Skip to main content
Perform the following tasks to set up in Google Cloud EKM for the first time:

​
Go to the Google Cloud Key Management Dashboard

Perform the following step to go to the Google Cloud Management Dashboard:
1
From the main Google Cloud dashboard, enter Key Management in the search bar at the top of the page. Then, select Key Management - Security service.

​
Create a new Key Ring

Perform the following steps to create a new Key Ring:
1
From the Key Management dashboard, select [ Create Key Ring ] at the top of the page.
2
In the Create key ring wizard. perform the following steps:
  1. Enter a name for the key ring. Key ring names can only contain letters, numbers, underscores (_), and hyphens (-). They can’t be renamed or deleted.
  2. Select Region as the Location type (EKM does not support Multi-region). Then, in the drop-down menu, select the Google region where you want to create the key ring.
  3. Select [ Create ].
Note the following regarding the key ring location:
  • Cloud EKM needs to be able to reach your keys quickly to avoid an error. When creating a Cloud EKM key, choose a Google Cloud location that is geographically near the location of the CryptoHub.
  • You can use Cloud EKM in any Google Cloud location supported for Cloud KMS, except for global.

​
Note the Service Account email address

After the Key Ring is created, the browser redirects to the key creation wizard. Perform the following steps to find the IP address:
1
Enter a name for the key.
2
Select External as the protection level for the key.
3
Select either via internet or via VPC as the External key manager (EKM) connection type.
4
Select [ Continue ].
5
Note the Service Account email address in the Key material section. The service account email address will be configured in CryptoHub in the next section.
Reminder:The Google EKM service account calling your endpoint follows this format: service-[PROJECT_NUMBER]@gcp-sa-ekms.iam.gserviceaccount.com. You’ll see calls from this principal.
You return to this dialog in the Google Cloud dashboard after creating a Google Crypto Space on the CryptoHub.