หากต้องการตั้งค่าโปรเจ็กต์ในสภาพแวดล้อม ให้ใช้คำสั่ง gcloud config set
หากต้องการตรวจสอบว่ามีการตั้งค่าโปรเจ็กต์ในสภาพแวดล้อมของคุณแล้วหรือไม่ ให้เรียกใช้
gcloud config list
หากไม่ได้ตั้งค่า project หรือต้องการใช้โปรเจ็กต์อื่นสำหรับคีย์ ให้
เรียกใช้ gcloud config set
สร้างผู้ให้บริการ Workload Identity Pool อาร์กิวเมนต์ --attribute-condition
จะยืนยันว่าผู้เรียกใช้เป็นบัญชีบริการการจับคู่ข้อมูลแบบเป็นความลับ
gcloudiamworkload-identity-poolsproviderscreate-oidcPROVIDER_ID\--location=global\--workload-identity-pool=WIP_ID\--display-name="PROVIDER_DISPLAY_NAME"\--description="PROVIDER_DESCRIPTION"\--attribute-mapping="google.subject=assertion.sub,google.groups=[\"PROVIDER_ID\"]"\--attribute-condition="assertion.swname == 'CONFIDENTIAL_SPACE' &&
'STABLE' in assertion.submods.confidential_space.support_attributes &&
['cfm-services@admcloud-cfm-services.iam.gserviceaccount.com'].exists( a, a in assertion.google_service_accounts) &&
'ECDSA_P256_SHA256:6b1f357b59e9407fb017ca0e3e783b2bd5acbfea6c83dd82971a4150df5b25f9' in assertion.submods.container.image_signatures.map(sig, sig.signature_algorithm+':'+sig.key_id)"\--issuer-uri="https://confidentialcomputing.googleapis.com"\--allowed-audiences="https://sts.googleapis.com"
มอบบทบาทผู้ถอดรหัสคีย์ให้กับผู้ให้บริการ WIP
# Grants the role to the WIP provider.
gcloudkmskeysadd-iam-policy-bindingKEY_NAME\--keyringKEY_RING_NAME\--locationKEY_RING_LOCATION\--member"principalSet://iam.googleapis.com/projects/PROJECT_ID/locations/global/workloadIdentityPools/WIP_ID/group/PROVIDER_ID"\--role"roles/cloudkms.cryptoKeyDecrypter"
หากต้องการเข้ารหัสข้อมูลเหตุการณ์สําหรับ Conversion ออฟไลน์และ
Conversion ที่ปรับปรุงแล้วสําหรับโอกาสในการขาย ให้มอบบทบาทผู้ถอดรหัสคีย์ให้กับบัญชีบริการ datamanager-api@datamanager-ga.iam.gserviceaccount.com ของ Google
# Grants the role to the Google service account.
gcloudkmskeysadd-iam-policy-bindingKEY_NAME\--keyringKEY_RING_NAME\--locationKEY_RING_LOCATION\--member"serviceAccount:datamanager-api@datamanager-ga.iam.gserviceaccount.com"\--role"roles/cloudkms.cryptoKeyDecrypter"
เข้ารหัสข้อมูล
การเข้ารหัสใน Data Manager API ต้องใช้คีย์การเข้ารหัสข้อมูล (DEK) DEK คือคีย์สมมาตรที่คุณใช้เพื่อเข้ารหัสข้อมูล ระบบจะเข้ารหัส DEK โดยใช้คีย์ Google Cloud KMS ของคุณ คุณส่ง DEK ที่เข้ารหัสเป็นส่วนหนึ่งของคำขอ
หากต้องการใช้ไลบรารีและยูทิลิตี Data Manager API เพื่อสร้างและส่งคำขอ
โปรดดูIngestAudienceMembersWithEncryptionตัวอย่างโค้ดสำหรับ Java หรือingest_audience_members_with_encryptionตัวอย่างโค้ดสำหรับ Python
[null,null,["อัปเดตล่าสุด 2025-08-08 UTC"],[],[],null,["# Encrypt user data\n\nHere's how to send encrypted data.\n\nSet up the Google Cloud command line interface\n----------------------------------------------\n\n1. [Install and\n initialize](//cloud.google.com/sdk/docs/install-sdk) the Google Cloud command line interface.\n\n2. To select or create a new Google Cloud project and enable the\n [Cloud Key Management Service](//cloud.google.com/kms/docs/key-management-service), click **Enable Cloud KMS**.\n\n | **Tip:** We recommend using a separate project for your Cloud KMS resources that doesn't contain any other Google Cloud resources.\n\n\n Enable Cloud KMS\n3. To set your project in your environment, use the [`gcloud config set`](//cloud.google.com/sdk/gcloud/reference/config/set)\n command. To check if the project is already set in your environment, run\n `gcloud config list`.\n\n If no `project` is set, or you want to use a different project for your key,\n run `gcloud config set`: \n\n gcloud config set project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\nCreate a key\n------------\n\nFor more information, see the [Cloud Key Management Service overview](//cloud.google.com/kms/docs/key-management-service).\n\n1. Create a key ring.\n\n gcloud kms keyrings create \u003cvar translate=\"no\"\u003eKEY_RING_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eKEY_RING_LOCATION\u003c/var\u003e\n\n For more information, see [Create a key ring](//cloud.google.com/kms/docs/create-key-ring).\n2. Create a key in the key ring. The \u003cvar translate=\"no\"\u003eROTATION_PERIOD\u003c/var\u003e indicates the\n interval to rotate the key, and the \u003cvar translate=\"no\"\u003eNEXT_ROTATION_TIME\u003c/var\u003e indicates\n the date and time when the first rotation should occur.\n\n For example, to rotate the key every 30 days and perform the first rotation\n in 1 week, set \u003cvar translate=\"no\"\u003eROTATION_PERIOD\u003c/var\u003e to `30d` and\n \u003cvar translate=\"no\"\u003eNEXT_ROTATION_TIME\u003c/var\u003e to\n `$(date --utc --date=\"next week\" --iso-8601=seconds)`. \n\n gcloud kms keys create \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e \\\n --keyring \u003cvar translate=\"no\"\u003eKEY_RING_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eKEY_RING_LOCATION\u003c/var\u003e \\\n --purpose \"encryption\" \\\n --rotation-period \u003cvar translate=\"no\"\u003eROTATION_PERIOD\u003c/var\u003e \\\n --next-rotation-time \"\u003cvar translate=\"no\"\u003eNEXT_ROTATION_TIME\u003c/var\u003e\"\n\n For more information, see [Create a key](//cloud.google.com/kms/docs/create-key).\n\nCreate a workload identity pool provider\n----------------------------------------\n\nThis section is a short overview of Workload Identity Federation. For more\ninformation, see [Workload Identity Federation](//cloud.google.com/iam/docs/workload-identity-federation).\n\n1. Create a workload identity pool (WIP). The `location` for the pool must be\n `global`.\n\n gcloud iam workload-identity-pools create \u003cvar translate=\"no\"\u003eWIP_ID\u003c/var\u003e \\\n --location=global \\\n --display-name=\"\u003cvar translate=\"no\"\u003eWIP_DISPLAY_NAME\u003c/var\u003e\" \\\n --description=\"\u003cvar translate=\"no\"\u003eWIP_DESCRIPTION\u003c/var\u003e\"\n\n For more information, see [Manage workload identity pools and\n providers](//cloud.google.com/iam/docs/manage-workload-identity-pools-providers).\n2. Create a workload identity pool provider. The `--attribute-condition`\n argument verifies that the caller is a confidential match service account.\n\n gcloud iam workload-identity-pools providers create-oidc \u003cvar translate=\"no\"\u003ePROVIDER_ID\u003c/var\u003e \\\n --location=global \\\n --workload-identity-pool=\u003cvar translate=\"no\"\u003eWIP_ID\u003c/var\u003e \\\n --display-name=\"\u003cvar translate=\"no\"\u003ePROVIDER_DISPLAY_NAME\u003c/var\u003e\" \\\n --description=\"\u003cvar translate=\"no\"\u003ePROVIDER_DESCRIPTION\u003c/var\u003e\" \\\n --attribute-mapping=\"google.subject=assertion.sub,google.groups=[\\\"\u003cvar translate=\"no\"\u003ePROVIDER_ID\u003c/var\u003e\\\"]\" \\\n --attribute-condition=\"assertion.swname == 'CONFIDENTIAL_SPACE' &&\n 'STABLE' in assertion.submods.confidential_space.support_attributes &&\n ['cfm-services@admcloud-cfm-services.iam.gserviceaccount.com'].exists(\n a, a in assertion.google_service_accounts) &&\n 'ECDSA_P256_SHA256:6b1f357b59e9407fb017ca0e3e783b2bd5acbfea6c83dd82971a4150df5b25f9'\n in assertion.submods.container.image_signatures.map(sig, sig.signature_algorithm+':'+sig.key_id)\" \\\n --issuer-uri=\"https://confidentialcomputing.googleapis.com\" \\\n --allowed-audiences=\"https://sts.googleapis.com\"\n\n3. Grant the key decrypter role to the WIP provider.\n\n # Grants the role to the WIP provider.\n gcloud kms keys add-iam-policy-binding \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e \\\n --keyring \u003cvar translate=\"no\"\u003eKEY_RING_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eKEY_RING_LOCATION\u003c/var\u003e \\\n --member \"principalSet://iam.googleapis.com/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/global/workloadIdentityPools/\u003cvar translate=\"no\"\u003eWIP_ID\u003c/var\u003e/group/\u003cvar translate=\"no\"\u003ePROVIDER_ID\u003c/var\u003e\" \\\n --role \"roles/cloudkms.cryptoKeyDecrypter\"\n\n4. If you want to encrypt [event data](/data-manager/api/get-started/quickstart/send-events) for offline conversions and\n enhanced conversions for leads, grant the key decrypter role to the Google\n\n service account `datamanager-api@datamanager-ga.iam.gserviceaccount.com`.\n\n # Grants the role to the Google service account.\n gcloud kms keys add-iam-policy-binding \u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e \\\n --keyring \u003cvar translate=\"no\"\u003eKEY_RING_NAME\u003c/var\u003e \\\n --location \u003cvar translate=\"no\"\u003eKEY_RING_LOCATION\u003c/var\u003e \\\n --member \"serviceAccount:datamanager-api@datamanager-ga.iam.gserviceaccount.com\" \\\n --role \"roles/cloudkms.cryptoKeyDecrypter\"\n\n \u003cbr /\u003e\n\nEncrypt data\n------------\n\nEncryption in the Data Manager API requires a data encryption key (DEK). A DEK is a\nsymmetric key that you use to encrypt data. Your DEK is encrypted using\nyour Google Cloud KMS key. You send the encrypted DEK as part of the request.\n\nTo prepare the data in the request for encryption, follow the same [formatting\nand hashing guidelines](/data-manager/api/get-started/formatting) you'd use for unencrypted data.\n\nDon't encrypt unhashed values. For example, the `region_code` or `postal_code`\nof an [`AddressInfo`](/data-manager/api/reference/rpc/google.ads.datamanager.v1#addressinfo).\n\nOnce the data for each field is formatted and hashed, encrypt the hashed value\nusing the following steps:\n\n1. Encode the hash bytes using Base64 encoding.\n2. Encrypt the Base64-encoded hash using your DEK.\n3. Encode the output from the encryption process using either hex or Base64 encoding.\n4. Use the encoded value for the field.\n5. Set the [`encryption_info`](/data-manager/api/reference/rpc/google.ads.datamanager.v1#encryptioninfo) and [`encoding`](/data-manager/api/reference/rpc/google.ads.datamanager.v1#encoding) on the request.\n\n| **Tip:** We recommend using [Tink](/tink) to implement encryption. Tink helps users without a cryptography background safely implement common cryptographic tasks.\n\nTo complete the last step, modify the\n[`IngestAudienceMembersRequest`](/data-manager/api/reference/rpc/google.ads.datamanager.v1#ingestaudiencemembersrequest) or\n[`IngestEventsRequest`](/data-manager/api/reference/rpc/google.ads.datamanager.v1#ingesteventsrequest)\nto indicate you encrypted\nyour data:\n\n- Set the `encryption_info` field.\n- Set the `encoding` field to the encoding used to encode the encrypted field values.\n\nHere's a snippet of a request with the encryption and encoding fields set: \n\n {\n ...\n \"encryptionInfo\": {\n \"gcpWrappedKeyInfo\": {\n \"kekUri\": \"gcp-kms://projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eKEY_RING_LOCATION\u003c/var\u003e/keyRings/\u003cvar translate=\"no\"\u003eKEY_RING_NAME\u003c/var\u003e/cryptoKeys/\u003cvar translate=\"no\"\u003eKEY_NAME\u003c/var\u003e\",\n \"wipProvider\": \"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/global/workloadIdentityPools/\u003cvar translate=\"no\"\u003eWIP_ID\u003c/var\u003e/providers/\u003cvar translate=\"no\"\u003ePROVIDER_ID\u003c/var\u003e\",\n \"keyType\": \"XCHACHA20_POLY1305\",\n \"encryptedDek\": \"\u003cvar translate=\"no\"\u003eENCRYPTED_DEK\u003c/var\u003e\"\n }\n },\n \"encoding\": \"\u003cvar label=\"encoding (HEX or BASE64)\" translate=\"no\"\u003eENCODING\u003c/var\u003e\"\n }\n\nTo use the Data Manager API [library and\nutilities](/data-manager/api/get-started/set-up-access) to construct and send a request,\nsee the `IngestAudienceMembersWithEncryption` code sample for Java or the\n`ingest_audience_members_with_encryption` code sample for Python."]]
