcp_alloydb_cluster`. A cluster passes when it is encrypted with customer-managed encryption keys.
What this control checks
AlloyDB cluster encryptionType must be CUSTOMER_MANAGED_ENCRYPTION, otherwise alarm.
Framework mappings
The clauses this control is mapped to in each framework.
- C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
alloydb_cluster_encrypted_with_cmk - Powerpipe Control:
gcp_compliance.control.alloydb_cluster_encrypted_with_cmk
Last reviewed: 2026-10-09