[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-08 (世界標準時間)。"],[],[],null,["# Customer-managed encryption keys\n\nIf you're using Secret Manager to store and pass your Amazon S3 or\nMicrosoft Azure credentials, you can additionally use a\n[customer-managed encryption key](/kms/docs/cmek) (CMEK) to encrypt those credentials at\nrest.\n\nSee [Enable Customer-Managed Encryption Keys for Secret Manager](/secret-manager/docs/cmek)\nfor instructions.\n\nEnforce CMEK with organization policy\n-------------------------------------\n\nTo enforce the use of CMEK through an [organizational policy](/resource-manager/docs/organization-policy/overview),\nadd Storage Transfer Service and Secret Manager to the\n`constraints/gcp.restrictNonCmekServices` deny list. Specifically, add:\n\n- `secretmanager.googleapis.com`\n- `storagetransfer.googleapis.com`\n\nSee [Creating and managing organization policies](/resource-manager/docs/organization-policy/creating-managing-policies) for\ninstructions.\n\nStorage Transfer Service checks for and enforces this restriction at job creation and\nupdate. Existing transfer jobs are not affected."]]
