ํ‚ค๋ง ๋งŒ๋“ค๊ธฐ

์ด ํŽ˜์ด์ง€์—์„œ๋Š” Cloud KMS์—์„œ ํ‚ค๋ง์„ ๋งŒ๋“œ๋Š” ๋ฐฉ๋ฒ•์„ ๋ณด์—ฌ์ค๋‹ˆ๋‹ค. ํ‚ค๋ง์€ Cloud KMS ํ‚ค ๋ฐ ํ‚ค ๋ฒ„์ „์˜ ๋ฃจํŠธ ๋ฆฌ์†Œ์Šค์ž…๋‹ˆ๋‹ค. ๊ฐ ํ‚ค๋ง์€ ์ง€์ •๋œ ์œ„์น˜ ๋‚ด์— ์žˆ์Šต๋‹ˆ๋‹ค. Cloud KMS ๋ฆฌ์†Œ์Šค์— ๋Œ€ํ•œ ์ž์„ธํ•œ ๋‚ด์šฉ์€ Cloud KMS ๋ฆฌ์†Œ์Šค๋ฅผ ์ฐธ๊ณ ํ•˜์„ธ์š”.

์‹œ์ž‘ํ•˜๊ธฐ ์ „์—

์ด ํŽ˜์ด์ง€์˜ ์ž‘์—…์„ ์™„๋ฃŒํ•˜๋ ค๋ฉด ๋จผ์ € ๋‹ค์Œ ํ•ญ๋ชฉ์ด ์žˆ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

  • Cloud KMS ๋ฆฌ์†Œ์Šค๋ฅผ ํฌํ•จํ•  Google Cloud ํ”„๋กœ์ ํŠธ ๋ฆฌ์†Œ์Šค. ์ด ํ”„๋กœ์ ํŠธ๋ฅผ ํ‚ค ํ”„๋กœ์ ํŠธ๋ผ๊ณ  ํ•ฉ๋‹ˆ๋‹ค. ํ‚ค ํ”„๋กœ์ ํŠธ์—๋Š” ๋‹ค๋ฅธGoogle Cloud ๋ฆฌ์†Œ์Šค๋ฅผ ํฌํ•จํ•˜์ง€ ์•Š๋Š” ๊ฒƒ์ด ์ข‹์Šต๋‹ˆ๋‹ค. ํ‚ค ํ”„๋กœ์ ํŠธ์—์„œ Cloud KMS API๋ฅผ ์‚ฌ์šฉ ์„ค์ •ํ•ฉ๋‹ˆ๋‹ค.

    API ์‚ฌ์šฉ ์„ค์ •ํ•˜๊ธฐ

  • ํ‚ค๋ง์„ ๋งŒ๋“ค ์œ„์น˜์˜ ์ด๋ฆ„. ๋‹ค๋ฅธ ๋ฆฌ์†Œ์Šค ๊ฐ€๊นŒ์ด์— ์žˆ๊ณ  ์„ ํƒํ•œ ๋ณดํ˜ธ ์ˆ˜์ค€์„ ์ง€์›ํ•˜๋Š” ์œ„์น˜๋ฅผ ์„ ํƒํ•ฉ๋‹ˆ๋‹ค. ์‚ฌ์šฉ ๊ฐ€๋Šฅํ•œ ์œ„์น˜ ๋ฐ ์ง€์›๋˜๋Š” ๋ณดํ˜ธ ์ˆ˜์ค€์„ ๋ณด๋ ค๋ฉด Cloud KMS ์œ„์น˜๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

ํ•„์š”ํ•œ ์—ญํ• 

ํ‚ค๋ง์„ ๋งŒ๋“œ๋Š” ๋ฐ ํ•„์š”ํ•œ ๊ถŒํ•œ์„ ์–ป์œผ๋ ค๋ฉด ๊ด€๋ฆฌ์ž์—๊ฒŒ ํ”„๋กœ์ ํŠธ ๋˜๋Š” ์ƒ์œ„ ๋ฆฌ์†Œ์Šค์— ๋Œ€ํ•œ Cloud KMS ๊ด€๋ฆฌ์ž (roles/cloudkms.admin) IAM ์—ญํ• ์„ ๋ถ€์—ฌํ•ด ๋‹ฌ๋ผ๊ณ  ์š”์ฒญํ•˜์„ธ์š”. ์—ญํ•  ๋ถ€์—ฌ์— ๋Œ€ํ•œ ์ž์„ธํ•œ ๋‚ด์šฉ์€ ํ”„๋กœ์ ํŠธ, ํด๋”, ์กฐ์ง์— ๋Œ€ํ•œ ์•ก์„ธ์Šค ๊ด€๋ฆฌ๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

์ด ์‚ฌ์ „ ์ •์˜๋œ ์—ญํ• ์—๋Š” ํ‚ค๋ง์„ ๋งŒ๋“œ๋Š” ๋ฐ ํ•„์š”ํ•œ ๊ถŒํ•œ์ด ํฌํ•จ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. ํ•„์š”ํ•œ ์ •ํ™•ํ•œ ๊ถŒํ•œ์„ ๋ณด๋ ค๋ฉด ํ•„์ˆ˜ ๊ถŒํ•œ ์„น์…˜์„ ํŽผ์น˜์„ธ์š”.

ํ•„์ˆ˜ ๊ถŒํ•œ

ํ‚ค๋ง์„ ๋งŒ๋“ค๋ ค๋ฉด ๋‹ค์Œ ๊ถŒํ•œ์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค.

  • cloudkms.keyRings.create
  • cloudkms.keyRings.get
  • cloudkms.keyRings.list
  • cloudkms.locations.get
  • cloudkms.locations.list
  • resourcemanager.projects.get

์ปค์Šคํ…€ ์—ญํ• ์ด๋‚˜ ๋‹ค๋ฅธ ์‚ฌ์ „ ์ •์˜๋œ ์—ญํ• ์„ ์‚ฌ์šฉํ•˜์—ฌ ์ด ๊ถŒํ•œ์„ ๋ถ€์—ฌ๋ฐ›์„ ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค.

ํ‚ค๋ง ๋งŒ๋“ค๊ธฐ

์ƒˆ ํ‚ค์˜ ํ‚ค๋ง์„ ๋งŒ๋“ค๋ ค๋ฉด ๋‹ค์Œ ๋‹จ๊ณ„๋ฅผ ๋”ฐ๋ฅด์„ธ์š”. ๊ธฐ์กด ํ‚ค๋ง์„ ๋Œ€์‹  ์‚ฌ์šฉํ•˜๋ ค๋ฉด ํ‚ค๋ฅผ ์ƒ์„ฑํ•˜๋ฉด ๋ฉ๋‹ˆ๋‹ค.

์ฝ˜์†”

  1. Google Cloud ์ฝ˜์†”์—์„œ ํ‚ค ๊ด€๋ฆฌ ํŽ˜์ด์ง€๋กœ ์ด๋™ํ•ฉ๋‹ˆ๋‹ค.

    Key Management Service๋กœ ์ด๋™

  2. ํ‚ค๋ง ๋งŒ๋“ค๊ธฐ๋ฅผ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค.

  3. ํ‚ค๋ง ์ด๋ฆ„์— ํ‚ค๋ง ์ด๋ฆ„์„ ์ž…๋ ฅํ•ฉ๋‹ˆ๋‹ค.

  4. ํ‚ค๋ง ์œ„์น˜์—์„œ "us-east1"๊ณผ ๊ฐ™์€ ์œ„์น˜๋ฅผ ์„ ํƒํ•ฉ๋‹ˆ๋‹ค.

  5. ๋งŒ๋“ค๊ธฐ๋ฅผ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค.

gcloud

  1. In the Google Cloud console, activate Cloud Shell.

    Activate Cloud Shell

  2. ํ™˜๊ฒฝ์—์„œ gcloud kms keyrings create ๋ช…๋ น์–ด๋ฅผ ์‹คํ–‰ํ•ฉ๋‹ˆ๋‹ค.

    gcloud kms keyrings create KEY_RING \
        --location LOCATION
    

    ๋‹ค์Œ์„ ๋ฐ”๊ฟ‰๋‹ˆ๋‹ค.

    • KEY_RING: ํ‚ค๊ฐ€ ํฌํ•จ๋œ ํ‚ค๋ง์˜ ์ด๋ฆ„์ž…๋‹ˆ๋‹ค.
    • LOCATION: ํ‚ค๋ง์˜ Cloud KMS ์œ„์น˜์ž…๋‹ˆ๋‹ค.

    ๋ชจ๋“  ํ”Œ๋ž˜๊ทธ ๋ฐ ๊ฐ€๋Šฅํ•œ ๊ฐ’์— ๋Œ€ํ•œ ์ •๋ณด๋ฅผ ๋ณด๋ ค๋ฉด --help ํ”Œ๋ž˜๊ทธ์™€ ํ•จ๊ป˜ ๋ช…๋ น์–ด๋ฅผ ์‹คํ–‰ํ•˜์„ธ์š”.

  3. C#

    ์ด ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•˜๋ ค๋ฉด ๋จผ์ € C# ๊ฐœ๋ฐœ ํ™˜๊ฒฝ์„ ์„ค์ •ํ•˜๊ณ  Cloud KMS C# SDK๋ฅผ ์„ค์น˜ํ•ฉ๋‹ˆ๋‹ค.

    
    using Google.Api.Gax.ResourceNames;
    using Google.Cloud.Kms.V1;
    
    public class CreateKeyRingSample
    {
        public KeyRing CreateKeyRing(
          string projectId = "my-project", string locationId = "us-east1",
          string id = "my-key-ring")
        {
            // Create the client.
            KeyManagementServiceClient client = KeyManagementServiceClient.Create();
    
            // Build the parent location name.
            LocationName locationName = new LocationName(projectId, locationId);
    
            // Build the key ring.
            KeyRing keyRing = new KeyRing { };
    
            // Call the API.
            KeyRing result = client.CreateKeyRing(locationName, id, keyRing);
    
            // Return the result.
            return result;
        }
    }

    Go

    ์ด ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•˜๋ ค๋ฉด ๋จผ์ € Go ๊ฐœ๋ฐœ ํ™˜๊ฒฝ์„ ์„ค์ •ํ•˜๊ณ  Cloud KMS Go SDK๋ฅผ ์„ค์น˜ํ•ฉ๋‹ˆ๋‹ค.

    import (
    	"context"
    	"fmt"
    	"io"
    
    	kms "cloud.google.com/go/kms/apiv1"
    	"cloud.google.com/go/kms/apiv1/kmspb"
    )
    
    // createKeyRing creates a new ring to store keys on KMS.
    func createKeyRing(w io.Writer, parent, id string) error {
    	// parent := "projects/PROJECT_ID/locations/global"
    	// id := "my-key-ring"
    
    	// Create the client.
    	ctx := context.Background()
    	client, err := kms.NewKeyManagementClient(ctx)
    	if err != nil {
    		return fmt.Errorf("failed to create kms client: %w", err)
    	}
    	defer client.Close()
    
    	// Build the request.
    	req := &kmspb.CreateKeyRingRequest{
    		Parent:    parent,
    		KeyRingId: id,
    	}
    
    	// Call the API.
    	result, err := client.CreateKeyRing(ctx, req)
    	if err != nil {
    		return fmt.Errorf("failed to create key ring: %w", err)
    	}
    	fmt.Fprintf(w, "Created key ring: %s\n", result.Name)
    	return nil
    }
    

    Java

    ์ด ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•˜๋ ค๋ฉด ๋จผ์ € ์ž๋ฐ” ๊ฐœ๋ฐœ ํ™˜๊ฒฝ์„ ์„ค์ •ํ•˜๊ณ  Cloud KMS ์ž๋ฐ” SDK๋ฅผ ์„ค์น˜ํ•ฉ๋‹ˆ๋‹ค.

    import com.google.cloud.kms.v1.KeyManagementServiceClient;
    import com.google.cloud.kms.v1.KeyRing;
    import com.google.cloud.kms.v1.LocationName;
    import java.io.IOException;
    
    public class CreateKeyRing {
    
      public void createKeyRing() throws IOException {
        // TODO(developer): Replace these variables before running the sample.
        String projectId = "your-project-id";
        String locationId = "us-east1";
        String id = "my-asymmetric-signing-key";
        createKeyRing(projectId, locationId, id);
      }
    
      // Create a new key ring.
      public void createKeyRing(String projectId, String locationId, String id) throws IOException {
        // Initialize client that will be used to send requests. This client only
        // needs to be created once, and can be reused for multiple requests. After
        // completing all of your requests, call the "close" method on the client to
        // safely clean up any remaining background resources.
        try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {
          // Build the parent name from the project and location.
          LocationName locationName = LocationName.of(projectId, locationId);
    
          // Build the key ring to create.
          KeyRing keyRing = KeyRing.newBuilder().build();
    
          // Create the key ring.
          KeyRing createdKeyRing = client.createKeyRing(locationName, id, keyRing);
          System.out.printf("Created key ring %s%n", createdKeyRing.getName());
        }
      }
    }

    Node.js

    ์ด ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•˜๋ ค๋ฉด ๋จผ์ € Node.js ๊ฐœ๋ฐœ ํ™˜๊ฒฝ์„ ์„ค์ •ํ•˜๊ณ  Cloud KMS Node.js SDK๋ฅผ ์„ค์น˜ํ•ฉ๋‹ˆ๋‹ค.

    //
    // TODO(developer): Uncomment these variables before running the sample.
    //
    // const projectId = 'my-project';
    // const locationId = 'us-east1';
    // const id = 'my-key-ring';
    
    // Imports the Cloud KMS library
    const {KeyManagementServiceClient} = require('@google-cloud/kms');
    
    // Instantiates a client
    const client = new KeyManagementServiceClient();
    
    // Build the parent location name
    const locationName = client.locationPath(projectId, locationId);
    
    async function createKeyRing() {
      const [keyRing] = await client.createKeyRing({
        parent: locationName,
        keyRingId: id,
      });
    
      console.log(`Created key ring: ${keyRing.name}`);
      return keyRing;
    }
    
    return createKeyRing();

    PHP

    ์ด ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•˜๋ ค๋ฉด ๋จผ์ € Google Cloud์—์„œ PHP ์‚ฌ์šฉ์— ๊ด€ํ•ด ์•Œ์•„๋ณด๊ณ  Cloud KMS PHP SDK๋ฅผ ์„ค์น˜ํ•˜์„ธ์š”.

    use Google\Cloud\Kms\V1\Client\KeyManagementServiceClient;
    use Google\Cloud\Kms\V1\CreateKeyRingRequest;
    use Google\Cloud\Kms\V1\KeyRing;
    
    function create_key_ring(
        string $projectId = 'my-project',
        string $locationId = 'us-east1',
        string $id = 'my-key-ring'
    ): KeyRing {
        // Create the Cloud KMS client.
        $client = new KeyManagementServiceClient();
    
        // Build the parent location name.
        $locationName = $client->locationName($projectId, $locationId);
    
        // Build the key ring.
        $keyRing = new KeyRing();
    
        // Call the API.
        $createKeyRingRequest = (new CreateKeyRingRequest())
            ->setParent($locationName)
            ->setKeyRingId($id)
            ->setKeyRing($keyRing);
        $createdKeyRing = $client->createKeyRing($createKeyRingRequest);
        printf('Created key ring: %s' . PHP_EOL, $createdKeyRing->getName());
    
        return $createdKeyRing;
    }

    Python

    ์ด ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•˜๋ ค๋ฉด ๋จผ์ € Python ๊ฐœ๋ฐœ ํ™˜๊ฒฝ์„ ์„ค์ •ํ•˜๊ณ  Cloud KMS Python SDK๋ฅผ ์„ค์น˜ํ•ฉ๋‹ˆ๋‹ค.

    from google.cloud import kms
    
    
    def create_key_ring(
        project_id: str, location_id: str, key_ring_id: str
    ) -> kms.CryptoKey:
        """
        Creates a new key ring in Cloud KMS
    
        Args:
            project_id (string): Google Cloud project ID (e.g. 'my-project').
            location_id (string): Cloud KMS location (e.g. 'us-east1').
            key_ring_id (string): ID of the key ring to create (e.g. 'my-key-ring').
    
        Returns:
            KeyRing: Cloud KMS key ring.
    
        """
    
        # Create the client.
        client = kms.KeyManagementServiceClient()
    
        # Build the parent location name.
        location_name = f"projects/{project_id}/locations/{location_id}"
    
        # Build the key ring.
        key_ring = {}
    
        # Call the API.
        created_key_ring = client.create_key_ring(
            request={
                "parent": location_name,
                "key_ring_id": key_ring_id,
                "key_ring": key_ring,
            }
        )
        print(f"Created key ring: {created_key_ring.name}")
        return created_key_ring
    
    

    Ruby

    ์ด ์ฝ”๋“œ๋ฅผ ์‹คํ–‰ํ•˜๋ ค๋ฉด ๋จผ์ € Ruby ๊ฐœ๋ฐœ ํ™˜๊ฒฝ์„ ์„ค์ •ํ•˜๊ณ  Cloud KMS Ruby SDK๋ฅผ ์„ค์น˜ํ•ฉ๋‹ˆ๋‹ค.

    # TODO(developer): uncomment these values before running the sample.
    # project_id  = "my-project"
    # location_id = "us-east1"
    # id = "my-key-ring"
    
    # Require the library.
    require "google/cloud/kms"
    
    # Create the client.
    client = Google::Cloud::Kms.key_management_service
    
    # Build the parent location name.
    location_name = client.location_path project: project_id, location: location_id
    
    # Build the key ring.
    key_ring = {}
    
    # Call the API.
    created_key_ring = client.create_key_ring parent: location_name, key_ring_id: id, key_ring: key_ring
    puts "Created key ring: #{created_key_ring.name}"

    API

    ์ด ์˜ˆ์‹œ์—์„œ๋Š” curl์„ HTTP ํด๋ผ์ด์–ธํŠธ๋กœ ์‚ฌ์šฉํ•˜์—ฌ API ์‚ฌ์šฉ์„ ๋ณด์—ฌ์ค๋‹ˆ๋‹ค. ์•ก์„ธ์Šค ์ œ์–ด์— ๋Œ€ํ•œ ์ž์„ธํ•œ ๋‚ด์šฉ์€ Cloud KMS API ์•ก์„ธ์Šค๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

    curl "https://cloudkms.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/keyRings?key_ring_id=KEY_RING" \
        --request "POST" \
        --header "authorization: Bearer TOKEN"
    

    ๋‹ค์Œ์„ ๋ฐ”๊ฟ‰๋‹ˆ๋‹ค.

    • PROJECT_ID: ํ‚ค๋ง์ด ํฌํ•จ๋œ ํ”„๋กœ์ ํŠธ์˜ ID์ž…๋‹ˆ๋‹ค.
    • KEY_RING: ํ‚ค๊ฐ€ ํฌํ•จ๋œ ํ‚ค๋ง์˜ ์ด๋ฆ„์ž…๋‹ˆ๋‹ค.
    • LOCATION: ํ‚ค๋ง์˜ Cloud KMS ์œ„์น˜์ž…๋‹ˆ๋‹ค.

    ์ž์„ธํ•œ ๋‚ด์šฉ์€ API ๋ฌธ์„œKeyRing.create๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

๋‹ค์Œ ๋‹จ๊ณ„