[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eAgent Assist encrypts customer content at rest by default using Google default encryption, which requires no additional user actions.\u003c/p\u003e\n"],["\u003cp\u003eCustomers can use customer-managed encryption keys (CMEKs) via Cloud KMS to control the protection level, location, rotation, usage, access permissions, and cryptographic boundaries of their encryption keys.\u003c/p\u003e\n"],["\u003cp\u003eCMEK is available for all Agent Assist locations and features, excluding those that are disabled and smart reply, and can only be used with Conversation data at-rest.\u003c/p\u003e\n"],["\u003cp\u003eOnce a CMEK key is set for an Agent Assist location, it cannot be changed, and locations with existing Agent Assist data cannot be configured with a CMEK key.\u003c/p\u003e\n"],["\u003cp\u003eRevoking Agent Assist's access to a CMEK key will render encrypted data inaccessible and halt service functionality, with data loss possible after 30 days of revocation.\u003c/p\u003e\n"]]],[],null,["# Customer-managed encryption keys (CMEK)\n\nBy default, Agent Assist encrypts customer content at\nrest. Agent Assist handles encryption for you without any\nadditional actions on your part. This option is called *Google default encryption*.\n\nIf you want to control your encryption keys, then you can use customer-managed encryption keys\n(CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including\nAgent Assist. Using Cloud KMS keys gives you control over their protection\nlevel, location, rotation schedule, usage and access permissions, and cryptographic boundaries.\nUsing Cloud KMS also lets\nyou view audit logs and control key lifecycles.\n\nInstead of Google owning and managing the symmetric\n[key encryption keys (KEKs)](/kms/docs/envelope-encryption#key_encryption_keys) that protect your data, you control and\nmanage these keys in Cloud KMS.\n\nAfter you set up your resources with CMEKs, the experience of accessing your\nAgent Assist resources is similar to using Google default encryption.\nFor more information about your encryption\noptions, see [Customer-managed encryption keys (CMEK)](/kms/docs/cmek).\n\nProtected data\n--------------\n\nOnly Conversation data [at-rest](https://en.wikipedia.org/wiki/Data_at_rest) in a supported location can be protected with CMEKs.\n\nSupported locations and features\n--------------------------------\n\nCMEK is available in all Agent Assist [locations](/agent-assist/docs/regionalization#available_regions) and for all Agent Assist [features](/agent-assist/docs/regionalization#available_features_for_regional_serving) in supported locations, including generative AI features.\n\nLimitations\n-----------\n\nCMEK is not available for features that are disabled in Agent Assist locations and smart reply.\n\nCreate keys\n-----------\n\nTo create keys, you use the KMS service.\nFor instructions, see\n[Creating symmetric keys](/kms/docs/creating-keys).\nWhen creating or choosing a key,\nyou must configure the following:\n\n- Be sure to select the [location](/agent-assist/docs/regionalization#available_regions) that you use for your Agent Assist data, otherwise, requests will fail.\n\nEnable CMEK in Agent Assist\n---------------------------\n\nBefore you create any Agent Assist data in a specific location,\nyou can specify whether the data in this location will be protected by\na customer-managed key. Configure your key at this time.\n| **Warning:** You **cannot change** encryption key settings for a location once it has been specified. If you already have Agent Assist data for a Google Cloud project in a location, you won't be be able to add a CMEK key given this location.\n\n### Prerequisites\n\n1. Create the CCAI CMEK Service account for your project with Google Cloud CLI. For more information,\n see [gcloud services identity documentation](https://cloud.google.com/sdk/gcloud/reference/beta/services/identity/create).\n\n ```bash\n gcloud beta services identity create --service=dialogflow.googleapis.com --project=PROJECT_ID\n ```\n\n The service account will be created. It won't be returned in the create response, but will have the following format: \n\n ```bash\n service-PROJECT_NUMBER@gcp-sa-ccai-cmek.iam.gserviceaccount.com\n ```\n2. Grant the CCAI CMEK Service account the [Cloud KMS CryptoKey Encrypter/Decrypter](/kms/docs/reference/permissions-and-roles#cloudkms.cryptoKeyEncrypterDecrypter) role to ensure that the service has permissions to encrypt and decrypt with your key.\n\n ```bash\n gcloud kms keys add-iam-policy-binding KMS_KEY_ID \\\n --project=PROJECT_ID \\\n --location=LOCATION_ID \\\n --keyring=KMS_KEY_RING \\\n --member=serviceAccount:service-PROJECT_NUMBER@gcp-sa-ccai-cmek.iam.gserviceaccount.com \\\n --role=roles/cloudkms.cryptoKeyEncrypterDecrypter\n ```\n\n### Configure a key for an Agent Assist location\n\n1. Use InitializeEncryptionSpec API to configure the key.\n\n You will need to provide the following variables:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your Google Cloud project ID.\n - \u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e: The location you chose to enable CMEK in Agent Assist.\n - \u003cvar translate=\"no\"\u003eKMS_KEY_RING\u003c/var\u003e: The key ring your KMS key was created in. (The location in the key ring, like `projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/locations/`\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e`/keyRings/`\u003cvar translate=\"no\"\u003eKMS_KEY_RING\u003c/var\u003e, must match the location where you're enabling CMEK.)\n - \u003cvar translate=\"no\"\u003eKMS_KEY_ID\u003c/var\u003e: The name of your KMS key that will be used to encrypt and decrypt Agent Assist data in the selected location.\n\n For example: \n\n ```bash\n curl -X POST \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json; charset=utf-8\" \\\n -d \"{ encryption_spec: { kms_key: 'projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/keyRings/\u003cvar translate=\"no\"\u003eKMS_KEY_RING\u003c/var\u003e/cryptoKeys/\u003cvar translate=\"no\"\u003eKMS_KEY_ID\u003c/var\u003e' } }\" \\\n \"https://\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e-dialogflow.googleapis.com/v2/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/encryptionSpec:initialize\"\n ```\n\n You should receive a JSON response similar to the following: \n\n ```json\n {\n \"name\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/operations/\u003cvar translate=\"no\"\u003eOPERATION_ID\u003c/var\u003e\"\n }\n ```\n2. Use GetOperation API to check the long-running operation result.\n\n For example: \n\n ```bash\n curl -X GET \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e-dialogflow.googleapis.com/v2/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/operations/\u003cvar translate=\"no\"\u003eOPERATION_ID\u003c/var\u003e\"\n ```\n\n \u003cbr /\u003e\n\nCheck CMEK Settings\n-------------------\n\nUse GetEncryptionSpec API to check the encryption key configured for a location.\n\nFor example:\n\n\u003cbr /\u003e\n\n```bash\n curl -X GET \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e-dialogflow.googleapis.com/v2/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/encryptionSpec\"\n \n```\n\n\u003cbr /\u003e\n\nRevoke keys\n-----------\n\nTo revoke Agent Assist access to the key, you could [disable the KMS key version](/kms/docs/iam#revoking_access_to_a_resource) or [remove](/kms/docs/iam#revoking_access_to_a_resource) the service account's [Cloud KMS CryptoKey Encrypter/Decrypter](/kms/docs/reference/permissions-and-roles#cloudkms.cryptoKeyEncrypterDecrypter) role from the KMS key.\n\nAfter key revocation the encrypted data will become inaccessible to Agent Assist and the service will no longer be in an operational state until the key permissions are reinstated.\n| **Warning:** If you have revoked the key for more than 30 days, the Agent Assist data encrypted by that key will be lost."]]
