问题跟踪器是 Google 及其合作伙伴用来跟踪专门项目的请求的工具。对于 TSI 管理的 Cloud Key Management Service 项目，您可以使用问题跟踪器向 TSI 提交请求，TSI 会在您的 Cloud Key Management Service 项目中执行请求，并在外部密钥管理器中管理您的密钥。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[],[],null,["# TSI-managed key operations\n\n| **Important:** Documentation for the latest version of T-Systems International (TSI)'s partnered offering ---Sovereign Controls by T-Systems--- is available here: [Sovereign Controls by Partners](/sovereign-controls-by-partners/docs/overview)\n\nAs a T-Systems Sovereign Cloud customer, you use a different workflow to manage your\nCloud External Key Manager (Cloud EKM) keys. Instead of setting up and managing your\nown external key manager, Google Cloud and T-Systems International (TSI)\nhandle these steps for you. This means that TSI manages your keys\nand key versions at your request.\n\nThis topic covers how to submit requests for common key operations in a\nTSI-managed Cloud Key Management Service project, commonly known as the **Key\nManagement Project**.\n\nBefore you begin\n----------------\n\nYou need to have a key ring with at least one key before making key operation\nrequests. If you need a new key ring and key, use the steps in\n[Getting started with TSI-managed Cloud KMS](/t-systems-sovereign-cloud/docs/getting-started-kms).\n\n### Get the key's resource name\n\nFor any key operation request, you need to\n[provide the resource name](/kms/docs/getting-resource-ids#getting_the_id_for_a_key_and_version)\nof the key or key version to be modified.\n\n- You need to provide the **key** resource name to create a version or rotate a key.\n- You need to provide the **key version** resource name to update or destroy a key version.\n\n### Issue Tracker requests\n\nIssue Tracker is a tool used by Google and its partners to track requests for\nspecialized projects. For TSI-managed Cloud Key Management Service projects, you\nuse the Issue Tracker to submit requests to TSI who then fulfills\nrequests in your Cloud Key Management Service project and manages your keys in the external key\nmanager.\n\nYou can find a link to your organization's Issue Tracker in your welcome email.\n\nCommon key operations\n---------------------\n\n### Create a key version\n\nUse the Issue Tracker to submit a request for a new key version. The new key\nversion is set as the primary version if it's the first key version, or if there\nare no other key versions.\n\nIn the Issue Tracker, select **Create key version** and provide the resource\nname of your key. Click **Create** to submit your request.\n\n### Rotate key\n\nIn the Issue Tracker, indicate **Rotate key** in the ticket body and provide the\nresource name of your key. Click **Create** to submit your request.\n\nWhen a key is rotated, TSI generates new key material in the EKM,\ncreates a new key version in your Cloud Key Management Service project, and then sets the new\nkey version as the primary version.\n\nRotating a key version causes all newly-created data protected with that key to\nbe encrypted with new key material. Data protected with previous key material is\nnot re-encrypted. As a result, your previous key material needs to remain\navailable for use.\n\n### Disable a key version\n\nYou can use the Google Cloud console, Google Cloud CLI, or a Cloud KMS\nclient library to disable a key version in the **Enabled** state. When you\ndisable a key version, its state changes to **Disabled** . See\n[Enabling and disabling key versions](/kms/docs/enable-disable#disable) in the\nCloud KMS documentation for more information.\n| **Note:** Key versions in the **Disabled** state are billed as active key versions.\n\n### Destroy a key version\n\n| **Caution:** Destroying a key is a permanent operation that can cause unrecoverable data loss. All key destruction actions will be permanent, and once destroyed, the key will be unrecoverable by you, TSI, or Google. Data that was encrypted with the key cannot be accessed.\n\nTo destroy a key version,\n[schedule the key version for destruction](/kms/docs/destroy-restore#destroy) in\nCloud KMS. This destroys the Cloud KMS key and data encrypted\nby the key will no longer be accessible.\n\nIf you'd also like to destroy the key in TSI's EKM:\n\n1. [Schedule the key version for destruction](/kms/docs/destroy-restore#destroy).\n2. In the Issue Tracker, select **Destroy key version** in the ticket body and provide the resource name of the key version you would like to have destroyed.\n3. Click **Create** to submit your request.\n\nTSI confirms your key destruction request with you before\nproceeding. When destruction is confirmed, TSI provides a date\nand time for when the key will be destroyed. You can restore the key before the\ndestruction.\n\nIn the period before the key is destroyed, if you\n[restore your key version](/kms/docs/destroy-restore#restore), both the\nCloud KMS key and the key in TSI's EKM will remain.\n\nIf the destruction continues as scheduled, the Cloud KMS key is deleted\nfirst, and then the key in TSI's EKM is deleted.\n\nResponse time\n-------------\n\nUse the Issue Tracker for routine key management operations only. Once an Issue\nTracker request is submitted, you can expect to receive a response from your\npartner within one business day.\n\nSee also\n--------\n\n- [Getting started with TSI-managed Cloud KMS](/t-systems-sovereign-cloud/docs/getting-started-kms)"]]
