Control: Ensure that dataproc cluster is encrypted using customer-managed encryption key
Description
When you use Dataproc, cluster, and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket. This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key-encryption key (KEK). Google still controls the data encryption key (DEK).
Usage
Run the control in your terminal:
powerpipe control run gcp_compliance.control.dataproc_cluster_encryption_with_cmekSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run gcp_compliance.control.dataproc_cluster_encryption_with_cmek --shareSQL
This control uses a named query:
dataproc_cluster_encryption_with_cmek