이 페이지에서는 암호화된 Google Distributed Cloud (GDC) 오프라인 스토리지 버킷을 관리하는 방법을 보여줍니다.
시작하기 전에
프로젝트 네임스페이스는 관리 API 서버에서 버킷 리소스를 관리합니다. 버킷 및 객체로 작업하려면 프로젝트가 있어야 합니다.
다음 작업을 수행하려면 적절한 버킷 권한도 있어야 합니다. 버킷 액세스 권한 부여를 참고하세요.
암호화 리소스 관리
v2 암호화가 적용된 버킷에는 보안 비밀 kekRef과 여러 AEADKey가 생성됩니다. 여기서 kekRef은 사용 중인 활성 기본 AEADKey를 참조하는 데 사용되고 AEADKey에는 버킷에 속한 활성 및 보관된 키가 포함됩니다.
버킷의 활성 기본 AEADKey 새로고침
약 420억 개의 객체 쓰기 작업이 완료된 후 버킷의 기본 AEADKeys를 새로고침하는 것이 좋습니다. 이 선제적 단계는 보안을 강화하고 키 소진을 방지합니다. 새로고침 프로세스는 새 kekRef를 만들고 이전 AEADKeys를 비활성화합니다. 새로고침 프로세스를 시작하려면 버킷과 연결된 kekRef 보안 비밀을 삭제하세요.
이 프로세스를 시작하려면 먼저 활성 기본 키를 새로고침해야 합니다. 이렇게 하면 새 활성 기본 AEADKey가 생성되고 이전 키 암호화 키가 비활성화된 것으로 표시됩니다. 기본 키가 새로고침된 후 후속 객체 업로드에서는 새 AEADKeys를 키 암호화 키로 사용합니다. 이전 AEADKeys는 폐기되지 않으므로 이러한 키를 사용하여 이전에 암호화된 기존 객체를 계속 복호화할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis guide outlines the process for managing encrypted storage buckets in Google Distributed Cloud (GDC) air-gapped environments, requiring a project and appropriate bucket permissions to begin.\u003c/p\u003e\n"],["\u003cp\u003eBuckets using \u003ccode\u003ev2\u003c/code\u003e encryption rely on a \u003ccode\u003ekekRef\u003c/code\u003e secret to reference active default AEADKeys, with AEADKeys including both active and archived keys, where archived keys are inactive due to the deletion of old secrets.\u003c/p\u003e\n"],["\u003cp\u003eAs a security best practice, users should refresh their bucket's default AEADKeys after around 42 billion object writes by deleting the \u003ccode\u003ekekRef\u003c/code\u003e secret, which will automatically create a new one and mark the previous AEADKeys as deactivated.\u003c/p\u003e\n"],["\u003cp\u003eIf an AEADKey becomes compromised, you should refresh the active default keys to generate new ones, then download and re-upload all objects in the bucket to use the new keys, while previous keys are not destroyed, allowing decryption of older objects.\u003c/p\u003e\n"],["\u003cp\u003eAfter you re-upload all objects in your bucket, you can identify and delete deactivated AEADKeys.\u003c/p\u003e\n"]]],[],null,["# Manage Encryption Resources\n\nThis page shows you how to manage encrypted Google Distributed Cloud (GDC) air-gapped storage buckets.\n\nBefore you begin\n----------------\n\nA project namespace manages bucket resources in the Management API server. You\nmust have a [project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/project-management) to work with buckets and objects.\n\nYou must also have the appropriate bucket permissions to perform the following\noperation. See [Grant bucket access](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/grant-obtain-storage-access#grant_bucket_access).\n\nManage encryption resources\n---------------------------\n\nBuckets with `v2` encryption would have a secret `kekRef` and several AEADKeys created, in which `kekRef` is used to reference active default AEADKeys being used and AEADKeys include active and archive ones belong to the bucket.\n| **Note:** Archive AEADKey means it has been deactivated due to the deletion of old secret.\n\nRefresh active default AEADKeys for a bucket\n--------------------------------------------\n\nAs a best practice, refresh your bucket's default AEADKeys after approximately 42 billion object writes. This proactive step enhances security and prevents key exhaustion. The refresh process will create a new kekRef and deactivates the previous AEADKeys. To start the refresh process, delete the kekRef secret associated with the bucket.\n| **Note:** Mark AEADKey to be inactive wouldn't cause objects encrypted using that key to be crypto shredded.\n\nThe previous kekRef can be retrieved by running the following command to retrieve: \n\n kubectl get secrets -n \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e -l object.gdc.goog/bucket-name=\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e\n\nThen you can run the following to delete the existing kekRef: \n\n kubectl delete secrets \u003cvar translate=\"no\"\u003eOLD_KEKREF_NAME\u003c/var\u003e -n \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e\n\nAfter the successful deletion, you can run the following to confirm a new kekRef has been created based on `AGE`: \n\n kubectl get secrets -n \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e -l object.gdc.goog/bucket-name=\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e\n\nVerify new default AEADKeys have been created based on `AGE`: \n\n kubectl get aeadkeys -n \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e -l cmek.security.gdc.goog/resource-name=\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e\n\nRotate default AEADKeys for a bucket\n------------------------------------\n\nIf an AEADKey for your bucket becomes compromised, you must manually rotate the key encryption keys associated with the bucket.\n\nTo start the process, you must first [refresh the active default keys](#refresh-keys). This creates new active default AEADKeys, and marks the previous key encryption keys as deactivated. After the default keys refresh, the subsequent object uploads use the new AEADKeys as the key encryption keys. The previous AEADKeys are not destroyed, so you can still decrypt existing objects that were previously encrypted using those keys.\n\nNext, follow the steps to [download and re-upload](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/upload-download-storage-objects) the objects in your bucket and [delete the old objects](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/delete-storage-objects).\n\nAfter you re-upload all the objects in your bucket, you can clean up the inactive AEADKeys and old objects. Identify the deactivated AEADKeys based on `AGE`: \n\n kubectl get aeadkeys -n \u003cvar translate=\"no\"\u003eNAMESPACE_NAME\u003c/var\u003e -l cmek.security.gdc.goog/resource-name=\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e\n\nLastly, follow the steps to [delete the AEADKeys](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/kms/create-delete-keys#delete).\n| **Note:** You can also [create a new bucket](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/create-storage-buckets) and [delete and crypto-shred the compromised bucket](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/delete-storage-buckets)."]]
