Skip to content

Add groups workaround for BYOK GCP config #2613

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 19, 2025
Merged

Add groups workaround for BYOK GCP config #2613

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0fc61bf
add groups workaround for byok gcp config
shainaraskas Aug 18, 2025
61920ab
now with tab sync
shainaraskas Aug 19, 2025
b621a4b
Merge branch 'main' into gcp-byok-limitation
shainaraskas Aug 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -313,9 +313,19 @@ The deployment is now created and encrypted using the specified key. Future snap
* `cloudkms.cryptoKeyVersions.useToEncrypt`


::::{tip}
The user performing this action needs to belong to the **Owner** or **Cloud KMS Admin** role.
::::
The user performing this action needs to belong to the **Owner** or **Cloud KMS Admin** role.


::::{note}
If [domain restricted sharing](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) is enabled, then you might not be able to grant the service principals access to the key resource directly. Alternatively, you can grant access to a Google group that contains the relevant service accounts.

1. Create a new Google group within the allowed domain.
2. In the Google Workspace administrator panel, [turn off domain restriction for your newly created Google group](https://support.google.com/a/answer/167097).
3. Add the service principals to the Google group.
4. Grant the Google group the roles as listed.

If you can't use Google Groups for your org, then [contact Elastic Support](https://www.elastic.co/support) for alternatives.
::::


**Step 2: Create your deployment**
Expand Down
Loading