Appendix: Configure Google VPC and KMS infrastructure
Virtual Private Cloud (VPC) uses a private network to connect directly to a network without using the public Internet. Perform the following tasks in the Google Cloud dashboard to set up a VPC connection to the KMES Series 3 and configure the KMS infrastructure:
Refer to the Google documentation for how to configure a VPC in your Google Cloud account: https://cloud.google.com/vpc/docs/create-modify-vpc-networks
The following steps provide a high-level outline:
Go to Computer Engine > VM Instance > Create VM Instance.
Go to Network Services > VPC Network > Create VPC Network.
- Enter a VPC Network name.
- Enter the Subnet name.
- Enter the Subnet Region.
Select created VPC Network > Add Route.
- Enter the VPC Route name.
- Enter the Destination IP address.
Go to Network Services > Service Directory > Namespace List > Create Namespace.
- Select region - must match VPC Network.
- Enter Namespace name.
Go to Network Services > Service Directory > Register Service.
- Select Standard.
- Enter region - should be the same as the VPC network.
- Select Namespace.
- Enter service name.
Select the created Service Directory > Create Endpoint.
- Enter endpoint name
- Enter IP of the KMES Series 3
- Enter the KMES REST API port number
- Select Choose from list
- Select VPC Network
From the main Google Cloud dashboard, enter Key Management into the search bar at the top of the page. Then, select Key Management - Security service.
Select [ KMS Infrastructure ].
Select [ Create Connection ].
Perform the following steps in the Create EKM via VPC connection wizard:
- Enter a name for the connection.
- Select a region for the connection. It must be the same region as the VPC network.
- Enter the resource ID (self link) of Service Directory service to use with this connection. The service must point to your external key manager IP address and must exist in the same region as the connection. Example: projects/futurex-ekms-test/locations/us-east1/ekmConnections/futurex-ekm-east
- Enter the EKM hostname. It should match the Common Name of the TLS certificate.
- Upload the external key manager X.509 server certificates (also known as end-entity or leaf certificates) in DER format with the .crt extension. This is the TLS certificate that is configured for the REST API connection pair on the KMES
- Enter one of the following EKM management modes:
- Manual: Manually manage key rotation from your EKM (such as KMES Series 3). This choice requires a URL for each rotation. Example: /v0/key-encrypt/external/0147E96A-77F2-0001-000A-34BE0BC561B5
- Cloud KMS: Crypto Space where Google manages the key rotation. Example: /v0/key-encrypt/external/<Crypto Space Name>
- (Optional) Set default - uses this interface for all keys using External via VPC connection as default.