Cloud Key Management Service 文档
借助 Cloud Key Management Service，您可以在一个集中的云服务中创建、导入和管理加密密钥并执行加密操作。您可以使用这些密钥并通过直接使用 Cloud KMS、使用 Cloud HSM 或 Cloud External Key Manager 或使用其他 Google Cloud 服务中的客户管理的加密密钥 (CMEK) 集成来执行这些操作。
借助 Cloud KMS，您将成为您的数据的终极监管人，可以按照与本地部署时相同的方式在云中管理加密密钥，并且您对数据具有可证明且可监控的信任根。
获享 $300 免费赠金开始概念验证
-
体验 Gemini 2.0 Flash Thinking
-
免费使用热门产品（包括 AI API 和 BigQuery）的每月用量
-
不会自动收费，无需承诺
继续探索 20 多种提供“始终免费”用量的产品
使用适用于常见应用场景（包括 AI API、虚拟机、数据仓库等）的 20 多种免费产品。
培训
培训和教程
使用 KMS 加密和解密数据
本教程介绍如何使用对称 Cloud KMS 密钥加密和解密数据。
培训
培训和教程
Google Cloud 中的安全性
通过动手实验了解和部署安全 Google Cloud 解决方案的组件。了解在基于 Google Cloud 的基础架构中从多个方面保护应用和数据的最佳实践以及相关缓解技术，包括分布式拒绝服务攻击、网上诱骗攻击以及涉及内容分类和使用的威胁。
培训
培训和教程
KMS 使用入门
在本实验中，您将学习如何使用 Google Cloud Security 和 Privacy API 的高级功能，包括设置安全的 Cloud Storage 存储桶、管理密钥和加密数据以及查看 Cloud Storage 审核日志。
使用场景
使用场景
对持卡人敏感数据进行标记化处理以满足 PCI DSS 要求
演示如何在 Cloud Functions 上设置受访问权限控制的信用卡和借记卡标记化服务。为设置该服务，本文使用 IAM、Cloud KMS 和 Datastore。
PCI DSS
函数
Datastore
使用场景
使用场景
PCI 数据安全标准合规性
了解如何在 Google Cloud 上为您的企业实现支付卡行业数据安全标准 (PCI DSS)。
PCI DSS
法规遵从
安全性
代码示例
代码示例
Python 示例
Python 代码示例和代码段
代码示例
代码示例
Node.js 示例
一组可靠的 Node.js 示例。
代码示例
代码示例
.NET 示例
.NET 和 KMS 示例。
代码示例
代码示例
PHP 示例
KMS 的 PHP 代码示例
代码示例
代码示例
Ruby 示例
KMS 的 Ruby 示例
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-18。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Cloud Key Management Service documentation\n==========================================\n\n[Read product documentation](/kms/docs/key-management-service)\nCloud Key Management Service allows you to create, import, and manage cryptographic keys\nand perform cryptographic operations in a single centralized cloud service.\nYou can use these keys and perform these operations by using\nCloud KMS directly, by using Cloud HSM or Cloud External Key Manager, or by\nusing Customer-Managed Encryption Keys (CMEK) integrations within other\nGoogle Cloud services.\n\n\nWith Cloud KMS you are the ultimate custodian of your data, you\ncan manage cryptographic keys in the cloud in the same ways you do\non-premises, and you have a provable and monitorable root of trust over your\ndata.\n[Get started for free](https://console.cloud.google.com/freetrial) \n\n#### Start your proof of concept with $300 in free credit\n\n- Get access to Gemini 2.0 Flash Thinking\n- Free monthly usage of popular products, including AI APIs and BigQuery\n- No automatic charges, no commitment \n[View free product offers](/free/docs/free-cloud-features#free-tier) \n\n#### Keep exploring with 20+ always-free products\n\n\nAccess 20+ free products for common use cases, including AI APIs, VMs, data warehouses,\nand more.\n\nDocumentation resources\n-----------------------\n\nFind quickstarts and guides, review key references, and get help with common issues. \nformat_list_numbered\n\n### Guides\n\n-\n\n [Quickstart: Create encryption keys with Cloud KMS](/kms/docs/create-encryption-keys)\n\n-\n\n [Encrypting and decrypting data with a symmetric key](/kms/docs/encrypt-decrypt)\n\n-\n\n [Encrypting and decrypting data with an asymmetric key](/kms/docs/encrypt-decrypt-rsa)\n\n-\n\n [Cloud HSM](/kms/docs/hsm)\n\n-\n\n [Creating symmetric keys](/kms/docs/creating-keys)\n\n-\n\n [Cloud External Key Manager](/kms/docs/ekm)\n\n-\n\n [Importing a key into Cloud KMS](/kms/docs/importing-a-key)\n\n-\n\n [Retrieving a public key](/kms/docs/retrieve-public-key)\n\n-\n\n [Destroying and restoring key versions](/kms/docs/destroy-restore)\n\nfind_in_page\n\n### Reference\n\n-\n\n [Permissions and roles](/kms/docs/reference/permissions-and-roles)\n\n-\n\n [Cloud KMS API client libraries](/kms/docs/reference/libraries)\n\n-\n\n [PKCS #11 library](/kms/docs/reference/pkcs11-library)\n\n-\n\n [REST API](/kms/docs/reference/rest)\n\n-\n\n [RPC API](/kms/docs/reference/rpc)\n\n-\n\n [Cloud EKM error reference](/kms/docs/reference/ekm_errors)\n\n-\n\n [Service APIs Overview](/kms/docs/reference/service-apis-overview)\n\ninfo\n\n### Resources\n\n-\n\n [Pricing](/kms/pricing)\n\n-\n\n [Quotas](/kms/quotas)\n\n-\n\n [Release notes](/kms/docs/release-notes)\n\nRelated resources\n-----------------\n\nTraining and tutorials \nUse cases \nCode samples \nExplore self-paced training, use cases, reference architectures, and code samples with examples of how to use and connect Google Cloud services. Training \nTraining and tutorials\n\n### Encrypt and decrypt data with KMS\n\n\nThis tutorial teaches you how to encrypt and decrypt data using symmetric Cloud KMS keys.\n\n\n[Learn more](https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms) \nTraining \nTraining and tutorials\n\n### Security in Google Cloud\n\n\nExplore and deploy the components of a secure Google Cloud solution through hands on labs. Learn best practices for securing applications and data and mitigation techniques for attacks at many points in a Google Cloud-based infrastructure, including Distributed Denial-of-Service attacks, phishing attacks, and threats involving content classification and use.\n\n\n[Learn more](/training/course/security-in-google-cloud-platform) \nTraining \nTraining and tutorials\n\n### Getting started with KMS\n\n\nIn this lab you'll learn how to use some advanced features of Google Cloud Security and Privacy APIs, including: setting up a secure Cloud Storage bucket, managing keys and encrypted data, and viewing Cloud Storage audit logs.\n\n\n[Learn more](https://www.cloudskillsboost.google/focuses/1713?parent=catalog) \nUse case \nUse cases\n\n### Tokenizing sensitive cardholder data for PCI DSS\n\n\nShows how to set up an access-controlled credit and debit card tokenization service on Cloud Functions. To set up the service, the article uses IAM, Cloud KMS, and Datastore.\n\nPCI DSS Functions Datastore\n\n\u003cbr /\u003e\n\n[Learn more](/solutions/tokenizing-sensitive-cardholder-data-for-pci-dss) \nUse case \nUse cases\n\n### PCI Data Security Standard Compliance\n\n\nLearn how to implement the Payment Card Industry Data Security Standard (PCI DSS) for your business on Google Cloud.\n\nPCI DSS Compliance Security\n\n\u003cbr /\u003e\n\n[Learn more](/solutions/pci-dss-compliance-in-gcp) \nCode sample \nCode Samples\n\n### Python samples\n\n\nPython code samples and snippets\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/python-docs-samples/tree/main/kms/snippets) \nCode sample \nCode Samples\n\n### Node.js samples\n\n\nA robust set of Node.js samples.\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/nodejs-docs-samples/tree/main/kms) \nCode sample \nCode Samples\n\n### Go samples\n\n\nA list of Go samples\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/golang-samples/tree/master/kms) \nCode sample \nCode Samples\n\n### .NET samples\n\n\nSamples for .NET and KMS.\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/dotnet-docs-samples/tree/master/kms/api/Kms.Samples) \nCode sample \nCode Samples\n\n### PHP samples\n\n\nPHP code samples for KMS\n\n\n[Open GitHub\narrow_forward](https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/kms) \nCode sample \nCode Samples\n\n### Ruby samples\n\n\nRuby samples for KMS\n\n\n[Open GitHub\narrow_forward](https://github.com/googleapis/google-cloud-ruby/tree/master/google-cloud-kms/samples)\n\nRelated videos\n--------------"]]
