Google은 모든 언어와 플랫폼에서 편리하게 Cloud KMS에 액세스할 수 있도록 노력을 지속할 것입니다. 개선이 필요한 부분이 있다면 알려주세요.
플랫폼
클라이언트에서 API에 액세스하는 방법은 코드가 실행 중인 플랫폼에 따라, 특히 인증과 관련하여 다소 다를 수 있습니다.
Google 애플리케이션 기본 사용자 인증 정보는 이러한 차이점 대부분을 무시하지만 여전히 유의해야 할 몇 가지 사항이 있습니다. 인증에 대한 자세한 내용은 인증 개요를 참조하세요.
Compute Engine 및 Google Kubernetes Engine
Google Kubernetes Engine 노드를 포함하여 Compute Engine에서 실행되는 소프트웨어는 일반적으로 연결된 서비스 계정을 사용하여 환경에 자동으로 프로비저닝되는 사용자 인증 정보로 인증합니다. Cloud KMS에서도 마찬가지입니다. 인스턴스를 만들 때 https://www.googleapis.com/auth/cloudkms(최소 권한의 원칙에 따르므로 선호) 또는 https://www.googleapis.com/auth/cloud-platform OAuth 범위에 대한 액세스 권한을 부여해야 합니다.
App Engine 서비스 계정(PROJECT_ID@appspot.gserviceaccount.com)에 키를 관리하거나 사용할 수 있는 ID 및 액세스 관리 권한을 부여합니다.
애플리케이션 기본 사용자 인증 정보를 사용하고 https://www.googleapis.com/auth/cloudkms 범위를 지정합니다. https://www.googleapis.com/auth/cloud-platform 범위를 지정할 수도 있지만 Cloud KMS보다 더 넓은 범위가 포함됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-04-21(UTC)"],[],[],null,["# Accessing the API\n\nWe recommend that you access Cloud Key Management Service via our high performance\n[Google API Client Libraries](/kms/docs/reference/libraries). These libraries,\nwhich connect to the Cloud KMS gRPC API, are provided in several\npopular programming languages.\n\nYou may also access Cloud KMS via our [REST\nAPI](/kms/docs/reference/rest). Thus, any language that supports sending HTTP\nrequests can access the API. However, most users will prefer a more idiomatic\nclient library.\n\nThere is also a web-based interface for\n[Cloud KMS on the Google Cloud console](https://console.cloud.google.com/security/kms), which allows for\nkey management operations. Encrypt and decrypt operations cannot be performed\nfrom the web interface.\n\nWe want to make accessing Cloud KMS a joy from every language and\nplatform, and work on that will be ongoing. If we're falling short in any way,\n[let us know](/kms/docs/support).\n\nPlatforms\n---------\n\nHow clients access the API may vary a bit depending on the platform on which the\ncode is running, particularly with respect to authentication.\n[Google Application Default Credentials](/docs/authentication/provide-credentials-adc) abstract away many of\nthe differences, but there are still some things to keep in mind. For more\ninformation about authentication, see the\n[authentication overview](/docs/authentication).\n\n### Compute Engine and Google Kubernetes Engine\n\nSoftware running on [Compute Engine](/compute), including Google Kubernetes Engine nodes,\ntypically authenticates using credentials automatically provisioned into the\nenvironment using the [attached service account](/compute/docs/access/create-enable-service-accounts-for-instances). The\nsame is true for Cloud KMS. Ensure that when you create an\ninstance, you give it access to the `https://www.googleapis.com/auth/cloudkms`\n(preferred because it supports the principle of least privilege) or\n`https://www.googleapis.com/auth/cloud-platform` OAuth scope.\n\nFor example: \n\n```\ngcloud compute instances create \"instance-1\" \\\n --zone \"us-east1-b\" \\\n --scopes \"https://www.googleapis.com/auth/cloudkms\"\n```\n\nFor more information, refer to the\n[Compute Engine documentation](/compute/docs/access/create-enable-service-accounts-for-instances#using) or the\n[GKE documentation](/kubernetes-engine/docs/how-to/role-based-access-control).\n\n### App Engine\n\nTo use Cloud KMS with App Engine:\n\n1. Give your App Engine service account (\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`@appspot.gserviceaccount.com`) [Identity and Access Management permissions](/kms/docs/iam) to manage and/or use your keys.\n2. Use the [Application Default Credentials](/docs/authentication/provide-credentials-adc), and specify the scope `https://www.googleapis.com/auth/cloudkms`. You can also specify the scope `https://www.googleapis.com/auth/cloud-platform`, but it includes broader scopes than just Cloud KMS.\n\nFor more information, refer to\n[Accessing the API](/appengine/docs/admin-api/accessing-the-api) and\n[Controlling access](/appengine/docs/admin-api/access-control)\nin the App Engine documentation.\n\n### Client authentication\n\nIf your application needs to authenticate your users directly, you can obtain\nand use credentials on their behalf. To learn more, see\n[User accounts](https://cloud.google.com/docs/authentication/use-cases#app-users)."]]
