Organízate con las colecciones
Guarda y clasifica el contenido según tus preferencias.
En esta página se explica cómo actualizar la referencia de clave externa de una clave de Cloud EKM sin rotarla. La nueva referencia de clave debe apuntar al mismo material de clave que la referencia de clave actual. Si el material de la clave se ha rotado en el sistema del partner de gestión de claves externo, debes rotar la clave.
Sigue las instrucciones de esta página si el sistema de tu partner de gestión de claves externo ha cambiado la referencia de una clave. Por ejemplo, la referencia de la clave puede cambiar si se modifica el nombre de host del partner de gestión de claves externo o si cambia la estructura de la referencia de la clave.
Roles obligatorios
Para obtener el permiso que necesitas para actualizar una referencia de clave externa, pide a tu administrador que te asigne el rol de gestión de identidades y accesos Administrador de Cloud KMS (roles/cloudkms.admin) en tu clave.
Para obtener más información sobre cómo conceder roles, consulta el artículo Gestionar el acceso a proyectos, carpetas y organizaciones.
Este rol predefinido contiene el permiso cloudkms.cryptoKeyVersions.update, que es necesario para actualizar una referencia de clave externa.
[[["Es fácil de entender","easyToUnderstand","thumb-up"],["Me ofreció una solución al problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Es difícil de entender","hardToUnderstand","thumb-down"],["La información o el código de muestra no son correctos","incorrectInformationOrSampleCode","thumb-down"],["Me faltan las muestras o la información que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-10 (UTC)."],[],[],null,["# Update external key reference\n\nThis page shows you how to update the external key reference for a\nCloud EKM key without rotating the key. The new key reference must\npoint to the same key material as the current key reference. If the key material\nhas been rotated in the external key management partner system, you must [rotate the\nkey](#rotate) instead.\n\nUse the instructions on this page if your external key management partner system has changed the\nkey reference for an existing key. For example, the key reference can\nchange as a result of a change to the hostname of the external key management partner or a\nchange in their key reference structure.\n\nRequired roles\n--------------\n\n\nTo get the permission that\nyou need to update an external key reference,\n\nask your administrator to grant you the\n\n\n[Cloud KMS Admin](/iam/docs/roles-permissions/cloudkms#cloudkms.admin) (`roles/cloudkms.admin`)\nIAM role on your key.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThis predefined role contains the\n` cloudkms.cryptoKeyVersions.update`\npermission,\nwhich is required to\nupdate an external key reference.\n\n\nYou might also be able to get\nthis permission\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\nUpdate the URI for a key version without rotation\n-------------------------------------------------\n\nTo update the key reference for a Cloud EKM key that you use over the\ninternet, complete the following steps: \n\n### Console\n\n1. \u003cbr /\u003e\n\n In the Google Cloud console, go to the\n **Key Management** page.\n\n [Go to Key Management](https://console.cloud.google.com/security/kms)\n\n \u003cbr /\u003e\n\n2. Select the key ring, and then select the key and version.\n\n3. Click *more_vert*\n **More** , and then click **View key URI**.\n\n4. Click **Update key URI**.\n\n5. Enter the new key URI, and then click **Save**.\n\n### gcloud CLI\n\nTo update the URI for the key version, use the `gcloud kms versions update`\ncommand: \n\n```sh\ngcloud kms keys versions update KEY_VERSION \\\n --key KEY_NAME \\\n --keyring KEY_RING \\\n --location LOCATION \\\n --external-key-uri NEW_KEY_URI\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eKEY_VERSION\u003c/var\u003e: the key version number.\n- \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e: the name of the key.\n- \u003cvar translate=\"no\"\u003eKEY_RING\u003c/var\u003e: the name of the key ring that contains the key.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the Cloud KMS location of the key ring.\n- \u003cvar translate=\"no\"\u003eNEW_KEY_URI\u003c/var\u003e: the new URI for the existing external key material.\n\n\u003cbr /\u003e\n\nUpdate the key path for a key version without rotation\n------------------------------------------------------\n\nTo update the key reference for a Cloud EKM key that you use over a\nVPC network, complete the following steps: \n\n### Console\n\n1. \u003cbr /\u003e\n\n In the Google Cloud console, go to the\n **Key Management** page.\n\n [Go to Key Management](https://console.cloud.google.com/security/kms)\n\n \u003cbr /\u003e\n\n2. Select the key ring, and then select the key and version.\n\n3. Click **More** *more_vert*\n then **View key path**.\n\n4. Click **Update key path**.\n\n5. Enter the new key path, then click **Save**.\n\n### gcloud CLI\n\nTo update the key path of the key version, use the `gcloud kms versions\nupdate` command: \n\n```sh\ngcloud kms keys versions update KEY_VERSION \\\n --key KEY_NAME \\\n --keyring KEY_RING \\\n --location LOCATION \\\n --ekm-connection-key-path NEW_KEY_PATH\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eKEY_VERSION\u003c/var\u003e: the key version number.\n- \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e: the name of the key.\n- \u003cvar translate=\"no\"\u003eKEY_RING\u003c/var\u003e: the name of the key ring that contains the key.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the Cloud KMS location of the key ring.\n- \u003cvar translate=\"no\"\u003eNEW_KEY_PATH\u003c/var\u003e: the new path for the existing external key material."]]
