Restez organisé à l'aide des collections
Enregistrez et classez les contenus selon vos préférences.
Créer des clés de chiffrement avec Cloud KMS
Ce guide de démarrage rapide vous explique comment créer et utiliser des clés de chiffrement avec Cloud Key Management Service dans un projet dont vous êtes propriétaire. Ces instructions utilisent la consoleGoogle Cloud pour créer des trousseaux de clés, des clés et des versions de clés dans Cloud KMS. Pour obtenir des instructions utilisant d'autres méthodes, consultez Présentation d'Autokey, Créer un trousseau de clés et Créer une clé.
Dans ce démarrage rapide, les requêtes sont envoyées à l'API Cloud KMS via la ligne de commande. Pour afficher des exemples de programmation où les requêtes sont envoyées à l'API Cloud KMS via des bibliothèques clientes, consultez la page Chiffrer et déchiffrer.
Avant de commencer
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Pour initialiser la gcloud CLI, exécutez la commande suivante :
gcloudinit
Trousseaux de clés et clés
Pour chiffrer et déchiffrer du contenu, vous avez besoin d'une clé Cloud KMS qui fait partie d'un trousseau de clés.
Créez un trousseau de clés nommé test et une clé nommée quickstart. Consultez la présentation de la hiérarchie des objets pour plus d'informations sur ces objets et sur leurs relations.
NAME PURPOSE PRIMARY_STATE
projects/PROJECT_ID/locations/global/keyRings/test/cryptoKeys/quickstart ENCRYPT_DECRYPT ENABLED
Chiffrer des données
Maintenant que vous avez une clé, vous pouvez vous en servir pour chiffrer un texte ou un contenu binaire.
Stockez du texte à chiffrer dans un fichier nommé "mysecret.txt".
echo-n"Some text to be encrypted" > mysecret.txt
Pour chiffrer les données avec gcloud kms encrypt, fournissez les informations relatives à votre clé et spécifiez le nom du fichier texte à chiffrer ainsi que celui du fichier qui contiendra les contenus chiffrés :
La méthode encrypt enregistre vos contenus chiffrés dans le fichier spécifié par l'indicateur --ciphertext-file.
Déchiffrer le texte chiffré
Pour chiffrer les données avec gcloud kms decrypt, fournissez les informations relatives à votre clé et spécifiez le nom du fichier texte chiffré (fichier ciphertext) à déchiffrer ainsi que celui du fichier qui contiendra les contenus déchiffrés :
Sauf indication contraire, le contenu de cette page est régi par une licence Creative Commons Attribution 4.0, et les échantillons de code sont régis par une licence Apache 2.0. Pour en savoir plus, consultez les Règles du site Google Developers. Java est une marque déposée d'Oracle et/ou de ses sociétés affiliées.
Dernière mise à jour le 2025/09/05 (UTC).
[[["Facile à comprendre","easyToUnderstand","thumb-up"],["J'ai pu résoudre mon problème","solvedMyProblem","thumb-up"],["Autre","otherUp","thumb-up"]],[["Difficile à comprendre","hardToUnderstand","thumb-down"],["Informations ou exemple de code incorrects","incorrectInformationOrSampleCode","thumb-down"],["Il n'y a pas l'information/les exemples dont j'ai besoin","missingTheInformationSamplesINeed","thumb-down"],["Problème de traduction","translationIssue","thumb-down"],["Autre","otherDown","thumb-down"]],["Dernière mise à jour le 2025/09/05 (UTC)."],[],[],null,["Create encryption keys with Cloud KMS This quickstart shows you how to create and use encryption keys with\nCloud Key Management Service in a project you own. These instructions use the\nGoogle Cloud console to create key rings, keys, and key versions in\nCloud KMS. For instructions that use other methods,\nsee [Autokey overview](/kms/docs/autokey-overview), [Create a key\nring](/kms/docs/create-key-ring), and [Create a key](/kms/docs/create-key).\n\nThis quickstart uses the command line to send requests to the\nCloud KMS API. For programming examples that use the client\nlibraries to send requests to the Cloud KMS API, see [Encrypting\nand Decrypting](/kms/docs/encrypt-decrypt).\n\nBefore you begin\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Cloud KMS API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=cloudkms.googleapis.com&redirect=https://console.cloud.google.com)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Cloud KMS API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=cloudkms.googleapis.com&redirect=https://console.cloud.google.com)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n\u003cbr /\u003e\n\n| **Important:** This quickstart creates Cloud KMS resources such as key rings and keys. Once created, these resources cannot be deleted. For more information, see [Why can't I delete keys or key rings?](/kms/docs/faq#cannot_delete).\n\nKey rings and keys\n\nTo encrypt and decrypt content you will need a Cloud KMS key, which\nis part of a key ring.\n\nCreate a key ring named `test`, and a key named `quickstart`. Refer to the\n[object hierarchy overview](/kms/docs/object-hierarchy) for more\ninformation about these objects and how they are related. \n\n gcloud kms keyrings create \"test\" \\\n --location \"global\"\n\n gcloud kms keys create \"quickstart\" \\\n --location \"global\" \\\n --keyring \"test\" \\\n --purpose \"encryption\"\n\nYou can use the `list` option to view the name and metadata for the key that you\njust created. \n\n gcloud kms keys list \\\n --location \"global\" \\\n --keyring \"test\"\n\nYou should see: \n\n```\nNAME PURPOSE PRIMARY_STATE\nprojects/PROJECT_ID/locations/global/keyRings/test/cryptoKeys/quickstart ENCRYPT_DECRYPT ENABLED\n```\n\nEncrypt data\n\nNow that you have a key, you can use that key to encrypt text or binary\ncontent.\n\nStore some text to be encrypted in a file called \"mysecret.txt\". \n\n echo -n \"Some text to be encrypted\" \u003e mysecret.txt\n\nTo encrypt the data with `gcloud kms encrypt`, provide your key information,\nspecify the name of the plaintext file to encrypt, and specify the name of the\nfile that will contain the encrypted content: \n\n gcloud kms encrypt \\\n --location \"global\" \\\n --keyring \"test\" \\\n --key \"quickstart\" \\\n --plaintext-file ./mysecret.txt \\\n --ciphertext-file ./mysecret.txt.encrypted\n\nThe `encrypt` method saves your encrypted content in the file specified by the\n`--ciphertext-file` flag.\n\nDecrypt ciphertext\n\nTo decrypt the data with `gcloud kms decrypt`, provide your key information,\nspecify the name of the encrypted file (ciphertext file) to decrypt, and specify\nthe name of the file that will contain the decrypted content: \n\n gcloud kms decrypt \\\n --location \"global\" \\\n --keyring \"test\" \\\n --key \"quickstart\" \\\n --ciphertext-file ./mysecret.txt.encrypted \\\n --plaintext-file ./mysecret.txt.decrypted\n\nThe `decrypt` method saves your decrypted content in the file specified by the\n`--plaintext-file` flag.\n\nTo decrypt encrypted content, you must use the same key that was\nused to encrypt the content.\n\nClean up\n\n\nTo avoid incurring charges to your Google Cloud account for\nthe resources used on this page, follow these steps.\n\nList the versions available for your key: \n\n gcloud kms keys versions list \\\n --location \"global\" \\\n --keyring \"test\" \\\n --key \"quickstart\"\n\nTo destroy a version, run the following command, where `1` is the number\nof the key version that you want to destroy:\n**Important:** When you destroy a key version, you can no longer decrypt content that was encrypted using that version of the key. Make sure that you no longer need a key version before you destroy it. \n\n```\ngcloud kms keys versions destroy 1 \\\n --location \"global\" \\\n --keyring \"test\" \\\n --key \"quickstart\"\n```\n\nWhat's next\n\n- Start [using the API](/kms/docs/accessing-the-api).\n- Take a look at the [API Reference](/kms/docs/reference/rest).\n- Learn more about how to [encrypt data at\n rest](https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms)."]]
