Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Melihat dan menindaklanjuti justifikasi
Halaman ini menjelaskan cara melihat dan menindaklanjuti justifikasi yang dikirim Justifikasi Akses Kunci untuk meminta akses ke kunci enkripsi Anda. Setiap kali informasi Anda
dienkripsi atau didekripsi, Key Access Justifications akan mengirimkan justifikasi yang menjelaskan
alasan akses tersebut. Cara Anda melihat dan menindaklanjuti justifikasi bergantung pada
jenis kunci yang Anda gunakan dengan Key Access Justifications:
Untuk kunci yang dikelola secara eksternal, partner Cloud EKM dapat memberikan
kemampuan untuk menetapkan kebijakan yang otomatis menyetujui atau menolak permintaan akses
berdasarkan konten justifikasi. Untuk mengetahui informasi selengkapnya tentang cara menetapkan kebijakan, lihat dokumentasi yang relevan untuk pengelola kunci yang Anda pilih. Partner
berikut mendukung Key Access Justifications:
Fortanix
Thales
Untuk semua kunci yang dikonfigurasi dengan kebijakan Key Access Justifications—terlepas dari jenis
kunci—Anda dapat melihat permintaan akses di log audit
Cloud KMS.
Menolak akses dapat menghambat kemampuan personel Google untuk membantu Anda terkait
layanan yang dikontrak. Contoh:
Menolak akses untuk permintaan dengan alasan CUSTOMER_INITIATED_ACCESS atau
GOOGLE_INITIATED_SYSTEM_OPERATION akan menyebabkan layanan Anda
tidak tersedia.
Menolak akses untuk permintaan dengan alasan CUSTOMER_INITATED_SUPPORT
akan membatasi kemampuan personel Google untuk merespons tiket dukungan pada
kasus yang jarang terjadi saat tiket dukungan Anda memerlukan akses ke informasi
pelanggan yang sensitif. Tiket dukungan biasanya tidak memerlukan akses ini dan
personel dukungan lini depan kami tidak memiliki akses ini.
Menolak akses untuk permintaan dengan alasan GOOGLE_INITIATED_SERVICE
akan mengurangi ketersediaan dan keandalan layanan serta menghambat kemampuan Google untuk
pulih dari pemadaman.
Melihat justifikasi untuk kunci EKM
Anda dapat menggunakan konsol Google Cloud untuk melihat justifikasi yang dikirim Key Access Justifications
ke pengelola kunci enkripsi eksternal saat data Anda diakses. Untuk mengakses
justifikasi, Anda harus mengaktifkan Log Audit Cloud dengan Cloud KMS terlebih dahulu di project yang berisi kunci yang digunakan untuk enkripsi.
Setelah Anda menyelesaikan penyiapan, Cloud Audit Logs juga menyertakan
justifikasi yang digunakan dalam permintaan eksternal untuk operasi kriptografis. Justifikasi
disertakan dalam log Akses Data pada kunci resource, dalam
entri metadata untuk protoPayload. Untuk informasi selengkapnya tentang kolom ini, lihat Memahami log audit.
Untuk informasi selengkapnya tentang penggunaan Cloud Audit Logs dengan Cloud KMS, lihat Informasi logging audit Cloud KMS.
Perhatikan bahwa tidak seperti justifikasi yang dibagikan kepada pengelola kunci eksternal, justifikasi dalam Log Audit Cloud tidak dapat digunakan untuk menyetujui atau menolak
operasi kriptografi terkait. Google Cloud mencatat justifikasi hanya
setelah operasi selesai. Oleh karena itu, log di Google Cloud harus
digunakan terutama untuk pencatatan.
Melihat justifikasi untuk Cloud HSM dan kunci software
key_access_justification: Kode justifikasi
yang terkait dengan permintaan.
key_access_justification_policy_metadata: Metadata kebijakan Key Access Justifications
untuk kunci yang berisi informasi berikut:
customer_configured_policy_enforced: Menunjukkan apakah kebijakan Key Access Justifications yang ditetapkan pada kunci diterapkan untuk operasi atau tidak.
customer_configured_policy: Menunjukkan kode justifikasi yang mengizinkan
akses ke kunci.
justification_propagated_to_ekm: Menunjukkan apakah permintaan akses
di-propagasi ke pengelola kunci eksternal (jika dikonfigurasi).
Contoh berikut menunjukkan entri log audit Cloud KMS untuk
kunci Cloud HSM yang dikonfigurasi dengan Key Access Justifications:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eKey Access Justifications sends justifications for encryption key access requests, viewable in Cloud KMS audit logs for all key types.\u003c/p\u003e\n"],["\u003cp\u003eExternally managed keys allow setting policies with Cloud EKM partners to automatically approve or deny access based on justification content.\u003c/p\u003e\n"],["\u003cp\u003eDenying access requests can lead to service unavailability or limit Google's support capabilities, depending on the justification reason.\u003c/p\u003e\n"],["\u003cp\u003eJustifications in Cloud Audit Logs are for record-keeping only and cannot be used to approve or deny cryptographic operations, unlike the justifications sent to external key managers.\u003c/p\u003e\n"],["\u003cp\u003eCloud HSM and software key audit logs include details like the justification code, whether the Key Access Justifications policy was enforced, and whether the request was sent to the external key manager.\u003c/p\u003e\n"]]],[],null,["# View and act on justifications\n==============================\n\nThis page describes how you can view and act on justifications that Key Access Justifications\nsends to request access to your encryption keys. Whenever your information is\nencrypted or decrypted, Key Access Justifications sends you a justification describing the\nreason for the access. The way you view and act on justifications depends on the\ntype of keys you're using with Key Access Justifications:\n\n- For externally managed keys, the Cloud EKM partner may provide the ability to set a policy that automatically approves or denies access requests based on the content of the justifications. For more information about setting a policy, see the relevant documentation for your chosen key manager. The following partners support Key Access Justifications:\n - Fortanix\n - Thales\n- For all keys configured with Key Access Justifications policies---regardless of key type---you [can view access requests](#hsm) in the Cloud KMS audit logs.\n\nDenying access can hinder the ability of Google personnel to help you with a\ncontracted service. For example:\n\n- Denying access for requests with reasons of `CUSTOMER_INITIATED_ACCESS` or `GOOGLE_INITIATED_SYSTEM_OPERATION` results in your service becoming unavailable.\n- Denying access for requests with the reason of `CUSTOMER_INITATED_SUPPORT` limits the ability of Google personnel to respond to support tickets on the rare occasion that your support ticket requires access to sensitive customer information. Support tickets typically don't require this access and our frontline support personnel don't have this access.\n- Denying access for request with the reason of `GOOGLE_INITIATED_SERVICE` reduces service availability and reliability and inhibits Google's ability to recover from outages.\n\n| **Important:** Justification codes for Key Access Justifications are similar to [Access Transparency codes](/logging/docs/audit/reading-access-transparency-logs#justification-reason-codes), but they are not equivalent and shouldn't be directly compared.\n\nView justifications for EKM keys\n--------------------------------\n\nYou can use the Google Cloud console to view the justification Key Access Justifications\nsends to your external key manager when your data is accessed. To access the\njustification, you first need to enable Cloud Audit Logs with Cloud KMS\non the project containing the key used for encryption.\n\nAfter you have completed the setup, the Cloud Audit Logs also includes the\njustification used in the external request for cryptographic operations. The\njustification is included in the Data Access logs on the resource key, in\nthe `metadata` entries for `protoPayload`. For more information on these fields,\nsee [Understanding audit logs](/logging/docs/audit/understanding-audit-logs).\nFor more information about using Cloud Audit Logs with Cloud KMS, see\n[Cloud KMS audit logging information](/kms/docs/audit-logging).\n\nNote that unlike the justification shared with the external key manager, the\njustification in the Cloud Audit Logs cannot be used for approving or denying the\nassociated cryptographic operation. Google Cloud logs the justification only\nafter the operation is completed. Therefore, the logs in Google Cloud must be\nused primarily for record keeping.\n\nView justifications for Cloud HSM and software keys\n---------------------------------------------------\n\nWhen Cloud HSM and software keys\n[configured with Key Access Justifications](/assured-workloads/key-access-justifications/docs/configure-kaj)\nhave been used to perform encryption or decryption operations, you can view the\n[Cloud KMS audit logs](/kms/docs/audit-logging#viewing_logs) to\nview the following information:\n\n- `key_access_justification`: The [justification code](/assured-workloads/key-access-justifications/docs/justification-codes) associated with the request.\n- `key_access_justification_policy_metadata`: The Key Access Justifications policy metadata for the key containing the following information:\n - `customer_configured_policy_enforced`: Indicates whether or not the Key Access Justifications policy set on the key was enforced for the operation.\n - `customer_configured_policy`: Indicates the justification codes that allow access to the key.\n - `justification_propagated_to_ekm`: Indicates whether the access request was propagated to the external key manager (if configured).\n\nThe following example demonstrates a Cloud KMS audit log entry for an\nCloud HSM key configured with Key Access Justifications:\n\n\u003cbr /\u003e\n\n```javascript\n {\n @type: \"type.googleapis.com/google.cloud.audit.AuditLog\"\n (...)\n metadata: {\n entries: {\n key_access_justification: {\n @type: \"type.googleapis.com/google.cloud.ekms.v0.AccessReasonContext\"\n reason: \"CUSTOMER_INITIATED_ACCESS\"\n }\n key_access_justification_policy_metadata: {\n customer_configured_policy_enforced: \"true\"\n customer_configured_policy: {\n allowed_access_reasons: [\"CUSTOMER_INITIATED_ACCESS\", \"GOOGLE_INITIATED_SYSTEM_OPERATION\"]\n }\n justification_propagated_to_ekm: \"false\"\n }\n }\n }\n methodName: \"useVersionToDecrypt\"\n serviceName: \"cloudkms.googleapis.com\"\n (...)\n }\n \n```\n\n\u003cbr /\u003e"]]
