Upload coordinated external keys using VPC to store them in your crypto space. You can manage most coordinated external keys in Google Cloud using

  • Google Cloud console
  • gcloud CLI 
  • Cloud KMS API 
  • Cloud KMS client libraries
  • Procedure 

To create coordinated EKM CloudKeys

  1. Log in to the Cryptographic Security Platform Vault for Cloud Keys webGUI using an account with Cloud Admin privileges.

  2. In the top menu bar, click CloudKeys.

  3. Create a Cloud Service Provider account and a KeySet.  

    • The KeySet UUID becomes the crypto space ID.

    • The Crypto Space Path is displayed on the Key Sets details tab:

      v5/cryptospaces/<keyset_uuid>

  4. Create an EKM connection in the Google Cloud console

  5. Set the EKM management node to Cloud KMS.

  6. During setup, authorize your Google Cloud project service account to access your crypto space in CSP Vault for Cloud Keys using the EKM access control list in the Cloud Service Provider account. 

    For more information on creating an EKM connection, see https://cloud.google.com/kms/docs/create-ekm-connection

  7. Optionally, create a Key Access Justification policy in the Cloud Service Provider account.