You are working with a client that is concerned about control of their encryption keys for sensitive data. The client does not want to store encryption keys at rest in the same cloud service…

Customer-supplied encryption keys (CSEK) allow users to provide their own encryption keys to Google Cloud, which Google uses to encrypt data at rest. The key material itself is not stored by Google Cloud, providing the customer full control over key management outside of Google's infrastructure.

Google default encryption means Google manages the encryption keys entirely, which is explicitly against the client's requirement of not storing keys in the same CSP.

Secret Manager is used for storing and managing secrets like API keys or passwords within Google Cloud, but it is not primarily an encryption key management solution for data at rest, and the secrets are still stored within Google Cloud.

Cloud External Key Manager (Cloud EKM) enables customers to protect their data in Google Cloud with encryption keys stored and managed in a third-party key management system outside of Google's infrastructure. This ensures that the key material never leaves the customer's control and is not at rest with Google Cloud.

Customer-managed encryption keys (CMEK) use Cloud Key Management Service (Cloud KMS) to manage keys. While it gives customers more control over key lifecycle, the keys themselves are still stored and managed within Google Cloud KMS, which is part of the same CSP.