Google Crypto Space-managed keys enable you to create, rotate, and destroy KMES-stored keys directly from the Google Cloud dashboard. You can create both symmetric and asymmetric keys inside key rings.
You must configure a VPC connection between Google Cloud and the KMES Series 3. Then, Google EKM requires only the Google Crypto Space URL in the KMS Infrastructure menu. Refer to Appendix: Google VPC and KMS Infrastructure Setup for VPC and KMS Infrastructure setup instructions.
When changing the existing KMS Infrastructure from Manual to Crypto Space, you cannot rotate keys if the wrapping key exists outside the Google Crypto Space. You can set the key rotation period in key settings, but it defaults to never rotate.
/v0/key-encrypt/external/<crypto-space name>
The URL must start with /v0. Otherwise, Google appends it to the returned Crypto Space path, resulting in a mismatching URL check.
Create a Google Crypto Space
Perform the following steps to create a new Google Crypto Space on the KMES Series 3:
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to the Key Management > Google Crypto Spaces menu and select [ Add ].
On the Info tab of the Google Crypto Space window, enter a name for the Google Crypto Space. Then, set the following permissions:| Key type | Permissions |
|---|
| Symmetric | - CREATE_KEY
- DESTROY_KEY
- WRAP
- UNWRAP
|
| Asymmetric | - CREATE_KEY
- DESTROY_KEY
- GET_PUBLIC_KEY
- ASYMMETRIC_SIGN
|
If you use a VPC connection between Google Cloud and the KMES Series 3, select the GET_INFO permission.
On the Justifications tab, select one of the following access reasons:
- REASON_UNSPECIFIED
- CUSTOMER_INITIATED_SUPPORT
- GOOGLE_INITIATED_SERVICE
- THIRD_PARTY_DATA_REQUEST
- GOOGLE_INITIATED_REVIEW
- CUSTOMER_INITIATED_ACCESS
- GOOGLE_INITIATED_SYSTEM_OPERATION
- REASON_NOT_EXPECTED
- MODIFIED_CUSTOMER_INITIATED_ACCESS
- MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION
- GOOGLE_RESPONSE_TO_PRODUCTION_ALERT
Select [ OK ] to close the successful creation message. The Google Crypto Space window now has additional tabs for Symmetric and Asymmetric keys.
Because you create future keys on the KMES through the Google Cloud dashboard, select [ OK ]* to save and close the Google Crypto Space window.
Grant permission
Perform the following steps to grant the Google EKM Identity permission to use the Crypto Space:
Right-click the Google Crypto Space you just created and select Permission.
In the Set Object-Group Permissions window, grant the Google EKM identity the Use permission.
