This example creates a sample centralized [Cloud KMS](https://cloud.google.com/kms?hl=it) configuration, and uses it to implement CMEK for [Cloud Storage](https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys) and [Compute Engine](https://cloud.google.com/compute/docs/disks/customer-managed-encryption) in a service project.
The example is designed to match real-world use cases with a minimum amount of resources, and be used as a starting point for scenarios where application projects implement CMEK using keys managed by a central team. It also includes the IAM wiring needed to make such scenarios work. Regional resources are used in this example, but the same logic will apply for 'dual regional', 'multi regional' or 'global' resources.
| [prefix](variables.tf#L28) | Optional prefix used to generate resources names. | <code>string</code> | ✓ | |
| [project_config](variables.tf#L34) | Provide 'billing_account_id' and 'parent' values if project creation is needed, uses existing 'projects_id' if null. Parent is in 'folders/nnn' or 'organizations/nnn' format. | <codetitle="object({ billing_account_id = optional(string, null) parent = optional(string, null) project_ids = optional(object({ encryption = string service = string }), { encryption = "encryption", service = "service" } ) })">object({…})</code> | ✓ | |
| [deletion_protection](variables.tf#L15) | Prevent Terraform from destroying data storage resources (storage buckets, GKE clusters, CloudSQL instances) in this blueprint. When this field is set in Terraform state, a terraform destroy or terraform apply that would delete data storage resources will fail. | <code>bool</code> | | <code>false</code> |
| [location](variables.tf#L22) | The location where resources will be deployed. | <code>string</code> | | <code>"europe"</code> |
| [region](variables.tf#L51) | The region where resources will be deployed. | <code>string</code> | | <code>"europe-west1"</code> |
| [vpc_ip_cidr_range](variables.tf#L57) | Ip range used in the subnet deployef in the Service Project. | <code>string</code> | | <code>"10.0.0.0/20"</code> |
| [vpc_name](variables.tf#L63) | Name of the VPC created in the Service Project. | <code>string</code> | | <code>"local"</code> |
| [vpc_subnet_name](variables.tf#L69) | Name of the subnet created in the Service Project. | <code>string</code> | | <code>"subnet"</code> |