[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-17。"],[],[],null,["# Manage customer-managed encryption key policies\n\nThis page describes the use of customer-managed encryption keys (CMEK) to\nmanage Google Cloud NetApp Volumes.\n\nAbout CMEK\n----------\n\nNetApp Volumes always encrypts your data with\nvolume-specific keys. NetApp Volumes always encrypts your\ndata at rest.\n\nWith CMEK, Cloud Key Management Service wraps your stored\nvolume keys. This feature gives you greater control over the encryption keys\nyou use and the added security of storing the\nkeys on a system or in a location different from the data.\nNetApp Volumes supports Cloud Key Management Service capabilities such as\nhardware security modules, and the full key management lifecycle of generate,\nuse, rotate, and destroy.\n\nNetApp Volumes supports one CMEK policy per region. A CMEK\npolicy attaches to a storage pool and all volumes created in that pool use\nit. You can have a mix of storage pools with and without CMEK policies in a\nregion. If you have pools without CMEK in a specific region, you can\nconvert them to CMEK by using the migration action of a region's CMEK policy.\n\nThe use of CMEK is optional. If used, CMEK policies\nare region-specific. You can only configure one policy per region.\n\nConsiderations\n--------------\n\nThe following sections include limitations for CMEK to consider.\n\n### Key management\n\nUsing CMEK makes you solely responsible for your keys and your data.\n| **Important:** When you destroy or deactivate configured Cloud KMS keys, it prevents you from creating or accessing volumes and their data. Neither Google nor NetApp can help you to recover the volume data if this happens.\n\n### Cloud KMS configurations\n\nCMEK uses symmetric keys for encryption and decryption.\nAfter all volumes are deleted in a region for a project, the Cloud KMS\nconfiguration returns to a `Ready` created state. It's used again when\nyou create the next volume in that region.\n\n### Regional key rings\n\nNetApp Volumes only supports regional KMS key rings and they need\nto reside in the same region as the CMEK policy.\n\n### Service level\n\nCMEK supports the Flex, Standard, Premium, and Extreme service levels storage\npools.\n\n### VPC Service Controls\n\nWhen you use VPC Service Controls, make sure to consider [Limitations of VPC Service Controls for NetApp Volumes](/netapp/volumes/docs/before-you-begin/service-perimeter#limitations).\n\nCMEK organization policy\n------------------------\n\nThe CMEK [organization policy](/resource-manager/docs/organization-policy/overview)\nfor NetApp Volumes gives organizations control over data\nencryption keys and restricts which keys can be used for CMEK. This is achieved\nby enforcing CMEK usage for encrypting data at rest in new storage pools and\nallowing organizations to manage encryption keys using Cloud KMS. The\norganization policy is enforced at storage pool creation and doesn't affect\nexisting storage pools.\n\nOrganization policies allow [administrators](/resource-manager/docs/organization-policy/using-constraints#add-org-policy-admin)\nto apply and enforce consistent [constraints](/resource-manager/docs/organization-policy/org-policy-constraints)\nacross all projects and resources. This is important for organizations that\nmanage multiple projects and resources to enforce standardized policies.\n\nThere are two types of organization policy constraints that can be applied to\nCMEK:\n\n- **Restrict Non-CMEK Services**: lets you specify which services within an\n organization, project, or folder can be configured without CMEK. If you add a\n service to the deny list or exclude it in the allow list, then resources for\n that service will require CMEK. By default, this constraint allows the\n creation of non-CMEK resources.\n\n- **Restrict CMEK CryptoKey Projects** : lets you define which projects can\n provide [KMS keys](/kms/docs/object-hierarchy#key) for [CMEK](/kms/docs/using-other-products)\n when configuring resources within the organization, project, or folder. If\n this constraint is set, only KMS keys from the specified projects can be used\n for CMEK protected resources. If the constraint is not set, CryptoKeys from\n any project can be used.\n\nFor more information about how to apply an organization policy, see\n[Apply a CMEK organization policy](/netapp/volumes/docs/configure-and-use/cmek/apply-CMEK-organization-policy).\n\nCMEK options\n------------\n\nNetApp Volumes offers support for CMEKs, which can be stored as\nsoftware keys, hardware keys within an [HSM cluster](/kms/docs/hsm), or as\nexternal keys stored in [Cloud External Key Manager (Cloud EKM)](/kms/docs/ekm).\n\nFor more information, see [Cloud Key Management Service](/kms/docs/key-management-service#cmek).\n\n### Disruptions to EKM service\n\nExternal keys are managed by a third-party, and Google Cloud isn't\nresponsible for key availability.\n\nIf the [External Key Manager (EKM)](/kms/docs/ekm#terminology) notifies\n[Cloud Key Management Service](/kms/docs/key-management-service) that an external key is\nunreachable, users receive a detailed error about the key's current state. This\ncauses volumes to go offline, and all read and write operations to the volume\nwill fail.\n\nUsers also receive an error if any of the following operations are attempted\nwhile EKM is unreachable:\n\n- [Create a storage pool](/netapp/volumes/docs/configure-and-use/storage-pools/create-storage-pool)\n\n- [Create a volume](/netapp/volumes/docs/configure-and-use/volumes/create-volume)\n\n- [Create a snapshot](/netapp/volumes/docs/configure-and-use/volume-snapshots/create-manual-snapshots)\n\n- [Create a backup](/netapp/volumes/docs/protect-data/create-backup)\n\n- [Mount a volume](/netapp/volumes/docs/get-started/quickstarts/mount-volume#mount_your_volume_on_a_client)\n\n- [Create a volume replication](/netapp/volumes/docs/protect-data/create-volume-replication)\n\n- [Delete a snapshot](/netapp/volumes/docs/configure-and-use/volume-snapshots/delete-snapshot)\n\n- [Delete a volume](/netapp/volumes/docs/configure-and-use/volumes/manage-volume#delete_a_volume)\n\n- [Delete a volume replication](/netapp/volumes/docs/protect-data/manage-replication#delete_a_volume_replication)\n\n- [Stop a replication](/netapp/volumes/docs/protect-data/stop-or-resume-replication#stop_a_replication)\n\n- [Reverse and resume a replication](/netapp/volumes/docs/protect-data/reverse-and-resume-replication)\n\nWhat's next\n-----------\n\n[Create a CMEK policy](/netapp/volumes/docs/configure-and-use/cmek/create-cmek-policy)."]]
