Your company has a strict policy that all cryptographic keys used to encrypt data in Google Cloud must be generated and managed on-premises by your own Hardware Security Module (HSM). Which encryption method must you use?

Customer-Supplied Encryption Keys (CSEK) is a feature where you generate your own encryption keys on-premises. When you create a resource (like a Compute Engine disk or Cloud Storage object), you provide the key in the API request. Google uses it to encrypt the data and immediately purges the key from memory. If you lose the key, Google cannot recover your data.