Google Compute instance VMs that have disk encryption enabled with customer supplied keys must also have the snapshots encrypted with a customer supplied key. For more on encryption of Compute Engine disks and snapshots, see the GCP documentation.
References:
https://cloud.google.com/compute/docs/disks/customer-supplied-encryption#create_snapshot
The encryption configuration can only be configured during the process of provisioning the snapshot.
In GCP Console -
In Terraform -
References:
https://registry.terraform.io/providers/hashicorp/google/4.50.0/docs/resources/compute_snapshot#nested_snapshot_encryption_key
https://cloud.google.com/compute/docs/disks/customer-supplied-encryption