> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up Google Cloud External Key Manager (EKM) initially

> Initial setup of Google Cloud EKM: create key ring and identify service account in Google Cloud dashboard.

To set up EKM the first time, perform the steps in this section in the Google dashboard to create a new key ring and find the service account address.

## Go to the Dashboard

Perform the following steps to go to the Google Cloud Key Management Dashboard:

<Steps>
  <Step>
    From the main Google Cloud dashboard, enter `Key Management` in the search bar at the top of the page.
  </Step>

  <Step>
    Select **Key Management**- **Security** service.
  </Step>
</Steps>

## Create a new key ring

Perform the following steps to create a new key ring:

<Steps>
  <Step>
    From the **Key Management** dashboard, select **\[ Create Key Ring ]** at the top of the page.
  </Step>

  <Step>
    In the **Create key ring** wizard, enter a **name** for the key ring.

    <Note>
      Key ring names can only contain letters, numbers, underscores (\_), and hyphens (-). You can't rename or delete them.
    </Note>
  </Step>

  <Step>
    Select **Region** as the **Location type**(EKM does not support Multi-region). In the drop-down menu, select the Google region where you want to create the key ring.
  </Step>

  <Step>
    Select **\[ Create ]**.

    Note the following regarding the key ring location:

    * Cloud EKM must be able to access your keys quickly to prevent errors. When creating a Cloud EKM key, choose a Google Cloud location that is geographically near the location of the KMES Series 3.
    * You can use Cloud EKM in any Google Cloud location supported for Cloud KMS, except for **global**.
  </Step>
</Steps>

## Find the Service Account email address

After you create the Key Ring, the browser redirects to the key creation wizard. Perform the following steps to find the Service Account email address:

<Steps>
  <Step>
    Enter a **name** for the key in the **Key Creation** wizard.
  </Step>

  <Step>
    Select **External** as the protection level for the key.
  </Step>

  <Step>
    Select either **via internet** or **via VPC** as the External Key Manager (EKM) connection type.
  </Step>

  <Step>
    Select **\[ Continue ]**.
  </Step>

  <Step>
    Note the **service account email address** in the **Key material** section. The service account email address is copied later to the **email** field of the identity that Google uses to interact with the KMES Series 3.

    You return to this dialog in the Google Cloud dashboard after creating a Google Crypto Space on the KMES in an upcoming section.
  </Step>
</Steps>