# Cloud Key Management Service documentation

[Read product documentation](https://docs.cloud.google.com/kms/docs/key-management-service)
Cloud Key Management Service allows you to create, import, and manage cryptographic keys
and perform cryptographic operations in a single centralized cloud service.
You can use these keys and perform these operations by using
Cloud KMS directly, by using Cloud HSM or Cloud External Key Manager, or by
using Customer-Managed Encryption Keys (CMEK) integrations within other
Google Cloud services.


With Cloud KMS you are the ultimate custodian of your data, you
can manage cryptographic keys in the cloud in the same ways you do
on-premises, and you have a provable and monitorable root of trust over your
data.

[Go to the Cloud Key Management Service product page for more.](https://cloud.google.com/security/products/security-key-management)

## Documentation resources

Find quickstarts and guides, review key references, and get help with common issues.

### Guides

-

  [Quickstart: Create encryption keys with Cloud KMS](https://docs.cloud.google.com/kms/docs/create-encryption-keys)

-

  [Encrypting and decrypting data with a symmetric key](https://docs.cloud.google.com/kms/docs/encrypt-decrypt)

-

  [Encrypting and decrypting data with an asymmetric key](https://docs.cloud.google.com/kms/docs/encrypt-decrypt-rsa)

-

  [Cloud HSM](https://docs.cloud.google.com/kms/docs/hsm)

-

  [Creating symmetric keys](https://docs.cloud.google.com/kms/docs/creating-keys)

-

  [Cloud External Key Manager](https://docs.cloud.google.com/kms/docs/ekm)

-

  [Importing a key into Cloud KMS](https://docs.cloud.google.com/kms/docs/importing-a-key)

-

  [Retrieving a public key](https://docs.cloud.google.com/kms/docs/retrieve-public-key)

-

  [Destroying and restoring key versions](https://docs.cloud.google.com/kms/docs/destroy-restore)

### Reference

-

  [Permissions and roles](https://docs.cloud.google.com/kms/docs/reference/permissions-and-roles)

-

  [Cloud KMS API client libraries](https://docs.cloud.google.com/kms/docs/reference/libraries)

-

  [PKCS #11 library](https://docs.cloud.google.com/kms/docs/reference/pkcs11-library)

-

  [REST API](https://docs.cloud.google.com/kms/docs/reference/rest)

-

  [RPC API](https://docs.cloud.google.com/kms/docs/reference/rpc)

-

  [Cloud EKM error reference](https://docs.cloud.google.com/kms/docs/reference/ekm_errors)

-

  [Service APIs Overview](https://docs.cloud.google.com/kms/docs/reference/service-apis-overview)

### Resources

-

  [Pricing](https://docs.cloud.google.com/kms/pricing)

-

  [Quotas](https://docs.cloud.google.com/kms/quotas)

-

  [Release notes](https://docs.cloud.google.com/kms/docs/release-notes)

## Related resources

Training and tutorials Use cases Code samples Explore self-paced training, use cases, reference architectures, and code samples with examples of how to use and connect Google Cloud services. Codelab Training and tutorials

### [Encrypt and decrypt data with KMS](https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms)


This tutorial teaches you how to encrypt and decrypt data using symmetric Cloud KMS keys.


Training Training and tutorials

### [Security in Google Cloud](https://docs.cloud.google.com/training/course/security-in-google-cloud-platform)


Explore and deploy the components of a secure Google Cloud solution through hands on labs. Learn best practices for securing applications and data and mitigation techniques for attacks at many points in a Google Cloud-based infrastructure, including Distributed Denial-of-Service attacks, phishing attacks, and threats involving content classification and use.


Training Training and tutorials

### [Getting started with KMS](https://www.cloudskillsboost.google/focuses/1713?parent=catalog)


In this lab you'll learn how to use some advanced features of Google Cloud Security and Privacy APIs, including: setting up a secure Cloud Storage bucket, managing keys and encrypted data, and viewing Cloud Storage audit logs.


Use case Use cases

### [Tokenizing sensitive cardholder data for PCI DSS](https://docs.cloud.google.com/solutions/tokenizing-sensitive-cardholder-data-for-pci-dss)


Shows how to set up an access-controlled credit and debit card tokenization service on Cloud Functions. To set up the service, the article uses IAM, Cloud KMS, and Datastore.

PCI DSS Functions Datastore

<br />

Architecture Use cases

### [PCI Data Security Standard Compliance](https://docs.cloud.google.com/solutions/pci-dss-compliance-in-gcp)


Learn how to implement the Payment Card Industry Data Security Standard (PCI DSS) for your business on Google Cloud.

PCI DSS Compliance Security

<br />

Code sample Code Samples

### [Python samples](https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/kms/snippets)


Python code samples and snippets


Code sample Code Samples

### [Node.js samples](https://github.com/GoogleCloudPlatform/nodejs-docs-samples/tree/main/kms)


A robust set of Node.js samples.


Code sample Code Samples

### [Go samples](https://github.com/GoogleCloudPlatform/golang-samples/tree/master/kms)


A list of Go samples


Code sample Code Samples

### [.NET samples](https://github.com/GoogleCloudPlatform/dotnet-docs-samples/tree/master/kms/api/Kms.Samples)


Samples for .NET and KMS.


Code sample Code Samples

### [PHP samples](https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/kms)


PHP code samples for KMS


Code sample Code Samples

### [Ruby samples](https://github.com/googleapis/google-cloud-ruby/tree/master/google-cloud-kms/samples)


Ruby samples for KMS


## Related videos