---
title: Configure Google Cloud KMS for CMEK
url: https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms
description: Use Google Cloud KMS to provide an encryption key for your organization.
---
Let Claude Code set up this feature for you
```text
/claude-api help me configure a customer-managed encryption key with Google Cloud KMS
```
This guide shows how to use a Google Cloud KMS key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
Enabling CMEK is permanent. If your KMS key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you begin.
## Prerequisites
* A Google Cloud project with billing enabled.
* The Cloud KMS API enabled (`cloudkms.googleapis.com`).
* Permissions to create KMS key rings and keys, and to set IAM policy on them (`roles/cloudkms.admin` or equivalent).
* Cloud KMS Data Access audit logs (Data Read and Data Write) turned on for the project, so that Cloud Logging records Anthropic's use of your key. They're off by default. To turn them on, see Google's [Enable Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access).
* To create the key from the command line, the [`gcloud` CLI](https://cloud.google.com/cli) installed and authenticated.
* To register the key through the API, an Anthropic Admin API key for your organization.
## Anthropic service account email
In this guide, you give the following Anthropic service account access to your key:
```text wrap
anthropic-cmek-client-us@gcp-anthropic-cmek-clients.iam.gserviceaccount.com
```
Use only this published service account email. Never trust an identifier provided over email, chat, or any onboarding channel.
**Domain restricted sharing:** If your Google Cloud organization enforces `constraints/iam.allowedPolicyMemberDomains`, it rejects the IAM bindings for this service account. Add a project-level exception to that constraint, or add Anthropic's Cloud Identity customer ID (format `C0xxxxxxxx`) to the allowed list. Contact Anthropic for the customer ID.
## Encryption key setup
The key must meet these requirements:
* **Location:** Use a single-region US location, such as `us-east5`. Multi-region locations such as `us` and `global` aren't supported. See [Availability and regions](https://platform.claude.com/docs/en/manage-claude/cmek#availability-and-regions).
* **Type:** Use a symmetric key with the `ENCRYPT_DECRYPT` purpose. Anthropic strongly recommends HSM protection.
* **Organization label:** Add the label `anthropic-org-` with the value `true`. Replace `` with your Anthropic organization ID in lowercase. Validation fails without this label. To label an existing key, see [Keys you already have](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#existing-key-label).
* **Access:** Give Anthropic's service account the `roles/cloudkms.cryptoKeyEncrypterDecrypter` and `roles/cloudkms.viewer` roles on the key itself.
**Finding your organization ID:** Use the bare UUID, not the `org_`-prefixed ID. Copy it from one of these places:
* **Claude Console:** the **Organization ID** field on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`)
* **claude.ai:** the **Organization ID** field under **Organization settings > Organization**
* **Admin API:** the `id` field from the [Organization Info](https://platform.claude.com/docs/en/api/organization/retrieve) endpoint
In the Google Cloud console, go to the [Key management](https://console.cloud.google.com/security/kms) page. Open a key ring in a single-region US location, such as `us-east5`, or create one.
Click **Create key** and enter a name. Select these options:
* **Protection level:** HSM
* **Key material:** Generated key
* **Purpose:** Symmetric encrypt/decrypt
* **Algorithm:** Google symmetric key
Click **Additional settings**, then **Add label**. Enter the organization label:
* **Key 1:** `anthropic-org-`
* **Value 1:** `true`
Click **Create**.
On the key ring details page, select the checkbox next to the key. Open the **Permissions** panel and click **Grant access**.
Check that **Resource** shows the key, not the key ring or project. Enter these values:
* **New principals:** `anthropic-cmek-client-us@gcp-anthropic-cmek-clients.iam.gserviceaccount.com`
* **Role:** Cloud KMS CryptoKey Encrypter/Decrypter
Click **Add another role** and select **Cloud KMS Viewer**. Click **Save**.
On the key ring details page, open the key's **Actions** menu and click **Copy resource name**.
In each command, replace these placeholders:
* **``:** your Google Cloud project ID
* **``:** the key's location, such as `us-east5`
* **``:** the key ring's name
* **``:** the key's name
* **``:** your Anthropic organization ID in lowercase
Skip this step if you already have a key ring to reuse.
```bash
gcloud kms keyrings create \
--project= \
--location=
```
```bash
gcloud kms keys create \
--project= \
--location= \
--keyring= \
--purpose=encryption \
--protection-level=hsm \
--labels=anthropic-org-=true
```
For software protection, omit `--protection-level=hsm`.
Run both commands:
```bash
gcloud kms keys add-iam-policy-binding \
--project= \
--location= \
--keyring= \
--member="serviceAccount:anthropic-cmek-client-us@gcp-anthropic-cmek-clients.iam.gserviceaccount.com" \
--role=roles/cloudkms.cryptoKeyEncrypterDecrypter
```
```bash
gcloud kms keys add-iam-policy-binding \
--project= \
--location= \
--keyring= \
--member="serviceAccount:anthropic-cmek-client-us@gcp-anthropic-cmek-clients.iam.gserviceaccount.com" \
--role=roles/cloudkms.viewer
```
```bash
gcloud kms keys describe \
--project= \
--location= \
--keyring= \
--format="value(name)"
```
You register the key with its full resource name, in this format:
```text wrap
projects//locations//keyRings//cryptoKeys/
```
**Keys you already have:** Add the organization label with this command, in Cloud Shell or with the gcloud CLI:
```bash
gcloud kms keys update \
--project= \
--location= \
--keyring= \
--update-labels=anthropic-org-=true
```
The placeholders match the parts of the key's full resource name. The command merges the label with any labels the key already has. Then grant access and copy the resource name as the preceding steps describe.
To share one key among several Anthropic organizations, add one organization label for each.
## Register the key with Anthropic
In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page.
Under **Encryption keys**, click **Add key**. Enter a **Display name** and select **Google Cloud KMS**. Click **Continue**.
The dialog box shows an **Organization label**. Check that your key has this label. Paste the full key resource name into **Key resource name** and click **Add**.
In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#troubleshoot-validation) for common causes.
Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
On the Data retention page, select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key and click **Save**.
Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
Replace `` with a display name. Replace the value that starts with `projects/` with the full key resource name.
```bash cURL
curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
-H "x-api-key: $ANTHROPIC_API_KEY" \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{
"display_name": "",
"geo": "us",
"provider_config": {
"type": "gcp",
"key_name": "projects//locations//keyRings//cryptoKeys/"
}
}'
```
```bash CLI
ant organization:external-keys create <<'YAML'
display_name: ""
geo: us
provider_config:
type: gcp
key_name: "projects//locations//keyRings//cryptoKeys/"
YAML
```
```python Python
client = anthropic.Anthropic()
external_key = client.organization.external_keys.create(
display_name="",
geo="us",
provider_config={
"type": "gcp",
"key_name": "projects//locations//keyRings//cryptoKeys/",
},
)
print(f"id: {external_key.id}")
print(f"display_name: {external_key.display_name}")
```
```typescript TypeScript
const client = new Anthropic();
const externalKey = await client.organization.externalKeys.create({
display_name: "",
geo: "us",
provider_config: {
type: "gcp",
key_name:
"projects//locations//keyRings//cryptoKeys/"
}
});
console.log(`id: ${externalKey.id}`);
console.log(`display_name: ${externalKey.display_name}`);
```
```csharp C#
using Anthropic.Models.Organization.ExternalKeys;
AnthropicClient client = new();
var externalKey = await client.Organization.ExternalKeys.Create(new()
{
DisplayName = "",
Geo = Geo.Us,
ProviderConfig = new GcpExternalKeyConfig
{
KeyName = "projects//locations//keyRings//cryptoKeys/"
}
});
Console.WriteLine($"id: {externalKey.ID}");
Console.WriteLine($"display_name: {externalKey.DisplayName}");
```
```go Go
client := anthropic.NewClient()
externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
DisplayName: anthropic.String(""),
Geo: anthropic.OrganizationExternalKeyNewParamsGeoUs,
ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
OfGCP: &anthropic.GCPExternalKeyConfigParam{
KeyName: "projects//locations//keyRings//cryptoKeys/",
},
},
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", externalKey.ID)
fmt.Printf("display_name: %s\n", externalKey.DisplayName)
```
```java Java
import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var params = ExternalKeyCreateParams.builder()
.displayName("")
.geo(ExternalKeyCreateParams.Geo.US)
.gcpProviderConfig("projects//locations//keyRings//cryptoKeys/")
.build();
var externalKey = client.organization().externalKeys().create(params);
IO.println("id: " + externalKey.id());
IO.println("display_name: " + externalKey.displayName().orElseThrow());
}
```
```php PHP
use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
// ...
$client = new Client();
$externalKey = $client->organization->externalKeys->create(
displayName: '',
geo: Geo::US,
providerConfig: [
'type' => 'gcp',
'keyName' => 'projects//locations//keyRings//cryptoKeys/',
],
);
echo "id: {$externalKey->id}\n";
echo "display_name: {$externalKey->displayName}\n";
```
```ruby Ruby
client = Anthropic::Client.new
external_key = client.organization.external_keys.create(
display_name: "",
geo: :us,
provider_config: {
type: :gcp,
key_name: "projects//locations//keyRings//cryptoKeys/"
}
)
puts "id: #{external_key.id}"
puts "display_name: #{external_key.display_name}"
```
The `id` field of the response contains the external key ID. Copy it for the next two steps:
```json
{
"type": "external_key",
"id": "ekey_",
"display_name": ""
}
```
Replace `ekey_` with the external key ID.
```bash cURL
curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_/validate" \
-H "x-api-key: $ANTHROPIC_API_KEY" \
-H "anthropic-version: 2023-06-01"
```
```bash CLI
ant organization:external-keys validate --external-key-id "ekey_"
```
```python Python
client = anthropic.Anthropic()
validation = client.organization.external_keys.validate("ekey_")
print(f"status: {validation.status}")
print(f"error: {validation.error}")
```
```typescript TypeScript
const client = new Anthropic();
const validation = await client.organization.externalKeys.validate("ekey_");
console.log(`status: ${validation.status}`);
console.log(`error: ${validation.error}`);
```
```csharp C#
AnthropicClient client = new();
var validation = await client.Organization.ExternalKeys.Validate("ekey_");
Console.WriteLine($"status: {validation.Status.Raw()}");
Console.WriteLine($"error: {validation.Error}");
```
```go Go
client := anthropic.NewClient()
validation, err := client.Organization.ExternalKeys.Validate(context.Background(), "ekey_")
if err != nil {
log.Fatal(err)
}
fmt.Printf("status: %s\n", validation.Status)
fmt.Printf("error: %s\n", validation.Error)
```
```java Java
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var validation = client.organization().externalKeys().validate("ekey_");
IO.println("status: " + validation.status().asString());
IO.println("error: " + validation.error().orElse(""));
```
```php PHP
$client = new Client();
$validation = $client->organization->externalKeys->validate(
externalKeyID: 'ekey_',
);
echo "status: {$validation->status}\n";
echo "error: {$validation->error}\n";
```
```ruby Ruby
client = Anthropic::Client.new
external_key_id = "ekey_"
validation = client.organization.external_keys.validate(external_key_id)
puts "status: #{validation.status}"
puts "error: #{validation.error}"
```
A successful response looks like this:
```json
{ "type": "external_key_validation", "status": "success", "error": null }
```
If validation fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#troubleshoot-validation).
Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
Replace `` with the workspace ID and `ekey_` with the external key ID.
```bash cURL
curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/" \
-H "x-api-key: $ANTHROPIC_API_KEY" \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{
"external_key_id": "ekey_"
}'
```
```bash CLI
ant organization:workspaces update \
--workspace-id "" \
--external-key-id "ekey_"
```
```python Python
client = anthropic.Anthropic()
workspace = client.organization.workspaces.update(
"", external_key_id="ekey_"
)
print(f"id: {workspace.id}")
print(f"external_key_id: {workspace.external_key_id}")
```
```typescript TypeScript
const client = new Anthropic();
const workspace = await client.organization.workspaces.update("", {
external_key_id: "ekey_"
});
console.log(`id: ${workspace.id}`);
console.log(`external_key_id: ${workspace.external_key_id}`);
```
```csharp C#
AnthropicClient client = new();
var workspace = await client.Organization.Workspaces.Update("", new()
{
ExternalKeyID = "ekey_"
});
Console.WriteLine($"id: {workspace.ID}");
Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
```
```go Go
client := anthropic.NewClient()
workspace, err := client.Organization.Workspaces.Update(
context.Background(),
"",
anthropic.OrganizationWorkspaceUpdateParams{
ExternalKeyID: anthropic.String("ekey_"),
},
)
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", workspace.ID)
fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
```
```java Java
import com.anthropic.models.organization.workspaces.WorkspaceUpdateParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var params = WorkspaceUpdateParams.builder()
.externalKeyId("ekey_")
.build();
var workspace = client.organization().workspaces().update("", params);
IO.println("id: " + workspace.id());
IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
}
```
```php PHP
$client = new Client();
$workspace = $client->organization->workspaces->update(
workspaceID: '',
externalKeyID: 'ekey_',
);
echo "id: {$workspace->id}\n";
echo "external_key_id: {$workspace->externalKeyID}\n";
```
```ruby Ruby
client = Anthropic::Client.new
workspace_id = ""
workspace = client.organization.workspaces.update(
workspace_id,
external_key_id: "ekey_"
)
puts "id: #{workspace.id}"
puts "external_key_id: #{workspace.external_key_id}"
```
On Claude Enterprise, CMEK applies to the whole organization, and an organization can have only one key.
Go to [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls) and find **Encryption keys**.
Click **Add key**. Enter a **Display name** and select **Google Cloud KMS**. Select the checkbox to confirm that you have read the CMEK documentation, then click **Continue**.
The dialog box shows an **Organization label**. Check that your key has this label. Paste the full key resource name into **Key resource name** and click **Add**.
When the check passes, **Encryption key configured** appears, and your organization is CMEK-protected from then on. If the check fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#troubleshoot-validation).
## Troubleshoot validation
If validation fails, common causes are:
* **Wrong organization label:** Make sure the key has the [organization label](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#organization-label), with your bare organization ID in lowercase.
* **VPC Service Controls:** A service perimeter that protects Cloud KMS in your project can block Anthropic. Add Anthropic to an access level on the perimeter, or exclude the key's project from it.
* **Domain restricted sharing:** The `constraints/iam.allowedPolicyMemberDomains` org policy blocks the binding for Anthropic's service account. To check that the binding is there, run `gcloud kms keys get-iam-policy --project= --location= --keyring=`. To allow it, see [Anthropic service account email](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#anthropic-service-account-email).
* **Disabled or destroyed key version:** Confirm that the key's primary version is enabled.
## Terraform
To create the key with Terraform, use the `google_kms_key_ring`, `google_kms_crypto_key`, and `google_kms_crypto_key_iam_member` resources from the `google` provider.