Core concept
CMEK: KMS-managed key. Rotation controlled. Audit trail. Standard for enterprises.
Advertisement
How it works
CSEK: you supply key each request. Google never stores. Advanced use.
Advertisement
Trade-offs + gotchas
CMEK for most. CSEK for extreme security. Google-managed for simple use.