[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-17。"],[],[],null,["# Apply a CMEK organization policy\n\nGoogle Cloud offers two organization policy constraints to enforce CMEK usage\nacross an organization:\n\n- `constraints/gcp.restrictNonCmekServices` is used to require CMEK\n protection.\n\n- `constraints/gcp.restrictCmekCryptoKeyProjects` is used to limit which\n CMEK keys are used for protection.\n\nCMEK organization policies only apply to newly created resources within\n[supported Google Cloud services](/kms/docs/cmek-org-policy#supported-services).\n\nFor more information about how this works, see\n[Google Cloud resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy)\nand [CMEK organization policies](/kms/docs/cmek-org-policy).\n\nControl CMEK use with an organization policy\n--------------------------------------------\n\nNetApp Volumes integrates with CMEK\n[organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints)\nto let you specify encryption compliance requirements for NetApp Volumes\nresources in your organization.\n\nThis integration lets you do the following:\n\n- [Require CMEKs for all NetApp Volumes resources](#resources-constraint).\n\n- [Restrict which Cloud KMS keys can be used to protect resources in a\n project](#key-constraint).\n\n### Require CMEKs for all NetApp Volumes resources\n\nA common policy is to require CMEKs to be used to protect all resources in an\norganization. You can use the `constraints/gcp.restrictNonCmekServices`\nconstraint to enforce this policy in NetApp Volumes.\n\nIf set, this organization policy causes all resource creation requests without a\nspecified Cloud KMS key to fail.\n\nAfter you set this policy, it applies only to new resources in the project. Any\nexisting resources without Cloud KMS keys set continue to exist and are\naccessible without issue.\n\nUse the following instructions to enforce CMEK use for\nNetApp Volumes resources using the Google Cloud console or\nGoogle Cloud CLI. \n\n### Console\n\n1. Open the **Organization policies** page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies/list)\n2. In the **Filter** field, enter\n `constraints/gcp.restrictNonCmekServices`, and then click\n **Restrict which services may create resources without CMEK**.\n\n3. Click edit **Manage Policy**.\n\n4. On the **Edit policy** page, select **Override parent's policy**.\n\n5. Select **Add a rule**.\n\n6. Under **Policy values** , select **Custom**.\n\n7. Under **Policy type** , select **Deny**.\n\n8. In the **Custom values** field, enter `is:netapp.googleapis.com`.\n\n9. Click **Done** , and then click **Set policy**.\n\n### gcloud\n\n1. Create a temporary file `/tmp/policy.yaml` to store the policy:\n\n ```yaml\n name: projects/PROJECT_ID/policies/gcp.restrictNonCmekServices\n spec:\n rules:\n - values:\n deniedValues:\n - is:netapp.googleapis.com\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the project ID of the project you\n want to use.\n2. Run the `org-policies set-policy` command:\n\n ```sh\n gcloud org-policies set-policy /tmp/policy.yaml\n ```\n\nTo verify that the policy is successfully applied, you can try to create a\nstorage pool in the project. The process fails unless you specify a\nCloud KMS key.\n\n### Restrict Cloud KMS keys for NetApp Volumes project\n\nYou can use the `constraints/gcp.restrictCmekCryptoKeyProjects` constraint to\nrestrict the Cloud KMS keys that you can use to protect a resource for\nNetApp Volumes project.\n\nYou might specify a rule, for example, \"For all NetApp Volumes\nresources in projects/my-company-data-project, Cloud KMS keys used in\nthis project must come from projects/my-company-central-keys OR\nprojects/team-specific-keys.\"\n\nUse the following instructions to enforce Cloud KMS keys for\nNetApp Volumes project using the Google Cloud console or\nGoogle Cloud CLI. \n\n### Console\n\n1. Open the **Organization policies** page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies/list)\n2. In the **Filter** field, enter\n `constraints/gcp.restrictCmekCryptoKeyProjects`, and then click\n **Restrict which projects may supply KMS CryptoKeys for CMEK**.\n\n3. Click edit **Manage Policy**.\n\n4. On the **Edit policy** page, select **Override parent's policy**.\n\n5. Select **Add a rule**.\n\n6. Under **Policy values** , select **Custom**.\n\n7. Under **Policy type** , select **Allow**.\n\n8. In the **Custom values** field, enter the following:\n\n under:projects/\u003cvar translate=\"no\"\u003eKMS_PROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eKMS_PROJECT_ID\u003c/var\u003e with the project ID where the\n Cloud KMS keys you want to use are located.\n\n For example, `under:projects/my-kms-project`.\n9. Click **Done** , and then click **Set policy**.\n\n### gcloud\n\n1. Create a temporary file `/tmp/policy.yaml` to store the policy:\n\n ```yaml\n name: projects/PROJECT_ID/policies/gcp.restrictCmekCryptoKeyProjects\n spec:\n rules:\n - values:\n allowedValues:\n - under:projects/KMS_PROJECT_ID\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID of the project you want to use.\n - \u003cvar translate=\"no\"\u003eKMS_PROJECT_ID\u003c/var\u003e is the project ID where the Cloud KMS keys you want to use are located.\n2. Run the `org-policies set-policy` command:\n\n ```sh\n gcloud org-policies set-policy /tmp/policy.yaml\n ```\n\nTo verify that the policy is successfully applied, you can try to create a\nstorage pool using a Cloud KMS key from a different project. The\nprocess will fail.\n\nLimitations\n-----------\n\nThe following limitations apply when setting an organization policy.\n\n### Existing resources\n\nExisting resources are not subject to newly created organization policies.\nFor example, if you create an organization policy that requires you to specify a\nCMEK for every `create` operation, the policy doesn't retroactively apply to\nexisting instances and backup chains. Those resources are still accessible\nwithout a CMEK. If you want to apply the policy to existing resources such as\nstorage pools, you must replace them.\n\n### Required permissions to set an organization policy\n\nYou need the [Organization Policy Administrator role](/resource-manager/docs/organization-policy/using-constraints#required-roles)\ngranted at the organization level in order to set or update the organization\npolicy for testing purposes.\n\nYou can still specify a policy that only applies to a specific project or\nfolder.\n\nImpact of Cloud KMS key rotation\n--------------------------------\n\nNetApp Volumes doesn't automatically rotate a resource's\nencryption key when the Cloud KMS key associated with that resource is\nrotated.\n\n- All data in existing storage pools continues to be protected by the key\n version with which they were created.\n\n- Any newly-created storage pools use the primary key version specified at the\n time of their creation.\n\nWhen you rotate a key, data that was encrypted with previous key versions isn't\nautomatically re-encrypted. To encrypt your data with the latest key version,\nyou must decrypt the old key version from the resource, and then re-encrypt the\nsame resource with the new key version. In addition, rotating a key doesn't\nautomatically disable or destroy any existing key versions.\n\nFor detailed instructions on how to perform each of these tasks, see the\nfollowing guides:\n\n- [Rotate a key](/kms/docs/rotate-key)\n- [Decrypt and re-encrypt data](/kms/docs/re-encrypt-data)\n- [Enable and disable key versions](/kms/docs/enable-disable)\n- [Destroy and restore key versions](/kms/docs/destroy-restore)\n\n### NetApp Volumes access to the Cloud KMS key\n\nA Cloud KMS key is considered available and accessible by\nNetApp Volumes under the following conditions:\n\n- The key is [enabled](/kms/docs/key-states#enabled)\n- The NetApp Volumes service account has encrypt and decrypt permissions on the key\n\nWhat's next\n-----------\n\n- Learn about [CMEK](/kms/docs/cmek).\n- Learn about [organization policies](/resource-manager/docs/organization-policy/overview).\n- Learn about [CMEK organization policies](/kms/docs/cmek-org-policy)."]]
