IssueTracker

What you would like to accomplish:

We want to be able to use KMS Autokey on a per-object basis.
Not all objects should get their dedicated encryption key, but we want to have a set of encryption keys that are dynamically created (e.g. per customer).

When a new resource is uploaded, we check whether an encryption key exists for the customer. If it already exists, we use the encryption key; if it does not, we would create it dynamically.

How this might work:

1. Check if a key exists:

GET https://cloudkms.googleapis.com/v1/projects/-/locations/-/keyHandles/storage-customerA

404 Not Found

2. Create a key if it does not exist:

POST https://cloudkms.googleapis.com/v1/projects/-/locations/-/keyHandles?keyHandleId=storage-customerA

{
  "resourceTypeSelector": "storage.googleapis.com/Object"
}

If applicable, reasons why alternative solutions are not sufficient:

It would be impractical for us to create a storage bucket per customer, given we want to expose the files (securely protected) via our Application Load Balancer and our domain.

Other information (workarounds you have tried, documentation consulted, etc):

We'd be happy to test and give feedback on the Autokeys if it becomes available for Storage objects.