이 페이지에서는 키를 순환하지 않고 Cloud EKM 키의 외부 키 참조를 업데이트하는 방법을 보여줍니다. 새 키 참조는 현재 키 참조와 동일한 키 자료를 가리켜야 합니다. 키 자료가 외부 키 관리 파트너 시스템에서 순환되었다면 대신 키를 순환해야 합니다.
외부 키 관리 파트너 시스템이 기존 키의 키 경로 또는 키 URI를 변경한 경우 이 페이지의 안내를 따르세요. 예를 들어 외부 키 관리 파트너의 호스트 이름 변경 또는 키 참조 구조 변경으로 인해 키 참조가 변경될 수 있습니다.
필요한 역할
외부 키 참조를 업데이트하는 데 필요한 권한을 얻으려면 관리자에게 키에 대한 Cloud KMS 관리자(roles/cloudkms.admin) IAM 역할을 부여해 달라고 요청하세요.
역할 부여에 대한 자세한 내용은 프로젝트, 폴더, 조직에 대한 액세스 관리를 참조하세요.
이 사전 정의된 역할에는 외부 키 참조를 업데이트하는 데 필요한 cloudkms.cryptoKeyVersions.update 권한이 포함되어 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[],[],null,["# Update external key reference\n\nThis page shows you how to update the external key reference for a\nCloud EKM key without rotating the key. The new key reference must\npoint to the same key material as the current key reference. If the key material\nhas been rotated in the external key management partner system, you must [rotate the\nkey](#rotate) instead.\n\nUse the instructions on this page if your external key management partner system has changed the\nkey reference for an existing key. For example, the key reference can\nchange as a result of a change to the hostname of the external key management partner or a\nchange in their key reference structure.\n\nRequired roles\n--------------\n\n\nTo get the permission that\nyou need to update an external key reference,\n\nask your administrator to grant you the\n\n\n[Cloud KMS Admin](/iam/docs/roles-permissions/cloudkms#cloudkms.admin) (`roles/cloudkms.admin`)\nIAM role on your key.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThis predefined role contains the\n` cloudkms.cryptoKeyVersions.update`\npermission,\nwhich is required to\nupdate an external key reference.\n\n\nYou might also be able to get\nthis permission\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\nUpdate the URI for a key version without rotation\n-------------------------------------------------\n\nTo update the key reference for a Cloud EKM key that you use over the\ninternet, complete the following steps: \n\n### Console\n\n1. \u003cbr /\u003e\n\n In the Google Cloud console, go to the\n **Key Management** page.\n\n [Go to Key Management](https://console.cloud.google.com/security/kms)\n\n \u003cbr /\u003e\n\n2. Select the key ring, and then select the key and version.\n\n3. Click *more_vert*\n **More** , and then click **View key URI**.\n\n4. Click **Update key URI**.\n\n5. Enter the new key URI, and then click **Save**.\n\n### gcloud CLI\n\nTo update the URI for the key version, use the `gcloud kms versions update`\ncommand: \n\n```sh\ngcloud kms keys versions update KEY_VERSION \\\n --key KEY_NAME \\\n --keyring KEY_RING \\\n --location LOCATION \\\n --external-key-uri NEW_KEY_URI\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eKEY_VERSION\u003c/var\u003e: the key version number.\n- \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e: the name of the key.\n- \u003cvar translate=\"no\"\u003eKEY_RING\u003c/var\u003e: the name of the key ring that contains the key.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the Cloud KMS location of the key ring.\n- \u003cvar translate=\"no\"\u003eNEW_KEY_URI\u003c/var\u003e: the new URI for the existing external key material.\n\n\u003cbr /\u003e\n\nUpdate the key path for a key version without rotation\n------------------------------------------------------\n\nTo update the key reference for a Cloud EKM key that you use over a\nVPC network, complete the following steps: \n\n### Console\n\n1. \u003cbr /\u003e\n\n In the Google Cloud console, go to the\n **Key Management** page.\n\n [Go to Key Management](https://console.cloud.google.com/security/kms)\n\n \u003cbr /\u003e\n\n2. Select the key ring, and then select the key and version.\n\n3. Click **More** *more_vert*\n then **View key path**.\n\n4. Click **Update key path**.\n\n5. Enter the new key path, then click **Save**.\n\n### gcloud CLI\n\nTo update the key path of the key version, use the `gcloud kms versions\nupdate` command: \n\n```sh\ngcloud kms keys versions update KEY_VERSION \\\n --key KEY_NAME \\\n --keyring KEY_RING \\\n --location LOCATION \\\n --ekm-connection-key-path NEW_KEY_PATH\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eKEY_VERSION\u003c/var\u003e: the key version number.\n- \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e: the name of the key.\n- \u003cvar translate=\"no\"\u003eKEY_RING\u003c/var\u003e: the name of the key ring that contains the key.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the Cloud KMS location of the key ring.\n- \u003cvar translate=\"no\"\u003eNEW_KEY_PATH\u003c/var\u003e: the new path for the existing external key material."]]
