Ensure encryption is enabled for Google Cloud Storage Buckets

Google Cloud Storage should be encrypted to protect sensitive information. It is considered best practice to encrypt data at-rest in any environment that supports it, especially as it is often required for certain compliance frameworks or industry regulations.

Encryption of Cloud Storage data at-rest is configured by default. To use a customer-managed key, follow the instructions below.

In GCP Console -

1. Log into the GCP Console and go to Cloud Storage.
2. Under Buckets, choose the bucket you wish to edit.
3. Select the Configuration tab.
4. Under Protection, select the pencil next to the Encryption type listed.
5. Choose Customer-managed encryption key and select a key from the drop down.
6. Select Save.

In Terraform -

1. In the google_storage_bucket resource, set the encryption.default_kms_key_name field to a valid KMS key name.

References:
https://cloud.google.com/storage/docs/encryption
https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket#nested_encryption