[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Customer-managed encryption keys\n\nIf you're using Secret Manager to store and pass your Amazon S3 or\nMicrosoft Azure credentials, you can additionally use a\n[customer-managed encryption key](/kms/docs/cmek) (CMEK) to encrypt those credentials at\nrest.\n\nSee [Enable Customer-Managed Encryption Keys for Secret Manager](/secret-manager/docs/cmek)\nfor instructions.\n\nEnforce CMEK with organization policy\n-------------------------------------\n\nTo enforce the use of CMEK through an [organizational policy](/resource-manager/docs/organization-policy/overview),\nadd Storage Transfer Service and Secret Manager to the\n`constraints/gcp.restrictNonCmekServices` deny list. Specifically, add:\n\n- `secretmanager.googleapis.com`\n- `storagetransfer.googleapis.com`\n\nSee [Creating and managing organization policies](/resource-manager/docs/organization-policy/creating-managing-policies) for\ninstructions.\n\nStorage Transfer Service checks for and enforces this restriction at job creation and\nupdate. Existing transfer jobs are not affected."]]
