Monitor and adjust Cloud KMS quotas

This document shows you how to manage your Cloud Key Management Service quotas. For information about the quotas associated with Cloud KMS, see Quotas.

Before you begin

The following permissions are required to view project quotas:

• resourcemanager.projects.get
• monitoring.timeSeries.list
• serviceusage.services.list
• serviceusage.quotas.get

The serviceusage.quotas.update permission is required to change project quotas.

For information about which IAM roles include these permissions, see IAM permissions reference.

Check your Cloud KMS quotas

1. In the Google Cloud console, go to the API/Service Details page for the Cloud KMS API.

   Go to Cloud KMS API/Service Details

   This page lets you view quota details for the Cloud KMS API.

2. To view quotas for a different project, select the project in the Google Cloud console header.

3. To filter by quota type, click in the Filter bar and select Quota from the properties list, then choose the quota.

4. To filter by region, click in the Filter bar and select Dimensions (e.g. location): from the properties list, then enter the region name.

If you're nearing or exceeding your quotas, you can Request higher Cloud KMS quotas. You can also opt in to having the quota adjuster system automatically adjust your Cloud KMS quotas based on your usage.

Troubleshoot quota issues

If Cloud KMS denies a request because you have exceeded your quota and the system can't serve the request, it returns a RESOURCE_EXHAUSTED error. For requests made using the Cloud KMS REST API, the RESOURCE_EXHAUSTED error has an HTTP status code of 429.

Recurring RESOURCE_EXHAUSTED errors indicate that your project regularly exceeds one or more of its quotas. To address this issue, you can try any or all of the following:

• Reduce the rate at which your projects are making requests that use Cloud KMS resources.

• Request higher Cloud KMS quotas or opt in to using the quota adjuster system to automatically adjust your Cloud KMS quotas based on your usage.

• Use separate key projects for your resources where appropriate so that multiple resources aren't sharing the same quotas.

  Note: Creating additional projects as described here may create issues with other quotas, such as your Projects per user or Projects per billing account quotas. For more information about Google Cloud quotas, see the Cloud Quotas documentation.

• Add a backoff mechanism to your client to handle RESOURCE_EXHAUSTED errors.

Request higher Cloud KMS quotas

1. In the Google Cloud console, go to the API/Service Details page for the Cloud KMS API.

   Go to Cloud KMS API/Service Details

   This page lets you view quota details for the Cloud KMS API.

2. To request a quota increase for a different project, select the project in the Google Cloud console header.

3. In the list of quotas, select the default or regional quota that you want to increase, then click Edit Quotas.

   Note: Multiregional and global quotas don't appear in the console. To increase quota for multiregional locations or the global location, make the request for a different region and mention the multiregion in the Request description.

4. In the Quota changes pane, enter the chosen limits for the selected quotas.

5. In Request description, provide a description of the reason for your request.

6. Click Next to continue.

7. Provide your contact information including Name, Email, and Phone.

8. To complete your request, click Submit request.

   After your request is submitted, it's sent to approvers for evaluation. You're notified about the status of your request after it's reviewed.

Cap Cloud KMS usage for a specific project

To impose a stricter usage quota for your Cloud KMS resources, set the quota for a given project to a lower limit than the default.

1. In the Google Cloud console, go to the API/Service Details page for the Cloud KMS API.

   Go to Cloud KMS API/Service Details

   This page lets you view quota details for the Cloud KMS API.

2. To decrease a quota for a different project, select the project in the Google Cloud console header.

3. In the list of quotas, select the default or regional quota that you want to decrease, then click Edit Quotas.

4. In the Quota changes pane, enter the chosen limits for the selected quotas.

5. Click Next to continue.

   If you are reducing a quota by more than 10% of the current limit, a warning appears. To continue applying a lower quota than the default, click Confirm. Otherwise, you can click Cancel to go back and choose a new limit.

6. To save your changes, click Submit request.

   Your new limit is active immediately.

What's next

• Learn more about Cloud Quotas.
• For information on how client libraries surface the RESOURCE_EXHAUSTED error, see Client library mapping.
• View details about Cloud KMS quotas.