이 문서에서는 Spanner에서 고객 관리 암호화 키(CMEK) 및 데이터 상주 조직 정책 위반 문제를 해결하는 방법을 설명합니다. 데이터베이스 Fleet을 모니터링할 수 있도록 데이터베이스 센터에서는 다음 상태 점검을 사용하여 CMEK 및 데이터 상주 조직 정책 위반을 감지합니다.
암호화 조직 정책이 충족되지 않음 위반은 Spanner 데이터베이스의 CMEK 조직 정책이 충족되지 않음을 나타냅니다.
위치 조직 정책을 충족하지 않음 위반은 데이터베이스가 조직 정책에서 허용하지 않는 리전에 있음을 나타냅니다. 허용된 리전에서 데이터베이스가 생성되었지만 데이터베이스가 생성된 후 조직 정책에서 해당 리전을 허용하지 않는 경우에 이 문제가 발생할 수 있습니다.
데이터베이스 센터에 이 위반이 표시되면 이 문서의 주제를 사용하여 문제를 해결하세요. 데이터베이스 센터에 대해 자세히 알아보려면 데이터베이스 센터 개요를 참고하세요.
CMEK 위반 문제 해결
데이터베이스 센터에서 Spanner 데이터베이스에 암호화 조직 정책을 충족하지 않음 위반이 발생하면 위반이 발생한 데이터베이스의 백업에서 새 데이터베이스를 만들어야 합니다. Spanner의 CMEK에 대해 자세히 알아보려면 CMEK 개요를 참고하세요. Cloud Key Management Service의 CMEK에 대해 자세히 알아보려면 고객 관리 암호화 키를 참고하세요. 백업에서 새 데이터베이스를 만들려면 다음 단계를 따르세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-10(UTC)"],[],[],null,["This document describes how to troubleshoot customer-managed encryption key\n(CMEK) and data residency organization policy violations in\nSpanner. To help you monitor your database fleet,\nDatabase Center detects CMEK and data residency organization\npolicy violations using the following health check:\n\n- An *Encryption org policy not satisfied* violation indicates that a CMEK\n organization policy on a Spanner database isn't satisfied.\n\n- A *Location org policy not satisfied* violation indicates that a database is\n in a region that's not allowed by an organization policy. This can happen when\n a database was created in an allowed region, but after the database was\n created an organization policy disallowed the region.\n\nIf you see this violations in Database Center, use the\ntopic in this document to fix the issue. To learn more about\nDatabase Center, see [Database Center\noverview](/database-center/docs/overview).\n\nTroubleshoot CMEK violations\n\nIf an *Encryption org policy not satisfied* violation on a\nSpanner database occurs in Database Center, you\nneed to create a new database from a backup of the database on which the\nviolation occurred. To learn more about CMEK in Spanner, see\n[CMEK overview](/spanner/docs/cmek). To learn more about CMEK in Cloud Key Management Service,\nsee [Customer-managed encryption keys](/kms/docs/cmek). To create a new database\nfrom a backup, follow these steps:\n\n1. If you don't have a key ring, create one using the steps in\n [Create a key ring](/kms/docs/create-key-ring).\n\n2. If you don't have a valid customer managed key, create one using the steps\n in [Create a key](/kms/docs/create-key).\n\n3. Create a backup of the database with the policy violation. For more\n information, see\n [Create a backup](/spanner/docs/backup/create-backups#create-backup). You\n can use an encryption key when you create the backup. If you don't, then you can\n specify an encryption key in the next step.\n\n4. Restore the backup using the steps in [Restore from a\n backup](/spanner/docs/use-cmek#restore). Choose one of the following when\n you create your restored database:\n\n - If you used a CMEK key when you created the backup, then choose **Use\n existing encryption**.\n\n - If you didn't encrypt the backup, then choose **Cloud KMS key**.\n\nTroubleshoot data residency violations\n\nIf a *Location org policy not satisfied* violation on a Spanner\ndatabase occurs in Database Center, then you need to move the\ndatabase to an instance that's in an allowed region. For more information about\nallowed regions, see\n[Resource locations](/resource-manager/docs/organization-policy/defining-locations).\n\nTo move a database, follow these steps:\n\n1. Make sure you have an available instance in an allowed region. To see a list\n of available instance configurations, run the following Google Cloud CLI\n command:\n\n gcloud spanner instance-configs list\n\n If you need to create a new instance, see\n [Create a custom instance configuration](/spanner/docs/create-manage-configurations).\n2. Use the\n [`gcloud spanner instances move`](/sdk/gcloud/reference/spanner/instances/move)\n command to move the database to the new instance.\n\nTo prevent a database from being created in a region, add the region to the\n`denied_values` list when you set the organization policy for the database. For\nmore information, see\n[Set the organization policy](/resource-manager/docs/organization-policy/defining-locations#setting_the_organization_policy)."]]
