Os nomes de alguns pacotes de controle do Assured Workloads estão mudando. Para saber mais sobre a mudança de nome, consulte Aviso de renomeação do pacote de controle.
Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Validar uma assinatura de solicitação aprovada
Cada solicitação de aprovação de acesso aprovada é assinada com uma chave criptográfica assimétrica para validar a aprovação. As solicitações aprovadas podem ser assinadas com
uma Google-owned and managed key ou uma chave do Cloud KMS fornecida pelo cliente.
Ao validar uma assinatura, você pode ter certeza de que a bytestring da
solicitação aprovada serializada é válida. Para concluir a validação do conteúdo da
aprovação, é necessário desserializar a mensagem e comparar a mensagem
desserializada com o conteúdo da solicitação aprovada.
Antes de começar
Para garantir que a conta de serviço da aprovação de acesso do seu
recurso tenha as permissões
necessárias para verificar as assinaturas de solicitações aprovadas,
peça ao administrador para conceder à conta de serviço da aprovação de acesso do seu
recurso o
papel do IAM Assinante/verificador de CryptoKey do Cloud KMS (roles/cloudkms.signerVerifier)
na chave, no keyring ou no projeto da chave.
O administrador também pode conceder à conta de serviço da aprovação de acesso para seu
recurso
as permissões necessárias por meio de papéis
personalizados ou outros papéis
predefinidos.
Validar uma solicitação assinada usando um Google-owned and managed key
No console Google Cloud , acesse a página Access Approval.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-18 UTC."],[[["\u003cp\u003eAccess Approval requests are signed with either a Google-managed key or a customer-provided Cloud KMS key to validate the approval.\u003c/p\u003e\n"],["\u003cp\u003eValidating a signature confirms the integrity of the bytestring of the serialized approved request, which must also be deserialized and compared with the approved request's contents.\u003c/p\u003e\n"],["\u003cp\u003eThe Access Approval service account must be granted the \u003ccode\u003eroles/cloudkms.signerVerifier\u003c/code\u003e IAM role on the key, key ring, or key project to ensure it has the necessary permissions to verify request signatures.\u003c/p\u003e\n"],["\u003cp\u003eValidation involves copying the public key, signature, and serialized approval request from the Google Cloud console to Cloud Shell, decoding them, and using \u003ccode\u003eopenssl\u003c/code\u003e to verify the signature.\u003c/p\u003e\n"],["\u003cp\u003eThe result \u003ccode\u003eVerified OK\u003c/code\u003e from \u003ccode\u003eopenssl\u003c/code\u003e confirms that the serialized request is valid, regardless of if it was signed with a Google or customer-managed key.\u003c/p\u003e\n"]]],[],null,["# Validate an approved request signature\n======================================\n\nEach approved Access Approval request is signed with an asymmetric\ncryptographic key to validate the approval. Approved requests can be signed with\na Google-owned and managed key or a customer-provided\nCloud KMS key.\n\nWhen you validate a signature, you can be sure that the bytestring of the\nserialized approved request is valid. To finish validating the contents of the\napproval, you must deserialize the message and compare the deserialized\nmessage with the contents of the approved request.\n\nBefore you begin\n----------------\n\n\nTo ensure that the Access Approval service account for your\nresource has the necessary\npermissions to verify approved request signatures,\n\nask your administrator to grant the Access Approval service account for your\nresource the\n\n\n[Cloud KMS CryptoKey Signer/Verifier](/iam/docs/roles-permissions/cloudkms#cloudkms.signerVerifier) (`roles/cloudkms.signerVerifier`)\nIAM role on the key, key ring, or key project.\n\n\n| **Important:** You must grant this role to the Access Approval service account for your resource, *not* to your user account. Failure to grant the role to the correct principal might result in permission errors.\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\u003cbr /\u003e\n\n\nYour administrator might also be able to give the Access Approval service account for your\nresource\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nValidate a request signed using a Google-owned and managed key\n--------------------------------------------------------------\n\n1. In the Google Cloud console, go to the **Access Approval** page.\n\n [Go to Access\n Approval](https://console.cloud.google.com/security/access-approval)\n2. Locate and select the approved Access Approval request that you\n want to validate. The **Request details** page opens.\n\n3. Under **Google-managed public key** , click\n content_copy **Copy**.\n\n4. Open the Cloud Shell, and then save the public key as a new file named\n `public_key`:\n\n echo \u003cvar translate=\"no\"\u003eGOOGLE_MANAGED_PUBLIC_KEY\u003c/var\u003e \u003e ./public_key\n\n Replace \u003cvar translate=\"no\"\u003eGOOGLE_MANAGED_PUBLIC_KEY\u003c/var\u003e with the contents of\n the **Google-managed public key** field.\n5. In the Google Cloud console, on the **Request details** page, under\n **Signature** , click\n content_copy **Copy**.\n\n6. Open the Cloud Shell, and then save the signature as a new file named\n `signature.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e \u003e ./signature.txt\n\n Replace \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e with the contents of the **Signature**\n field.\n7. Decode the signature using the `base64` command and save the result as\n `decoded_signature`:\n\n base64 ./signature.txt -d \u003e ./decoded_signature\n\n8. In the Google Cloud console, on the **Request details** page, under\n **Serialized Approval Request** , click\n content_copy **Copy**.\n\n9. Open the Cloud Shell, and then save the serialized approval request as a\n new file named `serialized_approval_request.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e \u003e ./serialized_approval_request.txt\n\n Replace \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e with the contents of\n the **Serialized Approval Request** field.\n10. Decode the serialized approval request and save the result as\n `decoded_serialized_approval_request`:\n\n base64 ./serialized_approval_request.txt -d \u003e ./decoded_serialized_approval_request\n\n11. Use `openssl` to verify the signature:\n\n openssl dgst \\\n -sha256 \\\n -verify ./public_key \\\n -signature ./decoded_signature \\\n ./decoded_serialized_approval_request\n\n If the signature is valid, the output should be `Verified OK`. This\n confirms that the serialized approval request is valid.\n\nValidate a request signed using a customer-provided key\n-------------------------------------------------------\n\n1. In the Google Cloud console, go to the **Access Approval** page.\n\n [Go to Access\n Approval](https://console.cloud.google.com/security/access-approval)\n2. Locate and select the approved Access Approval request that you\n want to validate. The **Request details** page opens.\n\n3. In the Google Cloud console, on the **Request details** page, under\n **Signature** , click\n content_copy **Copy**.\n\n4. Open the Cloud Shell, and then save the signature as a new file named\n `signature.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e \u003e ./signature.txt\n\n Replace \u003cvar translate=\"no\"\u003eSIGNATURE\u003c/var\u003e with the contents of the **Signature**\n field.\n5. Decode the signature and save the result as `decoded_signature`:\n\n base64 ./signature.txt -d \u003e ./decoded_signature\n\n6. In the Google Cloud console, on the **Request details** page, under\n **Serialized Approval Request** , click\n content_copy **Copy**.\n\n7. Open the Cloud Shell, and then save the serialized approval request as a\n new file named `serialized_approval_request.txt`:\n\n echo \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e \u003e ./serialized_approval_request.txt\n\n Replace \u003cvar translate=\"no\"\u003eSERIALIZED_APPROVAL_REQUEST\u003c/var\u003e with the contents of\n the **Serialized Approval Request** field.\n8. Decode the serialized approval request and save the result as\n `decoded_serialized_approval_request`:\n\n base64 ./serialized_approval_request.txt -d \u003e ./decoded_serialized_approval_request\n\n9. Under **Customer-managed key**, make note of the resource identifier of\n the key.\n\n10. [Retrieve the public key](/kms/docs/retrieve-public-key) for the key that\n you identified in the previous step. Save the downloaded public key in the\n PEM format as `./public_key`.\n\n11. Use `openssl` to verify the signature:\n\n openssl dgst \\\n -sha256 \\\n -verify ./public_key \\\n -signature ./decoded_signature \\\n ./decoded_serialized_approval_request\n\n If the signature is valid, the output should be `Verified OK`. This\n confirms that the serialized approval request is valid."]]
