Customer-managed encryption keys, or CMEK, are encryption keys that you create and control in a key management service, rather than keys that the cloud provider generates and manages by default. The provider's service uses your key to encrypt your data at rest, and you decide who can use the key, how it is rotated and when it is disabled.
Organizations choose CMEK to meet compliance requirements or to gain more control. For example, disabling or destroying a key can make the data it protects unreadable, and key usage can be logged and audited separately from the service.
The control comes with responsibility. If a key is deleted, disabled by mistake or its permissions are removed, the data may become inaccessible, and the service can stop working. CMEK can also add cost and setup effort, and not every feature or product supports it. It does not protect data from someone who has legitimate access to the running service.
Before enabling it, check whether the service and your region support CMEK, plan who manages the keys and how they are backed up and rotated, and test what happens when a key is disabled. Keep a documented recovery process so that a key problem does not become a data-loss incident.