[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Encrypt data with customer-managed encryption keys\n\nBy default, Secure Source Manager encrypts customer content at\nrest. Secure Source Manager handles encryption for you without any\nadditional actions on your part. This option is called *Google default encryption*.\n\nIf you want to control your encryption keys, then you can use customer-managed encryption keys\n(CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including\nSecure Source Manager. Using Cloud KMS keys gives you control over their protection\nlevel, location, rotation schedule, usage and access permissions, and cryptographic boundaries.\n\nUsing Cloud KMS also lets\nyou [track key usage](/kms/docs/view-key-usage), view audit logs, and\ncontrol key lifecycles.\n\n\nInstead of Google owning and managing the symmetric\n[key encryption keys (KEKs)](/kms/docs/envelope-encryption#key_encryption_keys) that protect your data, you control and\nmanage these keys in Cloud KMS.\n\nAfter you set up your resources with CMEKs, the experience of accessing your\nSecure Source Manager resources is similar to using Google default encryption.\nFor more information about your encryption\noptions, see [Customer-managed encryption keys (CMEK)](/kms/docs/cmek).\n\nCloud KMS can run in a separate project\nwhere you centrally manage keys for multiple projects, or the same\nGoogle Cloud project as Secure Source Manager. To support separation of\nduties and greater control over access to keys, we recommend that you create and\nmanage keys in a separate project that doesn't include other Google Cloud\nresources.\n\n\u003cbr /\u003e\n\nYou assign a Cloud KMS key when you create an instance. You can't\nchange the encryption mechanism of an existing instance. If you have a\nCMEK-encrypted instance, you can't change the encryption mechanism to Google\ndefault encryption or assign a different Cloud Key Management Service key for encryption.\n\nThe instance must be created in the same [location](/secure-source-manager/docs/locations) as the\nCloud KMS key.\n\n\n\u003cbr /\u003e\n\nWhen you use CMEK in Secure Source Manager,\nyour projects can consume Cloud KMS cryptographic requests\nquotas.\nCMEK-encrypted instances consume these quotas at creation time.\n\nEncryption and decryption operations using CMEK keys affect Cloud KMS\nquotas only if you use hardware (Cloud HSM) or external\n(Cloud EKM) keys.\n\n\nFor more information, see\n[Cloud KMS quotas](/kms/quotas).\n\nCreate a CMEK key and grant permissions\n---------------------------------------\n\nThe following instructions explain how to create a key and grant the\nSecure Source Manager service account permissions on the key.\n\n1. In the Google Cloud project where you want to manage your keys:\n\n 1. [Enable the Cloud KMS API](https://console.cloud.google.com/flows/enableapi?apiid=cloudkms.googleapis.com&redirect=https://console.cloud.google.com).\n\n 2. Create a key ring and a key using one of the following options:\n\n - Create the [key ring](/kms/docs/create-key-ring) and [key](/secure-source-manager/docs/create-key) directly in Cloud KMS.\n - Use an externally-managed key. [Create the external key](/kms/docs/ekm-internet#create_external_key) and then [create an Cloud EKM key](/kms/docs/ekm) to make the key available through Cloud KMS.\n\n The Cloud KMS [key location](/kms/docs/locations) must match the\n [location](/secure-source-manager/docs/locations)\n of the project where you want to create the Secure Source Manager\n instance.\n2. If you are creating your first Secure Source Manager instance in your\n project, you will need to manually create the Secure Source Manager service\n agent by running the following command:\n\n gcloud beta services identity create \\\n --service=securesourcemanager.googleapis.com \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n Where \u003cvar translate=\"no\"\u003e\u003ccode translate=\"no\" dir=\"ltr\"\u003ePROJECT\u003c/code\u003e\u003c/var\u003e is the project ID of the project where you\n will create your Secure Source Manager instance.\n\n Once you create the per-product, per-project service account (P4SA) - you\n must grant the Secure Source Manager Service Agent role\n (`roles/securesourcemanager.serviceAgent`) to principal\n service-PROJECT-NUMBER@gcp-sa-sourcemanager.iam.gserviceaccount.com\n or the instance creation will fail.\n3. Grant the [CryptoKey Encrypter/Decrypter IAM role](/iam/docs/understanding-roles#cloud-kms-roles)\n (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) to the Secure Source Manager\n service account. Grant this permission on the key you created.\n\n ### Console\n\n 1. Go to the **Key management** page.\n\n [Go to Key Management](https://console.cloud.google.com/security/kms)\n 2. Select the key ring you want to use, open the **Key ring details**\n page, then select the key you created.\n\n 3. Grant access to the Secure Source Manager service account:\n\n 1. Click **ADD PRINCIPLE**.\n 2. Add the Secure Source Manager service account. The service account is **service-\u003cvar translate=\"no\"\u003ePROJECT-NUMBER\u003c/var\u003e@gcp-sa-sourcemanager.iam.gserviceaccount.com** , where \u003cvar translate=\"no\"\u003ePROJECT-NUMBER\u003c/var\u003e is the [project number](/resource-manager/docs/creating-managing-projects#identifying_projects) of the Google Cloud project where Secure Source Manager is enabled.\n 3. In **Select a role** , select **Cloud KMS** \\\u003e **Cloud KMS CryptoKey Encrypter/Decrypter**.\n 4. Click **SAVE**.\n 4. Repeat the previous step to grant access to the account that will\n create the Secure Source Manager instance.\n\n 5. Return to the **[Key management](https://console.cloud.google.com/security/kms)**\n page, select your key ring and open the **Key ring details**\n page. Then select the key again.\n\n 6. Select the **SHOW INFO PANEL** . You should see roles on the\n **Role/Member** column.\n\n ### gcloud\n\n 1. Run the following command to grant access to the\n Secure Source Manager service account:\n\n gcloud kms keys add-iam-policy-binding [--project=\u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e] \\\n \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e --location \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e --keyring=\u003cvar translate=\"no\"\u003eKEY_RING\u003c/var\u003e \\\n --member serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-sourcemanager.iam.gserviceaccount.com \\\n --role roles/cloudkms.cryptoKeyEncrypterDecrypter\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the ID of the project that contains the key\n - \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e: the key name\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the key location. The [key location](/kms/docs/locations) must match the [location](/secure-source-manager/docs/locations) of the project where you want to deploy a Secure Source Manager instance\n - \u003cvar translate=\"no\"\u003eKEY_RING\u003c/var\u003e: the key ring name\n - \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the [project number](/resource-manager/docs/creating-managing-projects#identifying_projects) of the Google Cloud project with Secure Source Manager enabled\n 2. Repeat the previous step to grant access to the account that will\n create the Secure Source Manager instance.\n\n For more information about this command see the\n [gcloud kms keys add-iam-policy-binding](/sdk/gcloud/reference/kms/keys/add-iam-policy-binding)\n documentation.\n\nRemove access\n-------------\n\nThere are several ways to remove access to a CMEK-encrypted repository:\n\n- Revoke the Cloud KMS CryptoKey Encrypter/Decrypter [role](/kms/docs/reference/permissions-and-roles#predefined_roles) from the **Secure Source Manager service account** using the [Google Cloud console](/iam/docs/granting-changing-revoking-access#revoke_access) or the [gcloud CLI](/iam/docs/granting-changing-revoking-access#revoking-gcloud-manual).\n- [Temporarily disable](/kms/docs/enable-disable#disable_an_enabled_key_version) the CMEK key.\n- [Permanently destroy](/kms/docs/destroy-restore#schedule_a_key_version_for_destruction_destroy_a_key_version) the CMEK key.\n\nWe recommend that you revoke the permissions from the Secure Source Manager\nservice account before disabling or destroying a key. Changes to permissions are\nconsistent within seconds, so you can observe the impacts of disabling or\ndestroying a key.\n\nWhen you disable or destroy the encryption key for an instance, you lose the\nability to view or retrieve data from the instance. All data stored in the\ninstance becomes inaccessible, including code history, pull requests, and\nissues.\n\nUsers with the Secure Source Manager Instance Manager [role](/secure-source-manager/docs/access-control#pre-defined_roles)\nor Instance Owner role can delete the instance.\n\nCMEK organization policies\n--------------------------\n\nSecure Source Manager supports [organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints)\nthat can require CMEK protection.\n\nPolicies can limit which Cloud KMS CryptoKeys can be used for\nCMEK protection.\n\n- When Secure Source Manager API is in the `Deny` policy list of services of\n constraint `constraints/gcp.restrictNonCmekServices`, Secure Source Manager\n refuses to create new instances that aren't CMEK-protected.\n\n- When `constraints/gcp.restrictCmekCryptoKeyProjects` is configured,\n Secure Source Manager creates CMEK-protected instances that are\n protected by a CryptoKey from an allowed project, folder, or organization.\n\nFor more about configuring organization policies, see\n[CMEK organization policies](/kms/docs/cmek-org-policy).\n\nWhat's next?\n------------\n\n- [Deploy an instance encrypted with CMEK](/secure-source-manager/docs/deploy-access-instance#api)\n- Learn more about [CMEK](/kms/docs/cmek)\n- Learn more about [Google default encryption](/security/encryption/default-encryption)"]]
