하드웨어 보안 모듈 (HSM) API는 플랫폼 관리자 (PA)가 조직의 보안 키를 제어하는 데 사용하는 리소스를 제공합니다.
Google Distributed Cloud(GDC) 에어 갭의 스토리지 시스템(예: 디스크 암호화용 서버 키 및 블록 스토리지용 스토리지 데이터 관리 소프트웨어)은 키를 만들고 리소스로 나타냅니다.
PA는 키를 보고 감사 로그를 가져와서 삭제하여 데이터를 그래픽으로 지웁니다. PA는 키를 직접 만들 수 없습니다. 스토리지 시스템은 필요에 따라 이를 생성합니다.
GDC는 모든 저장 데이터를 암호화합니다. 저장 중인 모든 데이터와 모든 서버에 HSM을 사용합니다. 키 리소스에 액세스할 수 있으므로 저장 데이터를 보호하는 키를 관리할 수 있습니다. GDC의 암호화에 관한 자세한 내용은 저장 데이터 암호화를 참고하세요.
서비스 엔드포인트 및 검색 문서
kubectl proxy 명령어를 사용하여 브라우저에서 다음 HSM API 엔드포인트에 액세스하고 KMS API의 디스커버리 문서를 가져옵니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThe HSM API enables Platform Administrators (PAs) to manage security keys within their organization, which are created by storage systems in Google Distributed Cloud (GDC).\u003c/p\u003e\n"],["\u003cp\u003ePAs can view keys, access audit logs, and delete keys via the HSM API, but they cannot directly create new keys as the storage systems manage key creation automatically.\u003c/p\u003e\n"],["\u003cp\u003eGDC encrypts all data at rest, using the HSM for all data and servers, and this resource access provides the PA with the ability to manage the keys that protect the data.\u003c/p\u003e\n"],["\u003cp\u003eDeleting keys results in the permanent loss of the associated data, therefore extreme caution is required when performing this action.\u003c/p\u003e\n"],["\u003cp\u003eThe HSM API endpoint can be accessed via the \u003ccode\u003ekubectl proxy\u003c/code\u003e command, enabling retrieval of the discovery document for the KMS API.\u003c/p\u003e\n"]]],[],null,["# Hardware security modules API overview\n\nThe hardware security modules (HSM) API provides the resources that the\nPlatform Administrator (PA) uses to control the security keys in their organization.\nStorage systems in Google Distributed Cloud (GDC) air-gapped, such as Server Keys for\ndisk encryption and storage data management software for block storage,\ncreate the keys and represent them as resources.\n\nThe PA views the keys, pulls their audit logs, and deletes them to erase data\ngraphically. The PA cannot directly create keys. The storage systems create them\nas necessary.\n| **Note:** After the storage systems create the keys, it might take a few minutes for them to appear in each resource.\n\nGDC encrypts all data at rest. It uses the HSM for all\ndata at rest and all servers. Because you have access to the resource for keys,\nyou can manage the keys that protect your data at rest. For more details on\nencryption in GDC, see\n[Encryption at rest](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/encryption-at-rest).\n| **Warning:** Deleting keys wipes out your entire data. Delete your keys with caution for the stability of the system.\n\nService endpoint and discovery document\n---------------------------------------\n\nUse the `kubectl proxy` command to access the following HSM API endpoint in your\nbrowser and obtain the discovery document for the KMS API: \n\n https://\u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e/apis/hsm.gdc.goog/v1\n\nReplace \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e with the endpoint of the\nManagement API server.\n\nThe `kubectl proxy` command opens a proxy to the Kubernetes API server on your\nlocal machine. When the command is running, access the document through the\nfollowing URL:\n\n`http://127.0.0.1:8001/apis/hsm.gdc.goog/v1`"]]
