Security in Google Cloud v3.0 Lab 15: Using Customer-Supplied Encryption Keys with Cloud Storage
Cloud Storage always encrypts your data on the server side with a Google-managed encryption key, before it is written to disk, at no additional charge. As an alternative to a Google-managed server-side encryption key, you can choose to provide your own AES-256 key, encoded in standard Base64. This key is known as a customer-supplied encryption key.