一方、データの暗号化または復号が必要な場合は、暗号鍵が適しています。暗号化に使用される実際の暗号データは表示または抽出できません。Cloud Key Management Service などの鍵管理システムは、通常、データベース内の行、画像、ファイルなどの暗号化など、より要求の厳しいシナリオを管理するために使用されます。
データに追加の保護レイヤが必要な場合は、顧客管理の暗号鍵（CMEK）を有効にして、Cloud Key Management Service に保存されている独自の暗号鍵を使用して、Secret Manager のシークレットを保護できます。Datastream で CMEK を使用する方法の詳細については、顧客管理の暗号鍵（CMEK）を使用するをご覧ください。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eDatastream integrates with Secret Manager to securely store authentication resources like database passwords, utilizing secrets instead of plain text.\u003c/p\u003e\n"],["\u003cp\u003eSecrets in Secret Manager are global resources containing metadata and secret versions, which hold the actual data like API keys or passwords.\u003c/p\u003e\n"],["\u003cp\u003eSecrets are ideal for securely storing and managing sensitive data as binary blobs or text strings, while encryption keys are better suited for encrypting and decrypting data.\u003c/p\u003e\n"],["\u003cp\u003eTo use Secret Manager with Datastream, users must create a secret and can do so either through Secret Manager or while defining connection details, needing the \u003ccode\u003eSecret Manager Secret Accessor\u003c/code\u003e role.\u003c/p\u003e\n"],["\u003cp\u003eYou can enable customer-managed encryption keys (CMEK) to add an extra layer of security for your secrets.\u003c/p\u003e\n"]]],[],null,["# Use Secret Manager to store sensitive data\n\nDatastream integrates with [Secret Manager](/security/products/secret-manager)\nto let you securely store authentication resources, such as source database\npasswords. Rather than use a plain text password when creating a connection\nprofile, create and use a secret.\n\nWhat are secrets\n----------------\n\n**Secrets** are global resources that contain metadata, such as labels,\nannotations, and permissions.\n\nSecrets also have **secret versions**. Secret versions store the actual data for\nthe secret resource, such as API keys, passwords, or certificates. Each version\nhas a unique identifier or a timestamp.\n\nHow are secrets different from encryption keys\n----------------------------------------------\n\nManaging secrets is equally important as managing encryption keys, however it\nfocuses on a different area of data security. You might use one or the other,\ndepending on your use cases and types of sensitive information that you store.\n\nYou would typically select secrets to securely store and manage your sensitive\ndata as binary blobs or text strings. Secrets store the actual data, but to\naccess it, you need specific permissions which are defined in the secrets\nmetadata.\n\nOn the other hand, encryption keys are a better choice if you need to encrypt or\ndecrypt data. You can't view or extract the actual cryptographic data that is\nused for encryption. Key management systems such as Cloud Key Management Service are typically\nused to manage more demending scenarios, for example encrypting rows in a\ndatabase, or images and files.\n\nIf you need an additional layer of protection for your data, you can enable\ncustomer-managed encryption keys (CMEK), and use your own encryption keys\nstored in Cloud Key Management Service to secure secrets in Secret Manager. For more\ninformation about how to use CMEK with Datastream, see\n[Use customer-managed encryption keys (CMEK)](/datastream/docs/use-cmek).\n\nUse Secret Manager with Datastream\n----------------------------------\n\nTo store your sensitive data for use with Datastream, you need to create\na secret using Secret Manager. For more information, see\n[Create a secret](/secret-manager/docs/creating-and-accessing-secrets).\n\nYou can also create a secret when you define connection details for your\nconnection profile. For detailed information, see\n[Create connection profiles](/datastream/docs/create-connection-profiles).\n| **Note:** You can store your newly created secret in any Google Cloud project, it doesn't have to be the project where you created your stream.\n\n### Required roles\n\n\nTo get the permissions that\nyou need to use Secret Manager with Datastream,\n\nask your administrator to grant you the\n\n\n[Secret Manager Secret Accessor](/iam/docs/roles-permissions/secretmanager#secretmanager.secretAccessor) (`roles/secretmanager.secretAccessor`)\nIAM role on the Datastream service account.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined)."]]
