Set up Cloud EKM over the internet

This document shows you how to use Cloud External Key Manager (Cloud EKM) to create and manage external keys accessed over the internet.

If you're migrating existing EXTERNAL_VPC keys to the EXTERNAL protection level, then you must complete these setup steps first.

Before you begin

After you complete the steps below, you can begin using Cloud EKM keys to protect your data.

Create a new project

1. In the Google Cloud console, go to the Manage resources page.

   Go to Manage resources

2. Create a new Google Cloud project or select an existing project.

   Important: The name you use must be between 4 and 30 characters. When you type the name, the form will suggest a project ID, which you can edit. The project ID you use must be between 6 and 30 characters, with a lowercase letter as the first character. You can use a dash, lowercase letter, or digit for the remaining characters, but the last character cannot be a dash. You should be aware that some resource identifiers (such as project IDs) might be retained beyond the life of your project. For this reason, avoid storing sensitive information in resource identifiers.
   ...see naming guidelines

3. Verify that billing is enabled for your Google Cloud project.

You can learn more about Cloud EKM pricing.

Enable Cloud KMS

1. Enable the Cloud Key Management Service API for the project.

   Enable the Cloud Key Management Service API

2. Make a note of your project's Cloud EKM service account. In the following example, replace PROJECT_NUMBER with your Google Cloud project's project number. This information is also visible each time you use the Google Cloud console to create a Cloud EKM key.

   [e-mail]
   

Prepare the external key management partner system

In the external key management partner system, grant the Google Cloud service account access to use the external key. Treat the service account as an email address. Partners may use different terminology than that used in this document.

Ensure gcloud CLI is up to date

If you're going to use the Google Cloud CLI, ensure that it's up-to-date with the following command:

gcloud

gcloud components update

Troubleshooting errors

If you experience an error when creating or using a Cloud EKM key, an error is logged. For information about troubleshooting Cloud EKM errors, see the Cloud EKM error reference.

What's next

• Create an external key
• Optionally, migrate external keys between the EXTERNAL and EXTERNAL_VPC protection levels.