Vertex ML Metadata lets you track and analyze the metadata
produced by your machine learning (ML) workflows. The first time you run a
PipelineJob or create an experiment in the Vertex SDK, Gemini Enterprise Agent Platform creates
your project's
.

If you want your metadata encrypted using [Customer-managed encryption keys
(CMEK)](https://docs.cloud.google.com/gemini-enterprise-agent-platform/machine-learning/general/cmek), you must create your metadata store using a CMEK *before* you use
Vertex ML Metadata to track or analyze metadata.

After the metadata store has been created, the CMEK key that the metadata store
uses is independent of the CMEK key used by processes that log metadata,
for example, a pipeline run.

## Create a metadata store that uses a CMEK

Use the following instructions to create a CMEK and set up a
Vertex ML Metadata metadata store that uses this CMEK.

1. [Use Cloud Key Management Service to configure Customer-managed encryption keys.](https://docs.cloud.google.com/gemini-enterprise-agent-platform/machine-learning/general/cmek.md.txt#configure-cmek)

2. Use the following REST call to create your project's default metadata store
   using your CMEK.


   Before using any of the request data,
   make the following replacements:
   - <var translate="no">LOCATION_ID</var>: Your region.
   - <var translate="no">PROJECT_ID</var>: Your [project ID](https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects.md.txt#identifiers). .
   - <var translate="no">KEY_RING</var>: The name of the Cloud KMS key ring that your encryption key is on.
   - <var translate="no">KEY_NAME</var>: The name of the encryption key that you want to use for this metadata store.


   HTTP method and URL:

   ```
   POST https://LOCATION_ID-aiplatform.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/metadataStores?metadata_store_id=default
   ```


   Request JSON body:

   ```
   {
     "encryption_spec": {
       "kms_key_name": "projects/PROJECT_ID/locations/LOCATION_ID/keyRings/KEY_RING/cryptoKeys/KEY_NAME"
     },
   }
   ```

   To send your request, expand one of these options:

   #### curl (Linux, macOS, or Cloud Shell)

   > [!NOTE]
   > **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) , or by using [Cloud Shell](https://docs.cloud.google.com/shell/docs.md.txt), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


   Save the request body in a file named `request.json`.
   Run the following command in the terminal to create or overwrite
   this file in the current directory:

   ```
   cat > request.json << 'EOF'
   {
     "encryption_spec": {
       "kms_key_name": "projects/PROJECT_ID/locations/LOCATION_ID/keyRings/KEY_RING/cryptoKeys/KEY_NAME"
     },
   }
   EOF
   ```


   Then execute the following command to send your REST request:

   ```
   curl -X POST \
        -H "Authorization: Bearer $(gcloud auth print-access-token)" \
        -H "Content-Type: application/json; charset=utf-8" \
        -d @request.json \
        "https://LOCATION_ID-aiplatform.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/metadataStores?metadata_store_id=default"
   ```

   #### PowerShell (Windows)

   > [!NOTE]
   > **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


   Save the request body in a file named `request.json`.
   Run the following command in the terminal to create or overwrite
   this file in the current directory:

   ```
   @'
   {
     "encryption_spec": {
       "kms_key_name": "projects/PROJECT_ID/locations/LOCATION_ID/keyRings/KEY_RING/cryptoKeys/KEY_NAME"
     },
   }
   '@  | Out-File -FilePath request.json -Encoding utf8
   ```


   Then execute the following command to send your REST request:

   ```
   $cred = gcloud auth print-access-token
   $headers = @{ "Authorization" = "Bearer $cred" }

   Invoke-WebRequest `
       -Method POST `
       -Headers $headers `
       -ContentType: "application/json; charset=utf-8" `
       -InFile request.json `
       -Uri "https://LOCATION_ID-aiplatform.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/metadataStores?metadata_store_id=default" | Select-Object -Expand Content
   ```

   You should receive a JSON response similar to the following:

   ```
   {
     "name": "projects/PROJECT_ID/locations/LOCATION_ID/operations/OPERATIONS_ID",
     "metadata": {
       "@type": "type.googleapis.com/google.cloud.aiplatform.v1.CreateMetadataStoreOperationMetadata",
       "genericMetadata": {
         "createTime": "2021-05-18T18:47:14.494997Z",
         "updateTime": "2021-05-18T18:47:14.494997Z"
       }
     }
   }
   ```

   <br />