T-Systems Sovereign Cloud (TSI Sovereign Cloud) 为范围内的 Google Cloud 服务提供数据驻留和数据主权功能。为了提供这些功能，其中一些服务的功能受到限制。当您的组织由 T-Systems International (TSI) 管理时，大部分更改会在初始配置过程中应用，但其中一些更改稍后可通过修改组织政策来完成。
请务必了解这些限制如何修改给定 Google Cloud 服务的行为，或者如何影响数据主权或数据驻留。例如，系统会自动停用某些功能或能力，以确保保持数据主权和数据驻留。此外，如果更改组织政策设置，则可能出现将数据从一个区域复制到另一个区域的意外后果。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[],[],null,["# Restrictions and limitations in T-Systems Sovereign Cloud\n\n| **Important:** Documentation for the latest version of T-Systems International (TSI)'s partnered offering ---Sovereign Controls by T-Systems--- is available here: [Sovereign Controls by Partners](/sovereign-controls-by-partners/docs/overview)\n\nThis topic describes the restrictions, limitations, and other configuration\noptions when using T-Systems Sovereign Cloud.\n\nOverview\n--------\n\nT-Systems Sovereign Cloud (TSI Sovereign Cloud) provides data residency and data\nsovereignty features for [in-scope Google Cloud services](#services). To provide\nthese features, some of these services' features are restricted or limited. Most\nof these changes are applied during the onboarding process when your\norganization becomes managed by T-Systems International (TSI), however some\nof them can be changed later by modifying\n[organization policies](/resource-manager/docs/organization-policy/overview).\n\nIt's important to understand how these restrictions modify the behavior for a\ngiven Google Cloud service or affect data sovereignty or data residency. For\nexample, some features or capabilities may be automatically disabled to ensure\nthat data sovereignty and data residency are maintained. Additionally, if an\norganization policy setting is changed, it might have the unintended consequence\nof copying data from one region to another.\n\n### In-scope services and APIs\n\n#### Services\n\n- Compute Engine\n - [Organization policies](#org_compute)\n - [Impacted features](#features_compute)\n- Persistent Disk\n- Cloud Storage\n - [Organization policies](#org_storage)\n- Cloud SQL\n- Cloud Key Management Service (Cloud KMS)\n - [Organization policies](#org_kms)\n- Google Kubernetes Engine\n - [Organization policies](#org_gke)\n- Cloud Logging\n - [Impacted features](#features_logging)\n\n#### APIs\n\n| **Note:** Attempts to use out-of-scope APIs will result in an error, and the list of in-scope APIs in this section cannot be modified by customers of TSI Sovereign Cloud. See the [Organization policies](#org_policies) and [Impacted features](#features) sections below for more information about which APIs can be used for an in-scope service.\n\nThe following API endpoints are available in TSI Sovereign Cloud:\n\n- `accessapproval.googleapis.com`\n- `accesscontextmanager.googleapis.com`\n- `axt.googleapis.com`\n- `clientauthconfig.googleapis.com`\n- `cloudbilling.googleapis.com`\n- `cloudkms.googleapis.com`\n- `cloudnotifications.googleapis.com`\n- `cloudresourcemanager.googleapis.com`\n- `cloudsql.googleapis.com`\n- `cloudsupport.googleapis.com`\n- `compute.googleapis.com`\n- `container.googleapis.com`\n- `essentialcontacts.googleapis.com`\n- `iam.googleapis.com`\n- `logging.googleapis.com`\n- `monitoring.googleapis.com`\n- `orgpolicy.googleapis.com`\n- `servicenetworking.googleapis.com`\n- `serviceusage.googleapis.com`\n- `stackdriver.googleapis.com`\n- `storage.googleapis.com`\n- `sts.googleapis.com`\n- `vpcaccess.googleapis.com`\n\nOrganization policies\n---------------------\n\nThis section describes how each service is affected by the default organization\npolicy constraint values when folders or projects are created using\nTSI Sovereign Cloud. Other applicable constraints --- even if not set by\ndefault --- can provide additional \"defense-in-depth\" to further protect\nyour organization's Google Cloud resources.\n| **Important:** We strongly recommend not changing the values of the non-optional organization policy constraints listed in the sections below. Doing so may undermine data residency or data sovereignty. When such a change has been made, the effects of such change are difficult or impossible to reverse. Ensure that you understand the ramifications of changing its value before proceeding. \n|\n| Additionally, ensure that any automated mechanisms your organization uses to manage organization policies are updated to prevent these values from being changed unintentionally.\n\n### Cloud-wide organization policy constraints\n\nThe following\n[organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints)\napply across any applicable Google Cloud service.\n\n### Compute Engine organization policy constraints\n\n### Cloud Storage organization policy constraints\n\n### Google Kubernetes Engine organization policy constraints\n\n### Cloud Key Management Service organization policy constraints\n\nImpacted features\n-----------------\n\nThis section lists how each service's features or capabilities are impacted by\nTSI Sovereign Cloud.\n\n### Compute Engine features\n\n### Cloud Logging features\n\n#### Required additional Cloud Logging configuration for CMEK\n\nTo use Cloud Logging with Customer-Managed Encryption Keys (CMEK), you must\ncomplete the steps in the\n[Enable CMEK for an organization](https://cloud.google.com/logging/docs/routing/managed-encryption.md#enable)\ntopic in the Cloud Logging documentation.\n\n#### Impacted Cloud Logging features"]]
