Generally available: Google Cloud VMware Engine offers self-service management for customer-managed encryption keys...

Generally available: Google Cloud VMware Engine offers self-service management for customer-managed encryption keys (CMEK) using the Google Cloud console and the VMware Engine API. You can enable CMEK for your private clouds, using Cloud Key Management Service (Cloud KMS) to manage encryption keys for vSAN and vTPM. Key features and considerations include:

• You can transition between CMEK and Google-owned and Google-managed encryption keys (GMEK) as needed. • The "Auto-Rekey" feature integrates with Cloud KMS key rotation to perform automated key rotation for the key encryption key (KEK), maintaining security without manual intervention or service downtime.

Limitations: This self-service functionality is unavailable for private clouds that use CMEK through service tickets.