[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Enable customer-managed encryption keys for evaluations\n\nThis document describes how to encrypt Workload Manager evaluation\ndata with customer-managed encryption keys (CMEK).\n\nOverview\n--------\n\nBy default, Workload Manager encrypts customer content at\nrest. Workload Manager handles encryption for you without any\nadditional actions on your part. This option is called *Google default encryption*.\n\nIf you want to control your encryption keys, then you can use customer-managed encryption keys\n(CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including\nWorkload Manager. Using Cloud KMS keys gives you control over their protection\nlevel, location, rotation schedule, usage and access permissions, and cryptographic boundaries.\nUsing Cloud KMS also lets\nyou view audit logs and control key lifecycles.\n\nInstead of Google owning and managing the symmetric\n[key encryption keys (KEKs)](/kms/docs/envelope-encryption#key_encryption_keys) that protect your data, you control and\nmanage these keys in Cloud KMS.\n\nAfter you set up your resources with CMEKs, the experience of accessing your\nWorkload Manager resources is similar to using Google default encryption.\nFor more information about your encryption\noptions, see [Customer-managed encryption keys (CMEK)](/kms/docs/cmek).\n\nLimitations\n-----------\n\nThe following limitations apply to CMEK encryptions in Workload Manager:\n\n- CMEK is available for Workload Manager custom rule type evaluations\n only. Other Workload Manager features such as SAP evaluations or deployment use Google\n default encryption because no customer content at rest is involved.\n\n- Workload Manager applies CMEK keys to the storage owned by\n Workload Manager only.\n\nBefore you begin\n----------------\n\nBefore you can use CMEK, you need to create a Cloud Key Management Service key and grant the\nrequired permissions.\n\n1. Create a key ring and key.\n\n Select a project, follow the [Cloud KMS guide to creating symmetric keys](/kms/docs/creating-keys)\n to create a key ring and a key. The [key ring's location](/kms/docs/locations)\n must match the evaluation's location.\n\n Note that Workload Manager supports External Managed Key.\n For more information, see [Cloud External Key Manager](/kms/docs/ekm).\n2. Grant permissions.\n\n To provide access to the Cloud KMS key, [grant the `roles/cloudkms.cryptoKeyEncrypterDecrypter` role](/kms/docs/iam#granting_roles_on_a_resource) to the Workload Manager service agent.\n The service agent is `service-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`@gcp-sa-workloadmanager.iam.gserviceaccount.com`, where \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID in which the evaluation is created.\n\nHow CMEK works for custom rule type evaluations\n-----------------------------------------------\n\nThis section describes how CMEK works for custom rule type evaluations.\n\n### KMS key provision\n\nYou can provide a Cloud KMS key during the creation or update process of a\ncustom rule type evaluation. This provision is optional. If no Cloud KMS key is\nspecified, Workload Manager uses Google default encryption.\nThe provided Cloud KMS key must exist and the Workload Manager service account\nmust be assigned the Encrypter/Decrypter role\n(`roles/cloudkms.cryptoKeyEncrypterDecrypter`) to use the Cloud KMS key. Workload Manager\nvalidates the Cloud KMS key during the evaluation creation or update,\nand it returns errors.\n\n### Data encryption\n\nWhen you run an evaluation with a provisioned Cloud KMS key, Workload Manager\nuses the provided Cloud KMS key to encrypt the storage owned by Workload Manager:\n\n- Temporary Cloud Storage bucket used by the evaluation operation.\n The temporary Cloud Storage bucket is created at the start of an evaluation and\n deleted at the end of the evaluation.\n\n- BigQuery datasets where evaluation results are stored.\n\nWorkload Manager doesn't use these keys to encrypt data in\nthe Cloud Storage buckets where you store custom rules, or the external\nBigQuery datasets that you use to save the evaluation results.\n\n### Data access\n\n| **Warning:** If the Cloud KMS key version is disabled or destroyed, you cannot access the evaluation results.\n\nWorkload Manager encrypts evaluation results with the provided Cloud KMS key primary version\nat the time of running the evaluation. You can access and view the results of\nan evaluation if that specific Cloud KMS key version remains enabled.\n\nEvaluation results access is not affected by [KMS key rotation](/kms/docs/key-rotation).\nKey rotation creates a new version and the earlier versions still remain.\n\nEvaluation results are not re-encrypted when the key is rotated.\n\nConfigure CMEK for custom rule type evaluations\n-----------------------------------------------\n\nTo use CMEK for custom rule type evaluations, first create a key in Cloud KMS,\nthen grant the key the required permissions as described in [Before you begin](#before-you-begin). After that you can use the key to\ncreate or update evaluations, run evaluations and view evaluation results.\n\n### Create an evaluation with CMEK\n\nYou can create custom rule type evaluations with CMEK the same way as described\nin [the create evaluation page](/workload-manager/docs/evaluate/custom-rules/evaluate-using-custom-rules).\nYou can enable CMEK after selecting the regions.\n\n1. Select **Customer-managed encryption key (CMEK)** in the **Encryption (Optional)** list.\n\n2. Select a Cloud KMS key.\n\n### Update an evaluation with CMEK\n\nYou can update an evaluation to use CMEK keys.\n\n1. On the evaluation edit page, select **Customer-managed encryption key (CMEK)** in the **Encryption (Optional)** list\n\n2. Select a Cloud KMS key.\n\n| **Note:** Workload Manager doesn't show the history of the keys used for encryption.\n\n### View evaluation results with CMEK\n\nYou can view the evaluation results the same way as described on\n[the view evaluation results](/workload-manager/docs/evaluate/view-evaluation-results)\npage. No additional work is needed.\n\n\nCloud KMS quotas and Workload Manager\n-------------------------------------\n\n\u003cbr /\u003e\n\nWhen you use CMEK in Workload Manager,\nyour projects can consume Cloud KMS cryptographic requests\nquotas.\nFor example, CMEK-encrypted Workload Manager evaluations can consume these quotas.\n\nEncryption and decryption operations using CMEK keys affect Cloud KMS\nquotas only if you use hardware (Cloud HSM) or external\n(Cloud EKM) keys.\n\n\nFor more information, see\n[Cloud KMS quotas](/kms/quotas).\n\nFor external keys, the default quota is 100 QPS per [key project](/kms/quotas#examples)\nfor cryptographic operations. You can [request higher EKM quota](/kms/docs/monitor-adjust-quotas#increase_quotas) if needed.\n\nWhat's next\n-----------\n\n- Learn more about [CMEK on Google Cloud](/kms/docs/cmek).\n- Learn [how to use CMEK with other Google Cloud\n products](/kms/docs/use-keys-google-cloud)."]]
