Using Stackdriver Monitoring with KMS

Stackdriver Monitoring can be used to monitor operations performed on resources in Key Management Service.

This topic provides:

  • an example for monitoring when a key version is scheduled for destruction
  • information about monitoring other KMS resources and operations

Before you begin

If you haven't already done so:

Create a counter metric

Use the gcloud logging metrics create command to create a counter metric that will monitor any occurrence of the scheduled destruction of a key version.

gcloud logging metrics create key_version_destruction \
  --description "Key version scheduled for destruction" \
  --log-filter "resource.type=cloudkms_cryptokeyversion \
  AND protoPayload.methodName=DestroyCryptoKeyVersion"

You can list your counter metrics using the gcloud logging metrics list command:

gcloud logging metrics list

For more information about creating a counter metric, including via the Google Cloud Console and the Monitoring API, see Creating a counter metric.

Create an alerting policy

Create an alert policy to send an email whenever a key version is scheduled for destruction.

  1. In the Google Cloud Console, select Monitoring, or use the following button:

    Go to Monitoring

  2. Select Alerting > Create a Policy:

  3. Click Add Condition.

  4. Under Target:

    • Click the edit box under Find resource type and metric.
    • From the dropdown list, select logging/user/key_version_destruction.

      After you select the metric from the dropdown list, the title of the condition is automatically filled in. You can change the title if desired.

  5. Under Configuration:

    • Set Condition triggers if to Any time series violates.
    • Set Condition to is above.
    • For Threshold, enter 0.
    • For For, select most recent value.

      Your Add Metric Threshold Condition page should look similar to the following:

      Create new condition

  6. Click Save.

  7. Under Notifications (optional):

    • Select Email.
    • Enter the email address to receive the notification.
    • Click Add Notification Channel.
  8. Under Documentation (optional):

    • In the edit box under Edit, type in the message to use for the notification. For example:

      A key version has been scheduled for destruction.
  9. Under Name this policy, provide a name, such as Key version scheduled for destruction.

    Your Create new alerting policy page should look similar to the following:

    Create new alert policy page

  10. Click Save.

To test your new notification, schedule a key version for destruction and then check your email to see if the notification was sent.

This alert will be triggered each time a key version has been scheduled for destruction. Note that the alert will get automatically resolved (even though the key version remains scheduled for destruction), so there will be two email notifications, one for the scheduled destruction, and one for the alert being resolved.

For more information about alert policies, see Introduction to alerting. To learn how to turn on, turn off, edit, copy, or delete an alert policy, see Managing policies.

For information about different types of notifications, see Notification options.

Monitoring administrative activities vs. data access

The scheduled destruction of a key version is an administrator activity. Administrator activities are logged automatically. If you want to create an alert for data access of a KMS resource, e.g. monitoring when a key is used for encryption, you need to enable Data Access logs and then create an alert policy as described in this topic.

For more information about logging of KMS administrative activities and data access, see Using Cloud Audit Logs with KMS.

Rate quota metrics

KMS supports the following rate quota metrics:


For information about monitoring these quotas using Stackdriver Monitoring, see Monitoring quota metrics.

Bu sayfayı yararlı buldunuz mu? Lütfen görüşünüzü bildirin:

Şunun hakkında geri bildirim gönderin...

Cloud KMS Documentation