Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara memperbarui kunci Media CDN yang digunakan untuk permintaan
yang ditandatangani. Anda dapat memiliki hingga tiga kunci publik dan tiga kunci bersama validasi,
dengan total enam kunci per kumpulan kunci. Untuk mencegah melebihi batas tersebut selama
rotasi kunci, lihat petunjuk berikut tentang cara menghapus kunci bersama
validasi dan cara menambahkan kunci.
Pilih kumpulan kunci yang memiliki secret yang ingin Anda hapus, lalu
klik Edit.
Untuk menghapus secret, di bagian Keys > Validation shared keys,
klik deleteDelete di samping nama secret.
Klik Perbarui kumpulan kunci.
gcloud
Untuk menghapus kunci rahasia dari kumpulan kunci, gunakan perintah gcloud edge-cache keysets
update. Hapus
kumpulan kunci yang ingin Anda hapus dan tentukan kumpulan kunci yang ingin Anda simpan.
Dalam contoh berikut, KEY_VERSION_1
tidak tercantum, sedangkan KEY_VERSION_2 dan
KEY_VERSION_3 tercantum. Menghapus
KEY_VERSION_1 akan menghapusnya dari kumpulan kunci.
KEYSET_NAME: nama
kumpulan kunci Anda—misalnya, prod-vod-keyset
FILENAME: nama file YAML
Edit file konfigurasi kumpulan kunci yang diekspor untuk menghapus kunci rahasia.
Contoh berikut menunjukkan cara menghapus kunci rahasia terlama,
yang diakhiri dengan KEY_VERSION_1:
Pilih kumpulan kunci yang ingin Anda tambahkan secret, lalu klik
Edit.
Untuk menambahkan secret, di bagian Kunci > Kunci bersama validasi,
klik Secret. Kemudian, pilih secret dari daftar,
masukkan secret secara manual dengan menentukan ID resource-nya, atau
buat secret baru,
lalu pilih secret tersebut.
Pilih versi secret dari daftar atau buat versi secret baru, lalu pilih versi secret tersebut.
Klik Perbarui kumpulan kunci.
gcloud
Untuk menambahkan kunci rahasia ke kumpulan kunci, gunakan perintah
gcloud edge-cache keysets update. Tentukan
kumpulan kunci yang Anda miliki dan kumpulan kunci yang ingin ditambahkan.
Dalam contoh berikut, KEY_VERSION_1 sebelumnya telah dihapus dan KEY_VERSION_4 adalah kumpulan kunci yang ditambahkan. Mencantumkan KEY_VERSION_4 selain
KEY_VERSION_2 dan
KEY_VERSION_3 akan menambahkannya ke kumpulan kunci.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Rotate secrets\n\nThis page describes how to update Media CDN keys used for signed\nrequests. You can have up to three public keys and three validation shared keys,\nfor a total of six keys per keyset. To prevent exceeding those limits during a\nkey rotation, see the following instructions about how to delete a validation\nshared key and how to add a key.\n\nBefore you begin\n----------------\n\n1. [Configure your validation shared keys in Secret Manager](/secret-manager/docs/configuring-secret-manager).\n\n2. Grant the [Secret Manager Access role](/iam/docs/understanding-roles#secret-manager-roles)\n (`roles/secretmanager.secretAccessor`) to the Media CDN\n service account.\n\n ### Console\n\n 1. In the Google Cloud console,\n go to the **Secret Manager** page.\n\n [Go to Secret Manager](https://console.cloud.google.com/security/secret-manager)\n 2. Select the secret.\n 3. In the info panel, click **Add principal**.\n 4. For **New principals** , enter the Media CDN\n service account as follows: \n\n `service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-mediaedgefill.iam.gserviceaccount.com`\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e with your\n project number.\n 5. For **Select a role** , select **Secret Manager** , and then select **Secret Manager Secret Accessor**.\n 6. Click **Save**.\n\n ### gcloud\n\n Use the [`gcloud secrets add-iam-policy-binding` command](/sdk/gcloud/reference/secrets/add-iam-policy-binding): \n\n ```\n gcloud secrets add-iam-policy-binding projects/PROJECT_NUMBER/secrets/SECRET_ID \\\n --member=\"serviceAccount:service-PROJECT_NUMBER@gcp-sa-mediaedgefill.iam.gserviceaccount.com\" \\\n --role=\"roles/secretmanager.secretAccessor\"\n \n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: your project number\n - \u003cvar translate=\"no\"\u003eSECRET_ID\u003c/var\u003e: the ID of the secret\n\nDelete a secret\n---------------\n\n### Console\n\n1. In the Google Cloud console, go to the **Media CDN** page.\n\n [Go to Media CDN](https://console.cloud.google.com/net-services/media-cdn)\n2. Click the **Keysets** tab.\n\n3. Select the keyset that has the secret that you want to delete, and then\n click **Edit**.\n\n4. To delete a secret, in the **Keys \\\u003e Validation shared keys** section,\n click delete\n **Delete** next to the secret name.\n\n5. Click **Update keyset**.\n\n### gcloud\n\nTo delete a secret key from a keyset, use the [`gcloud edge-cache keysets\nupdate` command](/sdk/gcloud/reference/edge-cache/keysets/update). Omit the\nkeyset that you want to delete and specify the keysets that you want to keep.\n\nIn the following example, \u003cvar translate=\"no\"\u003eKEY_VERSION_1\u003c/var\u003e\nisn't listed, while \u003cvar translate=\"no\"\u003eKEY_VERSION_2\u003c/var\u003e and\n\u003cvar translate=\"no\"\u003eKEY_VERSION_3\u003c/var\u003e are listed. Omitting\n\u003cvar translate=\"no\"\u003eKEY_VERSION_1\u003c/var\u003e deletes it from the keyset. \n\n```\ngcloud edge-cache keysets update KEYSET_NAME \\\n --validation-shared-key='secret_version=projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_2'\n --validation-shared-key='secret_version=projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_3'\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eKEYSET_NAME\u003c/var\u003e: the name of the keyset\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: your project number\n- \u003cvar translate=\"no\"\u003eSECRET_ID\u003c/var\u003e: the ID of the secret that you're updating\n- \u003cvar translate=\"no\"\u003eKEY_VERSION\u003c/var\u003e: the key version\n\n### text editor\n\n1. Export your keyset to a YAML file. Use the\n [`gcloud edge-cache keysets export` command](/sdk/gcloud/reference/edge-cache/keysets/export).\n\n ```\n gcloud edge-cache keysets export KEYSET_NAME \\\n --destination=FILENAME.yaml\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEYSET_NAME\u003c/var\u003e: the name of your keyset---for example, `prod-vod-keyset`\n - \u003cvar translate=\"no\"\u003eFILENAME\u003c/var\u003e: the YAML filename\n2. Edit the exported keyset configuration file to remove the secret key.\n The following example shows how to remove the oldest secret key,\n which ends in \u003cvar translate=\"no\"\u003eKEY_VERSION_1\u003c/var\u003e:\n\n ```\n name: projects/my-project/locations/global/edgeCacheKeysets/prod-vod-keyset\n validationSharedKeys:\n - secretVersion: \"projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_1\"\n - secretVersion: \"projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_2\"\n - secretVersion: \"projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_3\"\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: your project number\n - \u003cvar translate=\"no\"\u003eSECRET_ID\u003c/var\u003e: the ID of the secret that you're updating\n - \u003cvar translate=\"no\"\u003eKEY_VERSION\u003c/var\u003e: the key version\n\n The edited file looks similar to the following: \n\n ```\n name: projects/my-project/locations/global/edgeCacheKeysets/prod-vod-keyset\n validationSharedKeys:\n - secretVersion: \"projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_2\"\n - secretVersion: \"projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_3\"\n ```\n3. Import the edited keyset. Use the\n [`gcloud edge-cache keysets import` command](/sdk/gcloud/reference/edge-cache/keysets/import):\n\n ```\n gcloud edge-cache keysets import KEYSET_NAME \\\n --source=FILENAME.yaml\n ```\n\nAdd a secret\n------------\n\n### Console\n\n1. In the Google Cloud console, go to the **Media CDN** page.\n\n [Go to Media CDN](https://console.cloud.google.com/net-services/media-cdn)\n2. Click the **Keysets** tab.\n\n3. Select the keyset for which you want to add a secret, and then click\n **Edit**.\n\n4. To add a secret, in the **Keys \\\u003e Validation shared keys** section,\n click **Secret** . Then, select a secret from the list,\n enter a secret manually by specifying its resource ID, or\n [create a new secret](/secret-manager/docs/create-secret-quickstart#create_a_secret_and_access_a_secret_version)\n and then select it.\n\n5. Select a secret version from the list or [create a new secret version](/secret-manager/docs/add-secret-version#add-secret-version),\n and then select it.\n\n6. Click **Update keyset**.\n\n### gcloud\n\nTo add a secret key to a keyset, use the [`gcloud edge-cache keysets update`\ncommand](/sdk/gcloud/reference/edge-cache/keysets/update). Specify the\nkeysets that you have and the keyset that you want to add.\n\nIn the following example, \u003cvar translate=\"no\"\u003eKEY_VERSION_1\u003c/var\u003e was\npreviously deleted and \u003cvar translate=\"no\"\u003eKEY_VERSION_4\u003c/var\u003e is the\nkeyset being added. Listing \u003cvar translate=\"no\"\u003eKEY_VERSION_4\u003c/var\u003e in\naddition to \u003cvar translate=\"no\"\u003eKEY_VERSION_2\u003c/var\u003e and\n\u003cvar translate=\"no\"\u003eKEY_VERSION_3\u003c/var\u003e adds it to the keyset. \n\n```\ngcloud edge-cache keysets update KEYSET_NAME \\\n --validation-shared-key='secret_version=projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_2'\n --validation-shared-key='secret_version=projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_3'\n --validation-shared-key='secret_version=projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_4'\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eKEYSET_NAME\u003c/var\u003e: the name of the keyset\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: your project number\n- \u003cvar translate=\"no\"\u003eSECRET_ID\u003c/var\u003e: the ID of the secret that you're updating\n- \u003cvar translate=\"no\"\u003eKEY_VERSION\u003c/var\u003e: the key version\n\n### text editor\n\n1. Export your keyset to a YAML file. Use the\n [`gcloud edge-cache keysets export` command](/sdk/gcloud/reference/edge-cache/keysets/export).\n\n ```\n gcloud edge-cache keysets export KEYSET_NAME \\\n --destination=FILENAME.yaml\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eKEYSET_NAME\u003c/var\u003e: the name of your keyset\n - \u003cvar translate=\"no\"\u003eFILENAME\u003c/var\u003e: the YAML filename\n2. In the exported keyset configuration file, add a new `secretVersion`\n line that includes a new key version, similar to the following:\n\n ```\n name: projects/my-project/locations/global/edgeCacheKeysets/prod-vod-keyset\n validationSharedKeys:\n - secretVersion: \"projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_2\"\n - secretVersion: \"projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_3\"\n - secretVersion: \"projects/PROJECT_NUMBER/secrets/SECRET_ID/versions/KEY_VERSION_4\"\n ```\n3. Import the edited keyset. Use the\n [`gcloud edge-cache keysets import` command](/sdk/gcloud/reference/edge-cache/keysets/import):\n\n ```\n gcloud edge-cache keysets import KEYSET_NAME \\\n --source=FILENAME.yaml\n ```"]]
