Jika Anda membuat fungsi baru, lihat Panduan Memulai Konsol di Cloud Run. Konten di halaman ini hanya berlaku untuk fungsi lama yang sudah ada yang dibuat dengan Cloud Functions v1 API.
Men-deploy fungsi dengan CMEK akan melindungi data yang terkait dengannya menggunakan
kunci enkripsi yang ada dalam kendali penuh Anda. Jenis enkripsi ini memungkinkan Anda
memenuhi persyaratan kepatuhan di industri tertentu, seperti jasa
keuangan. Karena kunci tersebut dimiliki oleh Anda dan tidak dikontrol oleh Google,
tidak seorang pun (termasuk Anda) yang dapat mengakses data yang dilindungi oleh kunci enkripsi ini
saat kunci tersebut dinonaktifkan atau dihancurkan.
Jenis data fungsi Cloud Run berikut dienkripsi saat menggunakan
CMEK:
Kode sumber fungsi yang diupload untuk penerapan dan disimpan oleh Google di
Cloud Storage, yang digunakan dalam proses build.
Hasil proses build fungsi, termasuk:
Image container yang dibuat dari kode sumber fungsi Anda.
Setiap instance fungsi yang di-deploy.
Data dalam penyimpanan untuk saluran transportasi peristiwa internal.
Proses build fungsi itu sendiri dilindungi oleh kunci efemeral yang dibuat
secara unik untuk setiap build. Lihat
Kepatuhan CMEK di Cloud Build untuk mengetahui informasi
selengkapnya. Selain itu, perhatikan hal-hal berikut:
Metadata file, seperti jalur sistem file atau stempel waktu modifikasi,
tidak dienkripsi.
Jika kunci dinonaktifkan, image container tidak dapat di-deploy dan instance
baru tidak dapat dimulai.
Perlindungan CMEK fungsi Cloud Run hanya berlaku untuk resource fungsi Cloud Run yang dikelola Google; Anda bertanggung jawab untuk melindungi data dan resource yang dikelola oleh Anda, seperti repositori kode sumber, atau layanan apa pun yang digunakan oleh fungsi Anda.
Menyiapkan CMEK untuk fungsi Cloud Run memerlukan hal-hal berikut:
Memberi akun layanan yang diperlukan akses ke kunci:
Untuk semua fungsi, Anda perlu memberi fungsi Cloud Run,
Artifact Registry, dan akun layanan Cloud Storage akses ke kunci.
Membuat repositori Artifact Registry yang dilindungi CMEK untuk menyimpan image
fungsi Anda.
Mengaktifkan CMEK di fungsi Anda.
Secara opsional, aktifkan kebijakan organisasi CMEK untuk
menerapkan semua fungsi baru agar mematuhi CMEK.
Langkah-langkah ini dijelaskan secara lebih mendetail di bawah.
Sebelum memulai
Buat kunci region tunggal untuk mengenkripsi fungsi Anda. Untuk mempelajari cara
membuat kunci, lihat
Membuat kunci enkripsi simetris.
Buat repositori Artifact Registry
yang telah mengaktifkan CMEK. Anda harus menggunakan kunci
yang sama untuk repositori Artifact Registry seperti yang Anda gunakan saat mengaktifkan CMEK untuk
suatu fungsi.
Memberi akun layanan akses ke kunci
Untuk semua fungsi, Anda harus memberi akun layanan berikut akses ke kunci:
Agen layanan fungsi Cloud Run (service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com)
Agen layanan Artifact Registry (service-PROJECT_NUMBER@gcp-sa-artifactregistry.iam.gserviceaccount.com)
Agen layanan Cloud Storage (service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com)
Untuk memberi akun layanan ini akses ke kunci tersebut, tambahkan setiap akun layanan sebagai
akun utama dari kunci tersebut, lalu berikan peran Cloud KMS CryptoKey Encrypter/Decrypter kepada akun
layanan tersebut:
Konsol
Buka halaman Cloud Key Management Service di konsol Google Cloud : Buka halaman Cloud KMS
Klik nama key ring yang berisi kunci yang dipilih.
Klik nama kunci untuk melihat detail kunci.
Di tab Izin, klik Berikan akses.
Di kolom New principals, masukkan alamat email ketiga akun layanan yang ditampilkan sebelumnya untuk menetapkan izin ke ketiga akun tersebut sekaligus.
Di menu drop-down Select a role, pilih Cloud KMS CryptoKey
Encrypter/Decrypter.
Klik Simpan.
gcloud
Untuk setiap akun layanan yang telah dibahas sebelumnya, jalankan perintah berikut:
Setelah menyiapkan repositori Artifact Registry dengan CMEK diaktifkan dan
memberi fungsi Cloud Run akses ke kunci, Anda siap mengaktifkan
CMEK untuk fungsi Anda.
FUNCTION: Nama fungsi untuk mengaktifkan
CMEK. Contoh, cmek-function.
KEY: Nama kunci yang sepenuhnya memenuhi syarat, dalam format
berikut:
projects/PROJECT_NAME/locations/LOCATION/keyRings/KEYRING_NAME/cryptoKeys/KEY_NAME.
REPOSITORY: Nama repositori Artifact Registry yang
sepenuhnya memenuhi syarat, dalam format berikut:
projects/PROJECT_NAME/locations/LOCATION/repositories/REPOSITORY.
YOUR_SOURCE_LOCATION: Saat mengaktifkan CMEK untuk
fungsi yang sudah ada, pastikan kode sumber yang dimaksud
di-deploy ulang dengan menentukan parameter ini secara eksplisit.
FLAGS...: Flag tambahan yang mungkin
diperlukan untuk men-deploy fungsi Anda, terutama untuk membuat deployment. Untuk mengetahui detailnya, lihat Men-deploy fungsi Cloud Run.
CMEK diaktifkan untuk fungsi ini.
Perhatikan bahwa fungsi Cloud Run selalu menggunakan versi utama kunci untuk perlindungan
CMEK. Anda tidak dapat menentukan versi kunci tertentu yang akan digunakan saat mengaktifkan
CMEK untuk fungsi Anda.
Jika kunci dihancurkan atau
dinonaktifkan, atau izin yang diperlukan atas kunci tersebut
dicabut, instance aktif dari fungsi yang dilindungi oleh kunci tersebut tidak akan dinonaktifkan.
Eksekusi fungsi yang sudah berjalan akan terus berjalan, tetapi eksekusi baru
akan gagal selama fungsi Cloud Run tidak memiliki akses ke kunci.
Menguji perlindungan CMEK
Untuk memverifikasi bahwa perlindungan CMEK berfungsi, Anda dapat menonaktifkan kunci yang digunakan
untuk mengaktifkan CMEK untuk suatu fungsi, lalu mencoba memicu fungsi Anda:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[[["\u003cp\u003eCloud Run functions (1st gen) can be protected using Cloud Key Management Service customer-managed encryption keys (CMEK), giving users full control over encryption keys for sensitive data.\u003c/p\u003e\n"],["\u003cp\u003eCMEK protection applies to function source code, container images, deployed instances, and at-rest data for internal event transport channels within Cloud Run functions.\u003c/p\u003e\n"],["\u003cp\u003eEnabling CMEK for Cloud Run functions requires granting key access to Cloud Run functions, Artifact Registry, and Cloud Storage service accounts, along with creating a CMEK-protected Artifact Registry repository.\u003c/p\u003e\n"],["\u003cp\u003eDisabling or destroying the CMEK key will prevent new function executions and deployments, though existing active instances will continue until completion.\u003c/p\u003e\n"],["\u003cp\u003eVerifying CMEK protection can be done by disabling the key and ensuring that attempts to access the functions source code or trigger it fails.\u003c/p\u003e\n"]]],[],null,["# Protect your data with CMEK (1st gen)\n=====================================\n\nYou can use Cloud Key Management Service\n[customer-managed encryption keys (CMEK)](/kms/docs/cmek) to protect\nCloud Run functions and related\n[data at rest](https://en.wikipedia.org/wiki/Data_at_rest). Such keys are\ncreated and managed through Cloud KMS and stored as software keys, in\nan [HSM cluster](/kms/docs/hsm), or [externally](/kms/docs/ekm).\n\nDeploying a function with a CMEK protects the data associated with it by using\nan encryption key that is in your full control. This type of encryption lets you\nmeet compliance requirements in certain industries, such as financial\nservices. Because the key is owned by you and is not controlled by Google,\nno one (including you) can access the data protected by these encryption keys\nwhen the keys are disabled or destroyed.\n\nThe following types of Cloud Run functions data are encrypted when using a\nCMEK:\n\n- Function source code uploaded for deployment and stored by Google in Cloud Storage, used in the build process.\n- The results of the function build process, including:\n - The container image built from your function source code.\n - Each instance of the function that is deployed.\n- At-rest data for internal event transport channels.\n\nThe function build process itself is protected by an ephemeral key uniquely\ngenerated for each build. See\n[CMEK compliance in Cloud Build](/build/docs/securing-builds/cmek) for more\ninformation. Additionally, note the following:\n\n- File metadata, such as filesystem paths or modification timestamps,\n is not encrypted.\n\n- If a key is disabled, the container image cannot be deployed and new\n instances cannot start.\n\n- Cloud Run functions CMEK protection only applies to Google-managed\n Cloud Run functions resources; you are responsible for protecting data and\n resources managed by you, such as your source code repositories, or any\n services used by your functions.\n\nSetting up CMEK for Cloud Run functions entails the following:\n\n- Granting the necessary service accounts access to the key:\n\n - For all functions, you need to grant the Cloud Run functions, Artifact Registry, and Cloud Storage service accounts access to the key.\n- Creating a CMEK-protected Artifact Registry repository to store your\n function images.\n\n- Enabling CMEK on your function.\n\n- Optionally, enable [CMEK organization policies](/kms/docs/cmek-org-policy) to\n enforce all new functions to be CMEK compliant.\n\nThese steps are described in more detail below.\n\nBefore you begin\n----------------\n\n1. Create a single-region key to use to encrypt your functions. To learn how to\n create a key, see\n [Creating symmetric encryption keys](/kms/docs/creating-keys).\n\n2. [Create an Artifact Registry repository](/artifact-registry/docs/manage-repos#create)\n that has [CMEK enabled](/artifact-registry/docs/cmek). You must use the same\n key for the Artifact Registry repository as you do when enabling CMEK for a\n function.\n\nGranting service accounts access to the key\n-------------------------------------------\n\nFor all functions, you must grant the following service accounts access to the key:\n\n- Cloud Run functions service agent (`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcf-admin-robot.iam.gserviceaccount.com`)\n\n- Artifact Registry service agent (`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-artifactregistry.iam.gserviceaccount.com`)\n\n- Cloud Storage service agent (`service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gs-project-accounts.iam.gserviceaccount.com`)\n\nTo grant these service accounts access to the key, add each service account as a\nprincipal of the key and then grant the service account the\n`Cloud KMS CryptoKey Encrypter/Decrypter` role: \n\n### Console\n\n1. Go to the Cloud Key Management Service page in the Google Cloud console: \n\n [Go to the Cloud KMS page](https://console.cloud.google.com/security/kms)\n\n2. Click the name of the key ring that contains the chosen key.\n\n3. Click the name of the key to view the key details.\n\n4. In the **Permissions** tab, click **Grant access**.\n\n5. In the **New principals** field, enter the email addresses of all three\n service accounts shown earlier to assign permissions to all three accounts\n at once.\n\n6. In the **Select a role** drop-down, select **Cloud KMS CryptoKey\n Encrypter/Decrypter**.\n\n7. Click **Save**.\n\n### gcloud\n\nFor each service account discussed earlier, run the following command: \n\n```bash\ngcloud kms keys add-iam-policy-binding KEY \\\n--keyring KEY_RING \\\n--location LOCATION \\\n--member serviceAccount:SERVICE_AGENT_EMAIL \\\n--role roles/cloudkms.cryptoKeyEncrypterDecrypter\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eKEY\u003c/var\u003e: The name of the key. For example, `my-key`.\n\n- \u003cvar translate=\"no\"\u003eKEY_RING\u003c/var\u003e: The name of the key ring. For example,\n `my-keyring`.\n\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: The location of the key. For example,\n `us-central1`.\n\n- \u003cvar translate=\"no\"\u003eSERVICE_AGENT_EMAIL\u003c/var\u003e: The email address of the\n service account.\n\n| **Important:** Some service agents, such as the Cloud Storage service agent (including its email address), are not initially available when you create a project. Instead, they are activated the first time you access them. For example, to activate the Cloud Storage service agent, you can [retrieve its email address](/storage/docs/getting-service-agent). The service agent must be activated prior to assigning permissions to it.\n\nEnabling CMEK for a function\n----------------------------\n\nAfter setting up an Artifact Registry repository with CMEK enabled and\ngranting Cloud Run functions access to your key, you're ready to enable\nCMEK for your function.\n\nTo enable CMEK for a function: \n\n### Console\n\n1. Go to the Cloud Run functions page in the Google Cloud console: \n\n [Go to the Cloud Run functions page](https://console.cloud.google.com/functions)\n\n2. Click the name of the function you want to enable CMEK on.\n\n3. Click **Edit**.\n\n4. Click **Runtime, build...** to expand the\n advanced configuration options.\n\n5. Select the **Security and image repo** tab.\n\n6. In the **Encryption** section, select\n **Customer-managed encryption key (CMEK)**.\n\n7. Select your chosen key from the dropdown.\n\n8. Under **Container location** , select\n **Customer-managed Artifact Registry**.\n\n9. In the **Artifact registry** dropdown, select the CMEK-protected\n repository.\n\n10. Click **Next**.\n\n11. Click **Deploy**.\n\n### gcloud\n\nRun the following command. \n\n```bash\ngcloud functions deploy FUNCTION \\\n--no-gen2 \\\n--kms-key=KEY \\\n--docker-repository=REPOSITORY \\\n--source=YOUR_SOURCE_LOCATION\nFLAGS...\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eFUNCTION\u003c/var\u003e: The name of the function to enable CMEK\n on. For example, `cmek-function`.\n\n- \u003cvar translate=\"no\"\u003eKEY\u003c/var\u003e: The fully qualified key name, in the following\n format:\n `projects/`\u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e`/locations/`\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e`/keyRings/`\u003cvar translate=\"no\"\u003eKEYRING_NAME\u003c/var\u003e`/cryptoKeys/`\u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e.\n\n- \u003cvar translate=\"no\"\u003eREPOSITORY\u003c/var\u003e: The fully qualified Artifact Registry\n repository name, in the following format:\n `projects/`\u003cvar translate=\"no\"\u003ePROJECT_NAME\u003c/var\u003e`/locations/`\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e`/repositories/`\u003cvar translate=\"no\"\u003eREPOSITORY\u003c/var\u003e.\n\n- \u003cvar translate=\"no\"\u003eYOUR_SOURCE_LOCATION\u003c/var\u003e: When enabling CMEK for a\n pre-existing function, make sure that the intended source code is being\n re-deployed by specifying this parameter explicitly.\n\n- \u003cvar translate=\"no\"\u003eFLAGS\u003c/var\u003e`...`: Additional flags that may be\n required to deploy your function, particularly for create deployments. For\n details, see\n [Deploy a Cloud Run function](/functions/1stgendocs/deploy#basics).\n\nCMEK is enabled for the function.\n| **Note:** First-time function deployments with CMEK enabled might fail due to IAM propagation delays. If you encounter an error upon deployment, ensure the permissions are set correctly and try again after a short period.\n\nNote that Cloud Run functions always uses the primary version of a key for CMEK\nprotection. You cannot specify a particular key version to use when enabling\nCMEK for your functions.\n\nIf a key is [destroyed](/kms/docs/destroy-restore) or\n[disabled](/kms/docs/enable-disable), or the requisite permissions on it are\nrevoked, active instances of functions protected by that key are not shut down.\nFunction executions already in progress will continue to run, but new executions\nwill fail as long as Cloud Run functions does not have access to the key.\n\nTesting CMEK protection\n-----------------------\n\nTo verify that CMEK protection is working, you can disable the key you used\nto enable CMEK for a function, then try to trigger your function:\n\n1. [Disable the key](/kms/docs/enable-disable#disable) used to protect\n your function.\n\n | **Note:** It may take up to three hours for the changes to propagate.\n2. Attempt to view the source code associated with this function. The attempt\n should fail.\n\n3. Attempt to [trigger the CMEK-protected function](/functions/1stgendocs/calling).\n The attempt should fail.\n\n4. After you have verified that CMEK protection is working,\n [enable the key](/kms/docs/enable-disable#enable).\n\nThe function's CMEK protection is now confirmed.\n\nWhat's next\n-----------\n\n- Learn how to [rotate your keys](/kms/docs/rotating-keys).\n- Learn more about [Google default encryption](/security/encryption/default-encryption).\n- Learn [more about CMEK](/kms/docs/cmek).\n- Learn more about [CMEK organization policies](/kms/docs/cmek-org-policy)."]]
