GcpHow-ToBeginner · 4 min read

How to Encrypt Data Using KMS in GCP: Simple Guide

To encrypt data using Google Cloud KMS, you first create a key ring and a crypto key, then use the encrypt method with your plaintext data and the key's resource name. The service returns encrypted ciphertext that you can safely store or transmit.

📐

Syntax

Use the encrypt method of the KMS client with these parts:

keyName: The full resource path of the crypto key.
plaintext: The data you want to encrypt, in bytes.
response: Contains the encrypted ciphertext.

javascript

const [encryptResponse] = await client.encrypt({
  name: keyName,
  plaintext: Buffer.from('your data here'),
});
const ciphertext = encryptResponse.ciphertext;

💻

Example

This example shows how to encrypt a simple text string using Google Cloud KMS in Node.js. It creates a client, specifies the key, encrypts the data, and prints the encrypted result in base64 format.

javascript

import {KeyManagementServiceClient} from '@google-cloud/kms';

async function encryptData() {
  const client = new KeyManagementServiceClient();

  const projectId = 'your-project-id';
  const locationId = 'global';
  const keyRingId = 'my-key-ring';
  const cryptoKeyId = 'my-key';

  const keyName = client.cryptoKeyPath(projectId, locationId, keyRingId, cryptoKeyId);

  const plaintext = 'Hello, encrypt me!';

  const [encryptResponse] = await client.encrypt({
    name: keyName,
    plaintext: Buffer.from(plaintext),
  });

  console.log('Encrypted ciphertext:', encryptResponse.ciphertext.toString('base64'));
}

encryptData().catch(console.error);

Output

Encrypted ciphertext: CiQA7vQx... (base64 string)

⚠️

Common Pitfalls

1. Using incorrect key resource names: Always use the full path format projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{key}.

2. Forgetting to convert plaintext to bytes: KMS expects data as bytes, so use Buffer.from() or equivalent.

3. Not handling async calls properly: Use await or promise handling to get results before proceeding.

javascript

/* Wrong: plaintext as string */
client.encrypt({
  name: keyName,
  plaintext: 'text', // wrong
});

/* Right: plaintext as bytes */
client.encrypt({
  name: keyName,
  plaintext: Buffer.from('text'),
});

📊

Quick Reference

Step	Description	Example
1	Create Key Ring and Crypto Key in GCP Console or CLI	gcloud kms keyrings create my-key-ring --location global
2	Get full key resource name	projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key
3	Encrypt data using KMS client	client.encrypt({name: keyName, plaintext: Buffer.from(data)})
4	Store or transmit encrypted ciphertext safely	ciphertext.toString('base64')

✅

Key Takeaways

Always use the full resource name for your KMS key when encrypting data.

Convert your plaintext data to bytes before calling the encrypt method.

Handle asynchronous calls properly to get the encrypted result.

Store the encrypted ciphertext securely; it is safe to share or store.

Use Google Cloud Console or CLI to create keys before encrypting data.