Query: storage_bucket_encryption_detail

select
  case when k.name is not null then 'Customer-managed encryption key (CMEK)' else 'Google-managed encryption key' end as "Encryption Type",
  k.name as "Key Name",
  k.key_ring_name as "Key Ring Name",
  k.create_time as "Created Time",
  k.location as "Location",
  k.self_link as "Self Link"
from
  gcp_storage_bucket b
  left join gcp_kms_key k on split_part(b.default_kms_key_name, 'cryptoKeys/', 2) = k.name
where
  b.id = split_part($1, '/', 1)
  and b.project = split_part($1, '/', 2)