[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eGoogle Cloud provides two organization policy constraints, \u003ccode\u003econstraints/gcp.restrictNonCmekServices\u003c/code\u003e and \u003ccode\u003econstraints/gcp.restrictCmekCryptoKeyProjects\u003c/code\u003e, to manage CMEK usage and restrict the selection of Cloud KMS keys for Filestore resources.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003econstraints/gcp.restrictNonCmekServices\u003c/code\u003e constraint enforces that all new Filestore resources within the specified project must utilize CMEK, causing resource creation to fail if a Cloud KMS key is not specified.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003econstraints/gcp.restrictCmekCryptoKeyProjects\u003c/code\u003e constraint allows administrators to limit the selection of Cloud KMS keys to only those from approved projects when creating Filestore resources.\u003c/p\u003e\n"],["\u003cp\u003eNewly implemented CMEK organization policies will only apply to newly created resources and will not impact existing Filestore instances or backups that were created before the policy was put in place.\u003c/p\u003e\n"],["\u003cp\u003eCMEK support is not available for the basic HDD and basic SSD service tiers, and attempting to create them with a CMEK requirement will fail.\u003c/p\u003e\n"]]],[],null,["# Apply a CMEK organization policy\n\nGoogle Cloud offers two organization policy constraints to help ensure CMEK\nusage across an organization:\n\n- `constraints/gcp.restrictNonCmekServices` is used to require CMEK protection.\n- `constraints/gcp.restrictCmekCryptoKeyProjects` is used to limit which Filestore keys are used for CMEK protection.\n\nCMEK organization policies only apply to newly created resources within\n[supported Google Cloud services](/kms/docs/cmek-org-policy#supported-services).\n\nFor a more detailed explanation of how this works, see\n[Google Cloud resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy)\nand [CMEK organization policies](/kms/docs/cmek-org-policy).\n\nControl CMEK use with organization policy\n-----------------------------------------\n\nFilestore integrates with CMEK\n[organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints)\nto let you specify encryption compliance requirements for\nFilestore resources in your organization.\n\nThis integration lets you do the following:\n\n- [Require CMEKs for all Filestore resources](#resources-constraint).\n\n- [Restrict which Cloud KMS keys can be used to protect resources in a\n project](#key-constraint).\n\nThe following sections cover both of these tasks.\n\n### Require CMEKs for all Filestore resources\n\nA common policy is to require CMEKs to be used to protect all resources in an\norganization. You can use the `constraints/gcp.restrictNonCmekServices`\nconstraint to enforce this policy in Filestore.\n\nIf set, this organization policy causes all resource creation requests without a\nspecified Cloud KMS key to fail.\n\nAfter you set this policy, it applies only to new resources in the project. Any\nexisting resources without Cloud KMS keys set continue to exist and are\naccessible without issue. \n\n### Console\n\n1. Open the **Organization policies** page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies/list)\n2. In the **Filter** field, enter\n `constraints/gcp.restrictNonCmekServices`, and then click\n **Restrict which services may create resources without CMEK**.\n\n3. Click edit **Manage Policy**.\n\n4. On the **Edit policy** page, select **Override parent's policy**.\n\n5. Select **Add a rule**.\n\n6. For **Policy values** , select **Custom**.\n\n7. For **Policy type** , select **Deny**.\n\n8. In the **Custom values** field, enter `is:file.googleapis.com`.\n\n9. Click **Done** , and then click **Set policy**.\n\n### gcloud\n\n1. Create a temporary file `/tmp/policy.yaml` to store the policy:\n\n ```yaml\n name: projects/PROJECT_ID/policies/gcp.restrictNonCmekServices\n spec:\n rules:\n - values:\n deniedValues:\n - is:file.googleapis.com\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the project ID of the project you want to\n use.\n2. Run the `org-policies set-policy` command:\n\n ```sh\n gcloud org-policies set-policy /tmp/policy.yaml\n ```\n\nTo verify that the policy is successfully applied, you can try to create an\ninstance or backup in the project. The process fails unless you specify a\nCloud KMS key.\n\n### Restrict Cloud KMS keys for a Filestore project\n\nYou can use the `constraints/gcp.restrictCmekCryptoKeyProjects` constraint to\nrestrict the Cloud KMS keys that you can use to protect a resource in a\nFilestore project.\n\nYou might specify a rule, for example, \"For all Filestore\nresources in projects/my-company-data-project, Cloud KMS keys used in\nthis project must come from projects/my-company-central-keys OR\nprojects/team-specific-keys.\" \n\n### Console\n\n1. Open the **Organization policies** page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies/list)\n2. In the **Filter** field, enter\n `constraints/gcp.restrictCmekCryptoKeyProjects`, and then click\n **Restrict which projects may supply KMS CryptoKeys for CMEK**.\n\n3. Click edit **Manage Policy**.\n\n4. On the **Edit policy** page, select **Override parent's policy**.\n\n5. Select **Add a rule**.\n\n6. For **Policy values** , select **Custom**.\n\n7. For **Policy type** , select **Allow**.\n\n8. In the **Custom values** field, enter the following:\n\n under:projects/\u003cvar translate=\"no\"\u003eKMS_PROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eKMS_PROJECT_ID\u003c/var\u003e with the project ID where the\n Cloud KMS keys you want to use are located.\n\n For example, `under:projects/my-kms-project`.\n9. Click **Done** , and then click **Set policy**.\n\n### gcloud\n\n1. Create a temporary file `/tmp/policy.yaml` to store the policy:\n\n ```yaml\n name: projects/PROJECT_ID/policies/gcp.restrictCmekCryptoKeyProjects\n spec:\n rules:\n - values:\n allowedValues:\n - under:projects/KMS_PROJECT_ID\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID of the project you want to use.\n - \u003cvar translate=\"no\"\u003eKMS_PROJECT_ID\u003c/var\u003e is the project ID where the Cloud KMS keys you want to use are located.\n2. Run the org-policies set-policy command:\n\n ```sh\n gcloud org-policies set-policy /tmp/policy.yaml\n ```\n\nTo verify that the policy is successfully applied, you can try to create an\ninstance or backup using a Cloud KMS key from a different project. The\nprocess will fail.\n\nLimitations\n-----------\n\nThe following limitations apply when setting an organization policy.\n\n### CMEK availability\n\nAs a reminder, CMEK support is not available for the basic HDD and basic SSD\nservice tiers. Given the way these constraints are defined, if you apply an\norganization policy that requires CMEK use and then attempt to create a\nbasic-tier instance or backup in the associated project, those create operations\nfail.\n\n### Existing resources\n\nExisting resources are not subject to newly created organization policies.\nFor example, if you create an organization policy that requires you to specify a\nCMEK for every `create` operation, the policy does not retroactively apply to\nexisting instances and backup chains. Those resources are still accessible\nwithout a CMEK. If you want to apply the policy to existing resources, whether\ninstances or backup chains, you must replace them.\n\n### Required permissions to set an organization policy\n\nThe permission to set or update the organization policy might be difficult to\nacquire for testing purposes. You must be granted the\n[Organization Policy Administrator role](/resource-manager/docs/organization-policy/using-constraints#required-roles),\nwhich can only be granted at the organization level.\n\nAlthough the role must be granted at the organization level, it is still\npossible to specify a policy that only applies to a specific project\nor folder.\n\nImpact of Cloud KMS key rotation\n--------------------------------\n\nFilestore doesn't automatically rotate a resource's encryption key\nwhen the Cloud KMS key associated with that resource is rotated.\n\n- All data in existing instances and backups continues to be protected by\n the key version with which they were created.\n\n- Any newly-created instances or backups use the primary key version specified\n at the time of their creation.\n\nWhen you rotate a key, data that was encrypted with previous key versions isn't\nautomatically re-encrypted. To encrypt your data with the latest key version,\nyou must decrypt the old key version from the resource, and then re-encrypt the\nsame resource with the new key version. In addition, rotating a key does not\nautomatically disable or destroy any existing key versions.\n\nFor detailed instructions on how to perform each of these tasks, see the\nfollowing guides:\n\n- [Rotate a key](/kms/docs/rotate-key)\n- [Decrypt and re-encrypt data](/kms/docs/re-encrypt-data)\n- [Enable and disable key versions](/kms/docs/enable-disable)\n- [Destroy and restore key versions](/kms/docs/destroy-restore)\n\n### Filestore access to the Cloud KMS key\n\nA Cloud KMS key is considered available and accessible by\nFilestore under the following conditions:\n\n- The key is [enabled](/kms/docs/key-states#enabled)\n- The Filestore service account has encrypt and decrypt permissions on the key\n\nWhat's next\n-----------\n\n- Learn how to [encrypt a Filestore instance or backup](/filestore/docs/cmek).\n- Learn about [CMEK](/kms/docs/cmek).\n- Learn about [encryption in transit in Google Cloud](/security/encryption-in-transit).\n- Learn about [organization policies](/resource-manager/docs/organization-policy/overview).\n- Learn about [CMEK organization policies](/kms/docs/cmek-org-policy)."]]
