{
  "slug": "gcp-compute-engine-customer-supplied-encryption-keys-cseks-retirement",
  "title": "Compute Engine: customer-supplied encryption keys (CSEKs) shutdown",
  "summary": "Shutdown date for customer-supplied encryption keys (CSEKs) in the Compute Engine deprecations table: 16 Jun 2027. Google's CSEK deprecation page gives July 20, 2027 for complete removal and names customer-managed encryption keys (CMEK) as the alternative.",
  "cloud": "gcp",
  "service": "Compute Engine",
  "service_slug": "compute-engine",
  "category": "feature",
  "type": "retirement",
  "announced_date": "2026-06-15",
  "effective_date": "2027-06-16",
  "effective_precision": "day",
  "impact": "Using customer-supplied encryption keys (CSEK) to encrypt Persistent Disks, images, machine images, standard and archive snapshots, and instant snapshots in Compute Engine is deprecated. The CSEK on an existing resource cannot be removed and replaced with a CMEK: a copy of the resource has to be created and encrypted with the CMEK. Google's two pages give different dates:\n\n- Compute Engine deprecations table: deprecated June 15, 2026, shutdown date 16 Jun 2027.\n- CSEK deprecation page: as of July 20, 2026, a CSEK can no longer be used to encrypt any of these resources, and CSEK is completely removed from Compute Engine on July 20, 2027.",
  "migration_path": "1. Make sure you have at least one Cloud KMS key ring and key. To create them, see [Creating key rings and keys](https://docs.cloud.google.com/kms/docs/creating-keys).\n2. Disks: create a standard snapshot of the CSEK-encrypted disk and create a new CMEK-encrypted disk from that snapshot. If the source disk is the boot disk of a running instance, stop the instance. Detach the source disk, attach the new disk, and verify that the new disk works as expected. Replacing the disk often requires stopping the instance.\n3. Images, standard snapshots and archive snapshots: create a new CMEK-encrypted disk from the image or snapshot, then create an image or snapshot of the new disk and encrypt it with a CMEK.\n4. Machine images: using REST or the Google Cloud CLI, create a temporary instance from the CSEK-encrypted machine image and specify a Cloud KMS key for each disk. Verify the instance, create a CMEK-encrypted machine image from it, then delete the temporary instance.\n5. Instant snapshots: create a temporary CSEK-encrypted standard snapshot from the instant snapshot, create a temporary CMEK-encrypted disk from it, create a CMEK-encrypted instant snapshot of that disk, then delete the temporary snapshot and disk.\n6. Test the migration steps in a non-production environment first, and delete the resources you no longer need afterward. Google's steps are in [migrate your CSEK-encrypted Compute Engine resources to use CMEKs](https://docs.cloud.google.com/compute/docs/deprecations/csek-deprecation-in-compute-engine#migrate-csek-cmeks-overview).",
  "replacement": "Customer-managed encryption keys (CMEK) in Cloud Key Management Service",
  "affected_versions": [],
  "source_url": "https://docs.cloud.google.com/compute/docs/deprecations",
  "extra_source_urls": [
    "https://docs.cloud.google.com/compute/docs/deprecations/csek-deprecation-in-compute-engine"
  ],
  "vendor_ref": null,
  "last_checked_at": "2026-11-12T09:56:10.861Z",
  "created_at": "2026-11-13T13:36:44.208Z",
  "updated_at": "2026-11-13T13:36:44.208Z",
  "url": "https://eolwatch.dev/items/gcp-compute-engine-customer-supplied-encryption-keys-cseks-retirement",
  "short_url": "https://eolwatch.dev/i/6p",
  "markdown_url": "https://eolwatch.dev/items/gcp-compute-engine-customer-supplied-encryption-keys-cseks-retirement.md",
  "json_url": "https://eolwatch.dev/items/gcp-compute-engine-customer-supplied-encryption-keys-cseks-retirement.json",
  "estate_check": null
}