Alguns produtos e recursos estão sendo renomeados. Os recursos de playbook generativo e de fluxo também estão sendo migrados para um único console consolidado. Confira os detalhes.
Chaves de criptografia gerenciadas pelo cliente (CMEK, na sigla em inglês)
Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Por padrão, o Dialogflow criptografa o conteúdo do cliente em
repouso. O Dialogflow processa a criptografia para você sem que você precise
fazer nada. Essa opção é chamada de Criptografia padrão do Google.
A criptografia padrão do Google usa os mesmos sistemas de gerenciamento de chaves protegidos que usamos para nossos próprios dados criptografados. Esses sistemas incluem controles de acesso estritos de chaves e auditoria.
Se você quiser controlar suas chaves de criptografia, use chaves de criptografia gerenciadas pelo cliente
(CMEKs) no Cloud KMS com serviços integrados a CMEKs, incluindo
o Dialogflow. O uso de chaves do Cloud KMS permite controlar o nível de proteção,
o local, a programação de rotação, as permissões de uso e acesso e os limites criptográficos.
O uso do Cloud KMS também permite
visualizar registros de auditoria e controlar ciclos de vida importantes.
Em vez de o Google ser proprietário e gerente
de chaves de criptografia de chaves (KEKs) simétricas que protegem seus dados, você controla e
gerencia essas chaves no Cloud KMS.
Depois de configurar os recursos com CMEKs, a experiência de acesso aos recursos do
Dialogflow é semelhante à criptografia padrão do Google.
Para mais informações sobre suas opções de criptografia,
consulte Chaves de criptografia gerenciadas pelo cliente (CMEK).
Dados protegidos
Todos os dados em repouso
do agente dos agentes de conversação (Dialogflow CX)
podem ser protegidos com CMEKs.
Limitações
A rotação de chaves é compatível, mas a recriptografia de dados não. Ou seja, não é possível recriptografar dados criptografados anteriormente com uma nova versão de chave.
Para
restaurar um agente
com a CMEK ativada,
escolha a opção do Cloud Storage.
Não é possível integrar recursos atuais em projetos não integrados à CMEK de forma retroativa. Em vez disso, é recomendável exportar e restaurar os recursos em um novo projeto para CMEK.
Para criar chaves, use o serviço KMS.
Para instruções, consulte
Como criar chaves simétricas.
Ao criar ou escolher uma chave,
você precisa configurar o seguinte:
Certifique-se de selecionar o
local
que você usa para seu agente,
caso contrário, as solicitações falharão.
Configurar um agente para usar suas chaves
Ao criar um agente,
é possível especificar o local dele
e se ele vai usar uma chave gerenciada pelo Google ou pelo cliente já configurada para esse local.
Faça suas seleções agora.
Configurar uma chave para a localização dos agentes de conversação (Dialogflow CX)
Use a API InitializeEncryptionSpec para configurar a chave.
Você precisará fornecer as seguintes variáveis:
PROJECT_ID: o ID do projeto do Google Cloud .
LOCATION_ID: o local escolhido para ativar a CMEK nos agentes de conversação (Dialogflow CX).
KMS_KEY_RING: o keyring em que a chave do KMS foi criada. O local no keyring, como projects/PROJECT_ID/locations/LOCATION_ID/keyRings/KMS_KEY_RING, precisa corresponder ao local em que você está ativando a CMEK.
KMS_KEY_ID: o nome da sua chave do KMS que será usada para criptografar e descriptografar dados dos agentes de conversação (Dialogflow CX) no local selecionado.
Depois da revogação da chave, os dados criptografados vão ficar inacessíveis para os agentes de conversação (Dialogflow CX), e o serviço não vai mais estar em um estado operacional até que as permissões da chave sejam restabelecidas.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-18 UTC."],[[["\u003cp\u003eDialogflow encrypts customer content at rest by default using Google default encryption, which includes strict key access controls and auditing.\u003c/p\u003e\n"],["\u003cp\u003eCustomers can opt to use customer-managed encryption keys (CMEKs) through Cloud KMS, allowing control over key protection level, location, rotation, usage, access, and cryptographic boundaries.\u003c/p\u003e\n"],["\u003cp\u003eOnce CMEKs are set up, the experience of accessing Dialogflow resources is similar to using Google default encryption, but you manage and control the key encryption keys.\u003c/p\u003e\n"],["\u003cp\u003eConfiguring an agent to use CMEKs is done during agent creation, and the encryption key settings for a location cannot be changed once specified.\u003c/p\u003e\n"],["\u003cp\u003eTo revoke Conversational Agents' access to the key you can disable the KMS key version or remove the service account's permissions, however, data may be lost if the key is revoked for more than 30 days.\u003c/p\u003e\n"]]],[],null,["# Customer-managed encryption keys (CMEK)\n\nBy default, Dialogflow encrypts customer content at\nrest. Dialogflow handles encryption for you without any\nadditional actions on your part. This option is called *Google default encryption*.\nGoogle default\nencryption uses the same hardened key management systems that we use for our\nown encrypted data. These systems include strict key access controls and\nauditing.\n\nIf you want to control your encryption keys, then you can use customer-managed encryption keys\n(CMEKs) in [Cloud KMS](/kms/docs) with CMEK-integrated services including\nDialogflow. Using Cloud KMS keys gives you control over their protection\nlevel, location, rotation schedule, usage and access permissions, and cryptographic boundaries.\nUsing Cloud KMS also lets\nyou view audit logs and control key lifecycles.\n\nInstead of Google owning and managing the symmetric\n[key encryption keys (KEKs)](/kms/docs/envelope-encryption#key_encryption_keys) that protect your data, you control and\nmanage these keys in Cloud KMS.\n\nAfter you set up your resources with CMEKs, the experience of accessing your\nDialogflow resources is similar to using Google default encryption.\nFor more information about your encryption\noptions, see [Customer-managed encryption keys (CMEK)](/kms/docs/cmek).\n\nProtected data\n--------------\n\nAll Conversational Agents (Dialogflow CX) agent\n[data-at-rest](https://en.wikipedia.org/wiki/Data_at_rest)\ncan be protected with CMEKs.\n\nLimitations\n-----------\n\n- Key rotation is supported but data re-encryption is not. That is, re-encrypting previously encrypted data with a new key version is not supported.\n- The following [regions](/dialogflow/cx/docs/concept/region#avail) are not supported:\n - `global`\n- One key should be used per project location.\n- In order to [restore an agent](/dialogflow/cx/docs/concept/agent#export) with CMEK enabled, you must choose the Cloud Storage option.\n- Existing resources in non-CMEK integrated projects cannot be CMEK integrated retroactively. Instead, it is recommended that resources be exported and restored in a new project for CMEK.\n- [AI Applications](/generative-ai-app-builder/docs/introduction) has some [Cloud KMS Limitations](/generative-ai-app-builder/docs/cmek#limitations)\n\nCreate keys\n-----------\n\nTo create keys, you use the KMS service.\nFor instructions, see\n[Creating symmetric keys](/kms/docs/creating-keys).\nWhen creating or choosing a key,\nyou must configure the following:\n\n- Be sure to select the [location](/dialogflow/cx/docs/how/region) that you use for your agent, otherwise, requests will fail.\n\nConfigure an agent to use your keys\n-----------------------------------\n\nWhen you create an agent,\nyou can specify the agent\n[location](/dialogflow/cx/docs/how/region) and whether the agent will use a\nGoogle-managed or the already configured customer-managed key for that location.\nMake your selections at this time.\n| **Warning:** You cannot change encryption key settings for a location once it has been specified. In order to change a location, you must create a new project with the selected location and [import](/dialogflow/cx/docs/concept/agent#export) existing agents to the new project.\n\n### Prerequisites\n\n| **Note:** CCAI CMEK Service account is not visible in your project IAM.\n\n1. Create the CCAI CMEK Service account for your project with Google Cloud CLI. For more information,\n see [gcloud services identity documentation](https://cloud.google.com/sdk/gcloud/reference/beta/services/identity/create).\n\n ```bash\n gcloud beta services identity create --service=dialogflow.googleapis.com --project=PROJECT_ID\n ```\n\n The service account will be created. It won't be returned in the create response, but will have the following format: \n\n ```bash\n service-PROJECT_NUMBER@gcp-sa-ccai-cmek.iam.gserviceaccount.com\n ```\n2. Grant the CCAI CMEK Service account the [Cloud KMS CryptoKey Encrypter/Decrypter](/kms/docs/reference/permissions-and-roles#cloudkms.cryptoKeyEncrypterDecrypter) role to ensure that the service has permissions to encrypt and decrypt with your key.\n\n ```bash\n gcloud kms keys add-iam-policy-binding KMS_KEY_ID \\\n --project=PROJECT_ID \\\n --location=LOCATION_ID \\\n --keyring=KMS_KEY_RING \\\n --member=serviceAccount:service-PROJECT_NUMBER@gcp-sa-ccai-cmek.iam.gserviceaccount.com \\\n --role=roles/cloudkms.cryptoKeyEncrypterDecrypter\n ```\n\n### Configure a key for Conversational Agents (Dialogflow CX) location\n\n1. Use the `InitializeEncryptionSpec` API to configure the key.\n\n You will need to provide the following variables:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your Google Cloud project ID.\n - \u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e: The location you chose to enable CMEK in Conversational Agents (Dialogflow CX).\n - \u003cvar translate=\"no\"\u003eKMS_KEY_RING\u003c/var\u003e: The key ring your KMS key was created in. (The location in the key ring, like `projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/locations/`\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e`/keyRings/`\u003cvar translate=\"no\"\u003eKMS_KEY_RING\u003c/var\u003e, must match the location where you're enabling CMEK.)\n - \u003cvar translate=\"no\"\u003eKMS_KEY_ID\u003c/var\u003e: The name of your KMS key that will be used to encrypt and decrypt Conversational Agents (Dialogflow CX) data in the selected location.\n\n For example: \n\n ```bash\n curl -X POST \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json; charset=utf-8\" \\\n -d \"{ encryption_spec: { kms_key: 'projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/keyRings/\u003cvar translate=\"no\"\u003eKMS_KEY_RING\u003c/var\u003e/cryptoKeys/\u003cvar translate=\"no\"\u003eKMS_KEY_ID\u003c/var\u003e' } }\" \\\n \"https://\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e-dialogflow.googleapis.com/v2/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/encryptionSpec:initialize\"\n ```\n\n You should receive a JSON response similar to the following: \n\n ```json\n {\n \"name\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/operations/\u003cvar translate=\"no\"\u003eOPERATION_ID\u003c/var\u003e\"\n }\n ```\n2. Use the `GetOperation` API to check the long-running operation result.\n\n For example: \n\n ```bash\n curl -X GET \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e-dialogflow.googleapis.com/v2/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/operations/\u003cvar translate=\"no\"\u003eOPERATION_ID\u003c/var\u003e\"\n ```\n\n \u003cbr /\u003e\n\nCheck CMEK settings\n-------------------\n\nUse the `GetEncryptionSpec` API to check the encryption key configured for a location.\n\nFor example:\n\n\u003cbr /\u003e\n\n```bash\n curl -X GET \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e-dialogflow.googleapis.com/v2/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION_ID\u003c/var\u003e/encryptionSpec\"\n \n```\n\n\u003cbr /\u003e\n\nRevoke keys\n-----------\n\nTo revoke Conversational Agents (Dialogflow CX) access to the key, you could [disable the KMS key version](/kms/docs/iam#revoking_access_to_a_resource) or [remove](/kms/docs/iam#revoking_access_to_a_resource) the service account's [Cloud KMS CryptoKey Encrypter/Decrypter](/kms/docs/reference/permissions-and-roles#cloudkms.cryptoKeyEncrypterDecrypter) role from the KMS key.\n\nAfter key revocation the encrypted data will become inaccessible to Conversational Agents (Dialogflow CX) and the service will no longer be in an operational state until the key permissions are reinstated.\n| **Warning:** If you have revoked the key for more than 30 days, the Conversational Agents (Dialogflow CX) data encrypted by that key will be lost."]]
