You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the...

[Reference: https://cloud.google.com/kms/docs/envelope-encryption, , Envelope Encryption: https://cloud.google.com/kms/docs/envelope-encryption, Here are best practices for managing DEKs:, -Generate DEKs locally., -When stored, always ensure DEKs are encrypted at rest., - For easy access, store the DEK near the data that it encrypts., The DEK is encrypted (also known as wrapped) by a key encryption key (KEK). The process of encrypting a key with another key is known as envelope encryption., Here are best practices for managing KEKs:, -Store KEKs centrally. (KMS ), -Set the granularity of the DEKs they encrypt based on their use case. For example, consider a workload that requires multiple DEKs to encrypt the workload's data chunks. You could use a single KEK to wrap all DEKs that are responsible for that workload's encryption., -Rotate keys regularly, and also after a suspected incident., , ]