Mit Sammlungen den Überblick behalten
Sie können Inhalte basierend auf Ihren Einstellungen speichern und kategorisieren.
Verschlüsselungsschlüssel mit Cloud KMS erstellen
In dieser Kurzanleitung erfahren Sie, wie Sie Verschlüsselungsschlüssel mit Cloud Key Management Service in einem Projekt erstellen und verwenden, das Ihnen gehört. In dieser Anleitung wird dieGoogle Cloud -Konsole verwendet, um Schlüsselbunde, Schlüssel und Schlüsselversionen in Cloud KMS zu erstellen. Anleitungen für andere Methoden finden Sie unter Anleitungen.
Im Rahmen des Schnellstarts werden die Anfragen über die Befehlszeile an die Cloud KMS-API gesendet. Programmbeispiele für die Verwendung von Clientbibliotheken zum Senden der Anfragen an die Cloud KMS-API finden Sie unter Daten verschlüsseln und entschlüsseln.
Hinweise
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Führen Sie folgenden Befehl aus, um die gcloud CLI zu initialisieren:
gcloudinit
Schlüsselbunde und Schlüssel
Zur Ver- und Entschlüsselung von Inhalten ist ein Cloud KMS-Schlüssel erforderlich, der zu einem Schlüsselbund gehört.
Erstellen Sie einen Schlüsselbund namens test und einen Schlüssel namens quickstart. Weitere Informationen zu diesen Objekten und ihren Beziehungen finden Sie in der Objekthierarchieübersicht.
NAME PURPOSE PRIMARY_STATE
projects/project-id/locations/global/keyRings/test/cryptoKeys/quickstart ENCRYPT_DECRYPT ENABLED
Daten verschlüsseln
Mit dem erstellten Schlüssel können Sie Text oder binären Inhalt verschlüsseln.
Speichern Sie Text, der verschlüsselt werden soll, in einer Datei mit dem Namen "mysecret.txt".
echo-n"Some text to be encrypted" > mysecret.txt
Geben Sie zum Verschlüsseln der Daten mit gcloud kms encrypt die Schlüsselinformationen, den Namen der Klartextdatei, die verschlüsselt werden soll, sowie den Namen der Datei, die den verschlüsselten Inhalt enthält, an:
Der verschlüsselte Inhalt wird von der Methode encrypt in der Datei gespeichert, die vom Flag --ciphertext-file angegeben wird.
Geheimtext entschlüsseln
Geben Sie zum Entschlüsseln der Daten mit gcloud kms decrypt die Schlüsselinformationen, den Namen der verschlüsselten Datei (Geheimtextdatei), die entschlüsselt werden soll, sowie den Namen der Datei, die den entschlüsselten Inhalt enthält, an:
[[["Leicht verständlich","easyToUnderstand","thumb-up"],["Mein Problem wurde gelöst","solvedMyProblem","thumb-up"],["Sonstiges","otherUp","thumb-up"]],[["Schwer verständlich","hardToUnderstand","thumb-down"],["Informationen oder Beispielcode falsch","incorrectInformationOrSampleCode","thumb-down"],["Benötigte Informationen/Beispiele nicht gefunden","missingTheInformationSamplesINeed","thumb-down"],["Problem mit der Übersetzung","translationIssue","thumb-down"],["Sonstiges","otherDown","thumb-down"]],["Zuletzt aktualisiert: 2025-08-25 (UTC)."],[],[],null,["# Quickstart: Create encryption keys with Cloud KMS\n\nCreate encryption keys with Cloud KMS\n=====================================\n\nThis quickstart shows you how to create and use encryption keys with\nCloud Key Management Service in a project you own. These instructions use the\nGoogle Cloud console to create key rings, keys, and key versions in\nCloud KMS. For instructions that use other methods,\nsee [Autokey overview](/kms/docs/autokey-overview), [Create a key\nring](/kms/docs/create-key-ring), and [Create a key](/kms/docs/create-key).\n\nThis quickstart uses the command line to send requests to the\nCloud KMS API. For programming examples that use the client\nlibraries to send requests to the Cloud KMS API, see [Encrypting\nand Decrypting](/kms/docs/encrypt-decrypt).\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Cloud KMS API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=cloudkms.googleapis.com&redirect=https://console.cloud.google.com)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the Cloud KMS API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=cloudkms.googleapis.com&redirect=https://console.cloud.google.com)\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n\u003cbr /\u003e\n\n| **Important:** This quickstart creates Cloud KMS resources such as key rings and keys. Once created, these resources cannot be deleted. For more information, see [Why can't I delete keys or key rings?](/kms/docs/faq#cannot_delete).\n\nKey rings and keys\n------------------\n\nTo encrypt and decrypt content you will need a Cloud KMS key, which\nis part of a key ring.\n\nCreate a key ring named `test`, and a key named `quickstart`. Refer to the\n[object hierarchy overview](/kms/docs/object-hierarchy) for more\ninformation about these objects and how they are related. \n\n gcloud kms keyrings create \"test\" \\\n --location \"global\"\n\n gcloud kms keys create \"quickstart\" \\\n --location \"global\" \\\n --keyring \"test\" \\\n --purpose \"encryption\"\n\nYou can use the `list` option to view the name and metadata for the key that you\njust created. \n\n gcloud kms keys list \\\n --location \"global\" \\\n --keyring \"test\"\n\nYou should see: \n\n```\nNAME PURPOSE PRIMARY_STATE\nprojects/PROJECT_ID/locations/global/keyRings/test/cryptoKeys/quickstart ENCRYPT_DECRYPT ENABLED\n```\n\nEncrypt data\n------------\n\nNow that you have a key, you can use that key to encrypt text or binary\ncontent.\n\nStore some text to be encrypted in a file called \"mysecret.txt\". \n\n echo -n \"Some text to be encrypted\" \u003e mysecret.txt\n\nTo encrypt the data with `gcloud kms encrypt`, provide your key information,\nspecify the name of the plaintext file to encrypt, and specify the name of the\nfile that will contain the encrypted content: \n\n gcloud kms encrypt \\\n --location \"global\" \\\n --keyring \"test\" \\\n --key \"quickstart\" \\\n --plaintext-file ./mysecret.txt \\\n --ciphertext-file ./mysecret.txt.encrypted\n\nThe `encrypt` method saves your encrypted content in the file specified by the\n`--ciphertext-file` flag.\n\nDecrypt ciphertext\n------------------\n\nTo decrypt the data with `gcloud kms decrypt`, provide your key information,\nspecify the name of the encrypted file (ciphertext file) to decrypt, and specify\nthe name of the file that will contain the decrypted content: \n\n gcloud kms decrypt \\\n --location \"global\" \\\n --keyring \"test\" \\\n --key \"quickstart\" \\\n --ciphertext-file ./mysecret.txt.encrypted \\\n --plaintext-file ./mysecret.txt.decrypted\n\nThe `decrypt` method saves your decrypted content in the file specified by the\n`--plaintext-file` flag.\n\nTo decrypt encrypted content, you must use the same key that was\nused to encrypt the content.\n\nClean up\n--------\n\n\nTo avoid incurring charges to your Google Cloud account for\nthe resources used on this page, follow these steps.\n\nList the versions available for your key: \n\n gcloud kms keys versions list \\\n --location \"global\" \\\n --keyring \"test\" \\\n --key \"quickstart\"\n\nTo destroy a version, run the following command, where `1` is the number\nof the key version that you want to destroy:\n**Important:** When you destroy a key version, you can no longer decrypt content that was encrypted using that version of the key. Make sure that you no longer need a key version before you destroy it. \n\n```\ngcloud kms keys versions destroy 1 \\\n --location \"global\" \\\n --keyring \"test\" \\\n --key \"quickstart\"\n```\n\nWhat's next\n-----------\n\n- Start [using the API](/kms/docs/accessing-the-api).\n- Take a look at the [API Reference](/kms/docs/reference/rest).\n- Learn more about how to [encrypt data at\n rest](https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms)."]]
