기본적으로 Secure Source Manager는 저장된 고객 콘텐츠를 암호화합니다. Secure Source Manager는 사용자의 추가 작업 없이 자동으로 암호화를 처리합니다. 이 옵션을 Google 기본 암호화라고 합니다.
암호화 키를 제어하려면 Secure Source Manager를 포함한 CMEK 통합 서비스와 함께 Cloud KMS에서 고객 관리 암호화 키(CMEK)를 사용하면 됩니다. Cloud KMS 키를 사용하면 보호 수준, 위치, 순환 일정, 사용 및 액세스 권한, 암호화 경계를 관리할 수 있습니다.
Cloud KMS를 사용하면 키 사용을 추적하고 감사 로그를 보며 키 수명 주기를 제어할 수도 있습니다.
Google에서 데이터를 보호하는 대칭 키 암호화 키(KEK)를 소유하고 관리하는 대신 사용자가 Cloud KMS에서 이러한 키를 제어하고 관리할 수 있습니다.
CMEK로 리소스를 설정한 후 Secure Source Manager 리소스에 액세스하는 환경은 Google 기본 암호화를 사용하는 것과 유사합니다.
암호화 옵션에 대한 자세한 내용은 고객 관리 암호화 키(CMEK)를 참조하세요.
Cloud KMS는 여러 프로젝트의 키를 중앙에서 관리하는 별도의 프로젝트에서 또는 Secure Source Manager와 동일한Google Cloud 프로젝트에서 실행할 수 있습니다. 업무 분장을 지원하고 키에 대한 액세스 권한을 더 효과적으로 제어하려면 다른 Google Cloud리소스가 포함되지 않은 별도의 프로젝트에서 키를 만들고 관리하는 것이 좋습니다.
인스턴스를 만들 때 Cloud KMS 키를 할당합니다. 기존 인스턴스의 암호화 메커니즘은 변경할 수 없습니다. CMEK로 암호화된 인스턴스가 있는 경우 암호화 메커니즘을 Google 기본 암호화로 변경하거나 암호화에 다른 Cloud Key Management Service 키를 할당할 수 없습니다.
Secure Source Manager에서 CMEK를 사용하는 경우 프로젝트에서 Cloud KMS 암호화 요청 할당량을 사용할 수 있습니다.
CMEK로 암호화된 인스턴스는 생성 시 이러한 할당량을 사용합니다.
CMEK 키를 사용하는 암호화 및 복호화 작업은 하드웨어 (Cloud HSM) 또는 외부(Cloud EKM) 키를 사용하는 경우에만 Cloud KMS 할당량에 영향을 미칩니다.
자세한 내용은 Cloud KMS 할당량을 참고하세요.
CMEK 키 만들기 및 권한 부여
다음 안내에서는 키를 만들고 Secure Source Manager 서비스 계정에 키에 대한 권한을 부여하는 방법을 설명합니다.
여기서 PROJECT는 Secure Source Manager 인스턴스를 만들 프로젝트의 프로젝트 ID입니다.
제품별, 프로젝트별 서비스 계정 (P4SA)을 만든 후에는 보안 소스 관리자 서비스 에이전트 역할(roles/securesourcemanager.serviceAgent)을 주 구성원 service-PROJECT-NUMBER@gcp-sa-sourcemanager.iam.gserviceaccount.com에 부여해야 합니다. 그렇지 않으면 인스턴스 생성이 실패합니다.
Secure Source Manager 서비스 계정에 CryptoKey 암호화/복호화 IAM 역할(roles/cloudkms.cryptoKeyEncrypterDecrypter)을 부여합니다. 만든 키에 대해 이 권한을 부여합니다.
Secure Source Manager 서비스 계정을 추가합니다. 서비스 계정은 service-PROJECT-NUMBER@gcp-sa-sourcemanager.iam.gserviceaccount.com입니다. 여기서 PROJECT-NUMBER는 Secure Source Manager가 사용 설정된 Google Cloud 프로젝트의 프로젝트 번호입니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Encrypt data with customer-managed encryption keys\n\nBy default, Secure Source Manager encrypts customer content at\nrest. Secure Source Manager handles encryption for you without any\nadditional actions on your part. This option is called *Google default encryption*.\n\nIf you want to control your encryption keys, then you can use customer-managed encryption keys\n(CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including\nSecure Source Manager. Using Cloud KMS keys gives you control over their protection\nlevel, location, rotation schedule, usage and access permissions, and cryptographic boundaries.\n\nUsing Cloud KMS also lets\nyou [track key usage](/kms/docs/view-key-usage), view audit logs, and\ncontrol key lifecycles.\n\n\nInstead of Google owning and managing the symmetric\n[key encryption keys (KEKs)](/kms/docs/envelope-encryption#key_encryption_keys) that protect your data, you control and\nmanage these keys in Cloud KMS.\n\nAfter you set up your resources with CMEKs, the experience of accessing your\nSecure Source Manager resources is similar to using Google default encryption.\nFor more information about your encryption\noptions, see [Customer-managed encryption keys (CMEK)](/kms/docs/cmek).\n\nCloud KMS can run in a separate project\nwhere you centrally manage keys for multiple projects, or the same\nGoogle Cloud project as Secure Source Manager. To support separation of\nduties and greater control over access to keys, we recommend that you create and\nmanage keys in a separate project that doesn't include other Google Cloud\nresources.\n\n\u003cbr /\u003e\n\nYou assign a Cloud KMS key when you create an instance. You can't\nchange the encryption mechanism of an existing instance. If you have a\nCMEK-encrypted instance, you can't change the encryption mechanism to Google\ndefault encryption or assign a different Cloud Key Management Service key for encryption.\n\nThe instance must be created in the same [location](/secure-source-manager/docs/locations) as the\nCloud KMS key.\n\n\n\u003cbr /\u003e\n\nWhen you use CMEK in Secure Source Manager,\nyour projects can consume Cloud KMS cryptographic requests\nquotas.\nCMEK-encrypted instances consume these quotas at creation time.\n\nEncryption and decryption operations using CMEK keys affect Cloud KMS\nquotas only if you use hardware (Cloud HSM) or external\n(Cloud EKM) keys.\n\n\nFor more information, see\n[Cloud KMS quotas](/kms/quotas).\n\nCreate a CMEK key and grant permissions\n---------------------------------------\n\nThe following instructions explain how to create a key and grant the\nSecure Source Manager service account permissions on the key.\n\n1. In the Google Cloud project where you want to manage your keys:\n\n 1. [Enable the Cloud KMS API](https://console.cloud.google.com/flows/enableapi?apiid=cloudkms.googleapis.com&redirect=https://console.cloud.google.com).\n\n 2. Create a key ring and a key using one of the following options:\n\n - Create the [key ring](/kms/docs/create-key-ring) and [key](/secure-source-manager/docs/create-key) directly in Cloud KMS.\n - Use an externally-managed key. [Create the external key](/kms/docs/ekm-internet#create_external_key) and then [create an Cloud EKM key](/kms/docs/ekm) to make the key available through Cloud KMS.\n\n The Cloud KMS [key location](/kms/docs/locations) must match the\n [location](/secure-source-manager/docs/locations)\n of the project where you want to create the Secure Source Manager\n instance.\n2. If you are creating your first Secure Source Manager instance in your\n project, you will need to manually create the Secure Source Manager service\n agent by running the following command:\n\n gcloud beta services identity create \\\n --service=securesourcemanager.googleapis.com \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n\n Where \u003cvar translate=\"no\"\u003e\u003ccode translate=\"no\" dir=\"ltr\"\u003ePROJECT\u003c/code\u003e\u003c/var\u003e is the project ID of the project where you\n will create your Secure Source Manager instance.\n\n Once you create the per-product, per-project service account (P4SA) - you\n must grant the Secure Source Manager Service Agent role\n (`roles/securesourcemanager.serviceAgent`) to principal\n service-PROJECT-NUMBER@gcp-sa-sourcemanager.iam.gserviceaccount.com\n or the instance creation will fail.\n3. Grant the [CryptoKey Encrypter/Decrypter IAM role](/iam/docs/understanding-roles#cloud-kms-roles)\n (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) to the Secure Source Manager\n service account. Grant this permission on the key you created.\n\n ### Console\n\n 1. Go to the **Key management** page.\n\n [Go to Key Management](https://console.cloud.google.com/security/kms)\n 2. Select the key ring you want to use, open the **Key ring details**\n page, then select the key you created.\n\n 3. Grant access to the Secure Source Manager service account:\n\n 1. Click **ADD PRINCIPLE**.\n 2. Add the Secure Source Manager service account. The service account is **service-\u003cvar translate=\"no\"\u003ePROJECT-NUMBER\u003c/var\u003e@gcp-sa-sourcemanager.iam.gserviceaccount.com** , where \u003cvar translate=\"no\"\u003ePROJECT-NUMBER\u003c/var\u003e is the [project number](/resource-manager/docs/creating-managing-projects#identifying_projects) of the Google Cloud project where Secure Source Manager is enabled.\n 3. In **Select a role** , select **Cloud KMS** \\\u003e **Cloud KMS CryptoKey Encrypter/Decrypter**.\n 4. Click **SAVE**.\n 4. Repeat the previous step to grant access to the account that will\n create the Secure Source Manager instance.\n\n 5. Return to the **[Key management](https://console.cloud.google.com/security/kms)**\n page, select your key ring and open the **Key ring details**\n page. Then select the key again.\n\n 6. Select the **SHOW INFO PANEL** . You should see roles on the\n **Role/Member** column.\n\n ### gcloud\n\n 1. Run the following command to grant access to the\n Secure Source Manager service account:\n\n gcloud kms keys add-iam-policy-binding [--project=\u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e] \\\n \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e --location \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e --keyring=\u003cvar translate=\"no\"\u003eKEY_RING\u003c/var\u003e \\\n --member serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-sourcemanager.iam.gserviceaccount.com \\\n --role roles/cloudkms.cryptoKeyEncrypterDecrypter\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the ID of the project that contains the key\n - \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e: the key name\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the key location. The [key location](/kms/docs/locations) must match the [location](/secure-source-manager/docs/locations) of the project where you want to deploy a Secure Source Manager instance\n - \u003cvar translate=\"no\"\u003eKEY_RING\u003c/var\u003e: the key ring name\n - \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the [project number](/resource-manager/docs/creating-managing-projects#identifying_projects) of the Google Cloud project with Secure Source Manager enabled\n 2. Repeat the previous step to grant access to the account that will\n create the Secure Source Manager instance.\n\n For more information about this command see the\n [gcloud kms keys add-iam-policy-binding](/sdk/gcloud/reference/kms/keys/add-iam-policy-binding)\n documentation.\n\nRemove access\n-------------\n\nThere are several ways to remove access to a CMEK-encrypted repository:\n\n- Revoke the Cloud KMS CryptoKey Encrypter/Decrypter [role](/kms/docs/reference/permissions-and-roles#predefined_roles) from the **Secure Source Manager service account** using the [Google Cloud console](/iam/docs/granting-changing-revoking-access#revoke_access) or the [gcloud CLI](/iam/docs/granting-changing-revoking-access#revoking-gcloud-manual).\n- [Temporarily disable](/kms/docs/enable-disable#disable_an_enabled_key_version) the CMEK key.\n- [Permanently destroy](/kms/docs/destroy-restore#schedule_a_key_version_for_destruction_destroy_a_key_version) the CMEK key.\n\nWe recommend that you revoke the permissions from the Secure Source Manager\nservice account before disabling or destroying a key. Changes to permissions are\nconsistent within seconds, so you can observe the impacts of disabling or\ndestroying a key.\n\nWhen you disable or destroy the encryption key for an instance, you lose the\nability to view or retrieve data from the instance. All data stored in the\ninstance becomes inaccessible, including code history, pull requests, and\nissues.\n\nUsers with the Secure Source Manager Instance Manager [role](/secure-source-manager/docs/access-control#pre-defined_roles)\nor Instance Owner role can delete the instance.\n\nCMEK organization policies\n--------------------------\n\nSecure Source Manager supports [organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints)\nthat can require CMEK protection.\n\nPolicies can limit which Cloud KMS CryptoKeys can be used for\nCMEK protection.\n\n- When Secure Source Manager API is in the `Deny` policy list of services of\n constraint `constraints/gcp.restrictNonCmekServices`, Secure Source Manager\n refuses to create new instances that aren't CMEK-protected.\n\n- When `constraints/gcp.restrictCmekCryptoKeyProjects` is configured,\n Secure Source Manager creates CMEK-protected instances that are\n protected by a CryptoKey from an allowed project, folder, or organization.\n\nFor more about configuring organization policies, see\n[CMEK organization policies](/kms/docs/cmek-org-policy).\n\nWhat's next?\n------------\n\n- [Deploy an instance encrypted with CMEK](/secure-source-manager/docs/deploy-access-instance#api)\n- Learn more about [CMEK](/kms/docs/cmek)\n- Learn more about [Google default encryption](/security/encryption/default-encryption)"]]
