[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間:2025-09-05 (世界標準時間)。"],[],[],null,["# Monitor state changes using Pub/Sub\n\nThis page shows you how to use [Pub/Sub](/pubsub) to create notifications on\nstate changes for Cloud KMS resources.\n\nBefore you begin\n----------------\n\nTo enable APIs, grant required permissions, and create a Pub/Sub\ntopic, follow the instructions in [Before you\nbegin](/asset-inventory/docs/monitoring-asset-changes#before_you_begin) in\n\"Monitoring asset changes\".\n\nConfigure a feed\n----------------\n\nConfigure a feed that monitors the type of changes and resources that you are\ninterested in.\n\n### Notify on all resource changes\n\nTo create a feed, use the [`gcloud asset feeds create`](/sdk/gcloud/reference/asset/feeds/create) command. \n\n```\ngcloud asset feeds create FEED_NAME \\\n --project=PROJECT_ID \\\n --asset-types=\"RESOURCE_TYPE\" \\\n --pubsub-topic=\"PUBSUB_TOPIC\"\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eFEED_NAME\u003c/var\u003e: The name to use for your Pub/Sub feed.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The ID of the Cloud KMS project you want to monitor.\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The types of resource for which you want\n to receive notifications. Use commas between resource types---for\n example,\n `cloudkms.googleapis.com/CryptoKey,cloudkms.googleapis.com/CryptoKeyVersion`.\n You can notify on any\n [supported resource\n type](/asset-inventory/docs/supported-asset-types#supported_resource_types),\n including the following:\n\n - `cloudkms.googleapis.com/CryptoKey`\n - `cloudkms.googleapis.com/CryptoKeyVersion`\n - `cloudkms.googleapis.com/EkmConnection`\n - `cloudkms.googleapis.com/ImportJob`\n - `cloudkms.googleapis.com/KeyRing`\n- \u003cvar translate=\"no\"\u003ePUBSUB_TOPIC\u003c/var\u003e: The name of the Pub/Sub topic\n you created in [Before you begin](#before-begin)\n\nThis creates a notification when resources of the indicated type are created or\nupdated. The notification indicates that the resource has been updated, but does\nnot include detailed information about the update. For example, an update\nnotification for a `CryptoKeyVersion` might mean the version was made primary or\nthat the version was scheduled for destruction. When you receive a notification\nthat a resource has been updated, you should check the resource to find its\ncurrent state.\n| **Note:** Cloud KMS does not support resource deletion. Key rings, keys, and key versions can't be deleted. The only way to fully delete Cloud KMS resources is to delete the project that contains them. Scheduling a `CryptoKeyVersion` for destruction and destruction of `CryptoKeyVersion` resources are update operations.\n\n### Notify on specific resource changes\n\nTo create a feed with a condition, use the [`gcloud asset feeds create`](/sdk/gcloud/reference/asset/feeds/create)\ncommand with the `--condition-expression` flag. \n\n```\ngcloud asset feeds create FEED_NAME \\\n --project=PROJECT_ID \\\n --asset-types=\"RESOURCE_TYPE\" \\\n --pubsub-topic=\"PUBSUB_TOPIC\" \\\n --condition-expression=\"CONDITION_EXPRESSION\"\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eFEED_NAME\u003c/var\u003e: The name to use for your Pub/Sub feed.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The ID of your Cloud KMS project.\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e: The type of resource for which you want to\n receive notifications---for example,\n `cloudkms.googleapis.com/CryptoKeyVersion`. You can notify on any\n [supported resource\n type](/asset-inventory/docs/supported-asset-types#supported_resource_types),\n including the following:\n\n - `cloudkms.googleapis.com/CryptoKey`\n - `cloudkms.googleapis.com/CryptoKeyVersion`\n - `cloudkms.googleapis.com/EkmConnection`\n - `cloudkms.googleapis.com/ImportJob`\n - `cloudkms.googleapis.com/KeyRing`\n- \u003cvar translate=\"no\"\u003ePUBSUB_TOPIC\u003c/var\u003e: The name of the Pub/Sub topic\n you created in [Before you begin](#before-begin)\n\n- \u003cvar translate=\"no\"\u003eCONDITION_EXPRESSION\u003c/var\u003e: A condition expression in [Common\n Expression Language (CEL)](https://github.com/google/cel-spec). For example,\n `\"folders/`\u003cvar translate=\"no\"\u003eFOLDER_NUMBER\u003c/var\u003e`\" in temporal_asset.asset.ancestors`\n causes the feed to only create notifications when the indicated resource is\n located within folder \u003cvar translate=\"no\"\u003eFOLDER_NUMBER\u003c/var\u003e.\n\nThis creates a notification when resources of the indicated type that match the\nspecified condition expression are created, deleted, or updated."]]