How to retain private control over the encryption keys while using Cloud services?

Question

All cloud service providers have their own Key management systems and customer keys can be imported when desired. However i want to have private control over keys such that keys are provided externally and never imported into the KMS.So the cloud provider should be able to access the external key without importing. Or another case could be where public keys are at the cloud provider but only client has access to private keys externally. Any help or ideas will be appreciated

Answer 1

On Google Cloud, you can do this with External Key Manager (EKM) https://cloud.google.com/kms/docs/ekm