Cloud Key Management Service 說明文件
Cloud Key Management Service 可讓您透過單一集中式雲端服務，建立、匯入及管理加密編譯金鑰，並執行加密編譯作業。您可以直接使用 Cloud KMS、Cloud HSM 或 Cloud External Key Manager，也可以在其他 Google Cloud 服務中使用客戶自行管理的加密金鑰 (CMEK) 整合功能，藉此使用這些金鑰並執行這些作業。
有了 Cloud KMS，您就是資料的終極監管者，可以在雲端使用與在內部部署相同的方式管理加密編譯金鑰，而且會擁有自有資料的信任根並能證明其真實性及加以監控。
使用價值 $300 美元的免費抵免額，開始進行概念驗證
-
取得 Gemini 2.0 Flash Thinking 的存取權
-
每月免費使用 AI API 和 BigQuery 等熱門產品
-
不會自動收費，也不會要求您一定要購買特定方案
繼續探索超過 20 項一律免費的產品
使用超過 20 項實用的免費產品，包括 AI API、VM 和 data warehouse 等。
訓練
訓練與教學課程
使用 KMS 加密及解密資料
本教學課程說明如何使用對稱 Cloud KMS 金鑰加密及解密資料。
訓練
訓練與教學課程
Google Cloud 的安全性
透過實作研究室，探索及部署安全 Google Cloud 解決方案的各個元件，瞭解如何運用最佳做法保護應用程式和資料，以及如何採用相關的保護措施，以防範 Google Cloud 式基礎架構中的諸多環節所可能遭受到的攻擊，例如分散式阻斷服務攻擊、網路釣魚攻擊，以及與內容分類和使用相關的威脅。
訓練
訓練與教學課程
開始使用 KMS
在本實驗室中，您將瞭解如何使用 Google Cloud 安全性解決方案和 Privacy API 的進階功能，包括設定安全的 Cloud Storage bucket、管理金鑰和已加密資料，以及查看 Cloud Storage 稽核記錄。
用途
用途
根據 PCI DSS 的規定，將機密性質的持卡人資料代碼化
說明如何在 Cloud Functions 中，設定存取權受到控管的信用卡和簽帳金融卡代碼化服務。為了設定這項服務，本文使用了 IAM、Cloud KMS 和 Datastore。
PCI DSS
函式
Datastore
用途
用途
符合 PCI 資料安全標準
瞭解如何在 Google Cloud 上為您的公司實作支付卡產業資料安全標準 (PCI DSS)。
PCI DSS
法規遵循
安全性
程式碼範例
程式碼範例
Python 範例
Python 程式碼範例和程式碼片段
程式碼範例
程式碼範例
Node.js 範例
一系列實用的 Node.js 範例。
程式碼範例
程式碼範例
Go 範例
Go 範例清單
程式碼範例
程式碼範例
.NET 範例
.NET 和 KMS 的範例。
程式碼範例
程式碼範例
PHP 範例
KMS 的 PHP 程式碼範例
程式碼範例
程式碼範例
Ruby 範例
KMS 的 Ruby 範例
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-09-02 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-02 (世界標準時間)。"],[],[],null,["# Cloud Key Management Service documentation\n==========================================\n\n[Read product documentation](/kms/docs/key-management-service)\nCloud Key Management Service allows you to create, import, and manage cryptographic keys\nand perform cryptographic operations in a single centralized cloud service.\nYou can use these keys and perform these operations by using\nCloud KMS directly, by using Cloud HSM or Cloud External Key Manager, or by\nusing Customer-Managed Encryption Keys (CMEK) integrations within other\nGoogle Cloud services.\n\n\nWith Cloud KMS you are the ultimate custodian of your data, you\ncan manage cryptographic keys in the cloud in the same ways you do\non-premises, and you have a provable and monitorable root of trust over your\ndata.\n[Get started for free](https://console.cloud.google.com/freetrial) \n\n#### Start your proof of concept with $300 in free credit\n\n- Get access to Gemini 2.0 Flash Thinking\n- Free monthly usage of popular products, including AI APIs and BigQuery\n- No automatic charges, no commitment \n[View free product offers](/free/docs/free-cloud-features#free-tier) \n\n#### Keep exploring with 20+ always-free products\n\n\nAccess 20+ free products for common use cases, including AI APIs, VMs, data warehouses,\nand more.\n\nDocumentation resources\n-----------------------\n\nFind quickstarts and guides, review key references, and get help with common issues. \nformat_list_numbered\n\n### Guides\n\n-\n\n [Quickstart: Create encryption keys with Cloud KMS](/kms/docs/create-encryption-keys)\n\n-\n\n [Encrypting and decrypting data with a symmetric key](/kms/docs/encrypt-decrypt)\n\n-\n\n [Encrypting and decrypting data with an asymmetric key](/kms/docs/encrypt-decrypt-rsa)\n\n-\n\n [Cloud HSM](/kms/docs/hsm)\n\n-\n\n [Creating symmetric keys](/kms/docs/creating-keys)\n\n-\n\n [Cloud External Key Manager](/kms/docs/ekm)\n\n-\n\n [Importing a key into Cloud KMS](/kms/docs/importing-a-key)\n\n-\n\n [Retrieving a public key](/kms/docs/retrieve-public-key)\n\n-\n\n [Destroying and restoring key versions](/kms/docs/destroy-restore)\n\nfind_in_page\n\n### Reference\n\n-\n\n [Permissions and roles](/kms/docs/reference/permissions-and-roles)\n\n-\n\n [Cloud KMS API client libraries](/kms/docs/reference/libraries)\n\n-\n\n [PKCS #11 library](/kms/docs/reference/pkcs11-library)\n\n-\n\n [REST API](/kms/docs/reference/rest)\n\n-\n\n [RPC API](/kms/docs/reference/rpc)\n\n-\n\n [Cloud EKM error reference](/kms/docs/reference/ekm_errors)\n\n-\n\n [Service APIs Overview](/kms/docs/reference/service-apis-overview)\n\ninfo\n\n### Resources\n\n-\n\n [Pricing](/kms/pricing)\n\n-\n\n [Quotas](/kms/quotas)\n\n-\n\n [Release notes](/kms/docs/release-notes)\n\nRelated resources\n-----------------\n\nTraining and tutorials \nUse cases \nCode samples \nExplore self-paced training, use cases, reference architectures, and code samples with examples of how to use and connect Google Cloud services. Training \nTraining and tutorials\n\n### Encrypt and decrypt data with KMS\n\n\nThis tutorial teaches you how to encrypt and decrypt data using symmetric Cloud KMS keys.\n\n\n[Learn more](https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms) \nTraining \nTraining and tutorials\n\n### Security in Google Cloud\n\n\nExplore and deploy the components of a secure Google Cloud solution through hands on labs. Learn best practices for securing applications and data and mitigation techniques for attacks at many points in a Google Cloud-based infrastructure, including Distributed Denial-of-Service attacks, phishing attacks, and threats involving content classification and use.\n\n\n[Learn more](/training/course/security-in-google-cloud-platform) \nTraining \nTraining and tutorials\n\n### Getting started with KMS\n\n\nIn this lab you'll learn how to use some advanced features of Google Cloud Security and Privacy APIs, including: setting up a secure Cloud Storage bucket, managing keys and encrypted data, and viewing Cloud Storage audit logs.\n\n\n[Learn more](https://www.cloudskillsboost.google/focuses/1713?parent=catalog) \nUse case \nUse cases\n\n### Tokenizing sensitive cardholder data for PCI DSS\n\n\nShows how to set up an access-controlled credit and debit card tokenization service on Cloud Functions. To set up the service, the article uses IAM, Cloud KMS, and Datastore.\n\nPCI DSS Functions Datastore\n\n\u003cbr /\u003e\n\n[Learn more](/solutions/tokenizing-sensitive-cardholder-data-for-pci-dss) \nUse case \nUse cases\n\n### PCI Data Security Standard Compliance\n\n\nLearn how to implement the Payment Card Industry Data Security Standard (PCI DSS) for your business on Google Cloud.\n\nPCI DSS Compliance Security\n\n\u003cbr /\u003e\n\n[Learn more](/solutions/pci-dss-compliance-in-gcp) \nCode sample \nCode Samples\n\n### Python samples\n\n\nPython code samples and snippets\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/kms/snippets) \nCode sample \nCode Samples\n\n### Node.js samples\n\n\nA robust set of Node.js samples.\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/nodejs-docs-samples/tree/main/kms) \nCode sample \nCode Samples\n\n### Go samples\n\n\nA list of Go samples\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/golang-samples/tree/master/kms) \nCode sample \nCode Samples\n\n### .NET samples\n\n\nSamples for .NET and KMS.\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/dotnet-docs-samples/tree/master/kms/api/Kms.Samples) \nCode sample \nCode Samples\n\n### PHP samples\n\n\nPHP code samples for KMS\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/kms) \nCode sample \nCode Samples\n\n### Ruby samples\n\n\nRuby samples for KMS\n\n\n[Open GitHub\narrow_forward](https://github.com/googleapis/google-cloud-ruby/tree/master/google-cloud-kms/samples)\n\nRelated videos\n--------------"]]
