Kunci Cloud KMS dengan tingkat perlindungan SOFTWARE digunakan untuk
operasi kriptografis yang dilakukan di software. Kunci Cloud KMS dapat dibuat oleh Google atau diimpor.
Kunci Cloud EKM dengan tingkat perlindungan EXTERNAL dibuat
dan disimpan dalam sistem pengelolaan kunci eksternal (EKM) Anda. Cloud EKM menyimpan materi kriptografis tambahan dan jalur ke kunci unik Anda, yang digunakan untuk mengakses kunci Anda melalui internet.
Kunci Cloud EKM dengan tingkat perlindungan EXTERNAL_VPC dibuat dan disimpan dalam sistem pengelolaan kunci eksternal (EKM) Anda.
Cloud EKM menyimpan materi kriptografi tambahan dan jalur ke kunci unik Anda, yang digunakan untuk mengakses kunci Anda melalui jaringan virtual private cloud (VPC).
Kunci dengan semua tingkat perlindungan ini memiliki fitur berikut:
Gunakan kunci Anda untuk layanan yang terintegrasi dengan kunci enkripsi yang dikelola pelanggan (CMEK).Google Cloud
Gunakan kunci Anda dengan API atau library klien Cloud KMS, tanpa kode khusus berdasarkan tingkat perlindungan kunci.
Kontrol akses ke kunci Anda menggunakan peran Identity and Access Management (IAM).
Kontrol apakah setiap versi kunci Diaktifkan atau Dinonaktifkan dari
Cloud KMS.
Operasi utama dicatat dalam log audit. Logging akses data dapat diaktifkan.
Tingkat perlindungan software
Cloud KMS menggunakan modul BoringCrypto (BCM) untuk semua operasi kriptografis untuk kunci software. BCM divalidasi FIPS 140-2. Kunci software Cloud KMS menggunakan Primitif Kriptografis BCM yang divalidasi FIPS 140-2 Level 1.
Tingkat perlindungan software adalah tingkat perlindungan yang paling murah.
Kunci software adalah pilihan yang tepat untuk kasus penggunaan yang tidak memiliki
persyaratan peraturan khusus untuk tingkat validasi FIPS 140-2 yang lebih tinggi.
Tingkat perlindungan eksternal
Kunci Cloud External Key Manager (Cloud EKM) adalah kunci yang Anda kelola di layanan partner pengelolaan kunci eksternal (EKM) yang didukung dan digunakan diGoogle Cloud layanan serta API dan library klien Cloud KMS.
Kunci Cloud EKM dapat didukung software atau hardware, bergantung pada penyedia EKM Anda. Anda dapat menggunakan kunci Cloud EKM di layanan yang terintegrasi dengan CMEK atau menggunakan API dan library klien Cloud KMS.
Tingkat perlindungan Cloud EKM adalah yang paling mahal.
Saat Anda menggunakan kunci Cloud EKM, Anda dapat yakin
bahwa Google Cloud tidak dapat mengakses materi kunci Anda.
Untuk melihat layanan yang terintegrasi dengan CMEK yang mendukung kunci Cloud EKM, lihat Integrasi CMEK dan terapkan filter Tampilkan hanya layanan yang kompatibel dengan EKM.
Tingkat perlindungan eksternal melalui internet
Anda dapat menggunakan kunci Cloud EKM melalui internet di semua lokasi yang didukung oleh Cloud KMS, kecuali nam-eur-asia1 dan global.
Tingkat perlindungan eksternal melalui VPC
Anda dapat menggunakan kunci Cloud EKM melalui jaringan VPC untuk ketersediaan yang lebih baik dari kunci eksternal Anda. Ketersediaan yang lebih baik ini berarti peluang kunci Cloud EKM Anda dan resource yang dilindunginya menjadi tidak tersedia lebih kecil.
Anda dapat menggunakan kunci Cloud EKM melalui jaringan VPC di sebagian besar lokasi regional yang didukung oleh Cloud KMS.
Cloud EKM melalui jaringan VPC tidak tersedia di lokasi multi-region.
Langkah berikutnya
Pelajari layanan yang kompatibel yang memungkinkan Anda menggunakan kunci Anda di Google Cloud.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-10 UTC."],[],[],null,["# Protection levels\n\nThis page compares the different protection levels supported in\nCloud KMS:\n\n[Software](#software)\n: Cloud KMS keys with the `SOFTWARE` protection level are used for\n cryptographic operations that are performed in software. Cloud KMS\n keys can be generated by Google or imported.\n\n[Hardware](#hardware)\n: Cloud HSM keys with the `HSM` protection level are stored in a\n Google-owned Hardware Security Module (HSM). Cryptographic operations using\n these keys are performed in our HSMs. You can use Cloud HSM keys\n the same way you use Cloud KMS keys. Cloud HSM keys\n can be generated by Google or imported.\n\n[External over the internet](#external)\n: Cloud EKM keys with the `EXTERNAL` protection level are generated\n and stored in your external key management (EKM) system. Cloud EKM\n stores additional cryptographic material and a path to your unique key,\n which is used to access your key over the internet.\n\n[External over VPC](#external-vpc)\n: Cloud EKM keys with the `EXTERNAL_VPC` protection level are\n generated and stored in your external key management (EKM) system.\n Cloud EKM stores additional cryptographic material and a path to\n your unique key, which is used to access your key over a [virtual private\n cloud (VPC) network](/vpc/docs/vpc).\n\nKeys with all of these protection levels share the following features:\n\n- Use your keys for customer-managed encryption key (CMEK) integrated\n Google Cloud services.\n\n | **Note:** Some CMEK-integrated services do not support Cloud EKM keys. To learn which CMEK-integrated services support Cloud EKM keys, see [CMEK integrations](/kms/docs/compatible-services#cmek_integrations).\n- Use your keys with the Cloud KMS APIs or client libraries, without\n any specialized code based on the protection level of the key.\n\n- Control access to your keys using Identity and Access Management (IAM) roles.\n\n- Control whether each key version is **Enabled** or **Disabled** from\n Cloud KMS.\n\n- Key operations are captured in audit logs. Data access logging can be\n enabled.\n\nSoftware protection level\n-------------------------\n\nCloud KMS uses the [BoringCrypto module (BCM)](https://boringssl.googlesource.com/boringssl/+/main/crypto/fipsmodule/FIPS.md) for all cryptographic\noperations for software keys. The BCM is [FIPS 140-2](https://csrc.nist.gov/publications/detail/fips/140/2/final)\nvalidated. Cloud KMS software keys use FIPS 140-2 Level 1--validated\nCryptographic Primitives of the BCM.\nThe software protection level is the cheapest protection level. Software keys are a good choice for use cases that do not have specific regulatory requirements for a higher FIPs 140-2 validation level.\n\n\u003cbr /\u003e\n\nHardware protection level\n-------------------------\n\nCloud HSM helps you enforce regulatory compliance for your workloads in\nGoogle Cloud. With Cloud HSM, you can generate encryption keys\nand perform cryptographic operations in [FIPS 140-2 Level\n3](https://csrc.nist.gov/publications/detail/fips/140/2/final) validated HSMs. The service is fully managed, so\nyou can protect your most sensitive workloads without worrying about the\noperational overhead of managing an HSM cluster. Cloud HSM provides a\nlayer of abstraction on top of the HSM modules.\nThis abstraction lets you use your keys in CMEK integrations or the\nCloud KMS APIs or client libraries without HSM-specific code.\nHardware key versions are more expensive, but they provide substantial security benefits relative to software keys. Each Cloud HSM key has an [attestation statement](/docs/security/cloud-hsm-architecture#cryptographic_key_attestation) that contains certified information about your key. This attestation and its associated certificate chains can be used to verify the authenticity of the statement and attributes of the key and HSM.\n\n\u003cbr /\u003e\n\nExternal protection levels\n--------------------------\n\nCloud External Key Manager (Cloud EKM) keys are keys that you manage in a [supported\nexternal key management (EKM) partner](/kms/docs/ekm#supported_partners) service and use in\nGoogle Cloud services and Cloud KMS APIs and client libraries.\nCloud EKM keys can be software-backed or hardware-backed, depending on\nyour EKM provider. You can use your Cloud EKM keys in CMEK-integrated\nservices or using the Cloud KMS APIs and client libraries.\nCloud EKM protection levels are the most expensive. When you use Cloud EKM keys, you can be sure that Google Cloud can't access your key material.\n\n\u003cbr /\u003e\n\nTo see which CMEK-integrated services support Cloud EKM keys,\nsee [CMEK integrations](/kms/docs/compatible-services#cmek_integrations) and\napply the **Show only EKM compatible services** filter.\n\n### External over the internet protection level\n\nYou can use Cloud EKM keys over the internet in all locations supported\nby Cloud KMS except `nam-eur-asia1` and `global`.\n| **Caution:** When you use Cloud EKM keys over the internet, there's a risk that the key can become unavailable. For better availability, consider using Cloud HSM or Cloud EKM over a VPC network.\n\n### External over VPC protection level\n\nYou can use Cloud EKM keys over a VPC network for better availability\nof your external keys. This better availability means that there's less of a\nchance of your Cloud EKM keys and the resources they protect becoming\nunavailable.\n\nYou can use Cloud EKM keys over a VPC network in most regional\nlocations supported by Cloud KMS.\n\nCloud EKM over a VPC network is not available in multi-region\nlocations.\n\n\u003cbr /\u003e\n\nWhat's next\n-----------\n\n- Learn about [compatible services](/kms/docs/compatible-services) that let you use your keys in Google Cloud.\n- Learn how to [create key rings](/kms/docs/create-key-ring) and [create\n encryption keys](/kms/docs/creating-keys).\n- Learn about [importing keys](/kms/docs/key-import).\n- Learn about [external keys](/kms/docs/ekm).\n- Learn about other [considerations for using\n Cloud EKM](/kms/docs/ekm#considerations)."]]