--- title: "Google Cloud Platform Keyring KMS Group Setup" slug: "fortanix-dsm-gcp-kms-keyring-setup-user-guide" updated: 2026-07-24T10:41:46Z published: 2026-07-24T10:41:46Z canonical: "support.fortanix.com/fortanix-dsm-gcp-kms-keyring-setup-user-guide" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Google Cloud Platform Keyring KMS Group Setup ## 1.0 Introduction This article describes how to add a new Google Cloud Platform (GCP) Cloud Key Management Service (KMS) using Fortanix-Data-Security-Manager (DSM). The Fortanix solution for GCP Cloud KMS offers complete Bring Your Own Key (BYOK) and lifecycle management for management and automation of native GCP Cloud keys (CMEK – Customer Master Encryption Key) and allows users to manage all keys centrally and securely. This guide will walk you through setting up a Cloud Data Control (CDC) group that will be used for both CNKMS and BYOK workflows. ## 2.0 Getting Started with Fortanix Cloud Data Control *To understand which solution between CNKMS, BYOK, or BYOE is right for you, refer to* [*Fortanix DSM - Cloud Data Control - Getting Started*](/v1/docs/fortanix-dsm-cloud-data-control-getting-started)*.* ## 3.0 Obtaining Access to Fortanix DSM Create an account in Fortanix DSM if you do not have one already. *For more information, refer to the* [*User's Guide: Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.* ## 4.0 Fortanix DSM GCP Cloud KMS Group Workflow The following section describes the workflow to configure Fortanix DSM to interact with the GCP Cloud KMS. A GCP CDC group is created in the Fortanix DSM account, and this group is configured to interact with the GCP Cloud KMS. ### 4.1 Create a GCP CDC Group Perform the following steps to create a GCP CDC group: 1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group. 2. On the **Adding new group** form: 1. Enter a title and description for your group. 2. Click **LINK HSM/EXTERNAL KMS** to select the GCP KMS type, so that Fortanix DSM can connect to it. 3. Select **GCP KMS Service Account Credentials** from the drop down menu. 4. In the **Configure as HSM/External KMS group** form: - **GCP Project ID**: This is the unique identifier for the Google Cloud project used to differentiate your project from all others in Google Cloud. For example, **fortanix**. - Select the geographical region/location where the Google Cloud KMS resource is stored or can be accessed within a Google Cloud project. For example, **South Carolina (us-east1)**. - **Authentication**: The following APIs must be enabled for using KMS and Cloud Platform related GCP services: To authenticate with the Google Cloud KMS, a Google service account is used. Enter the service account email in the format `SERVICEACCOUNT@PROJECT.iam.gserviceaccount.com` > [!NOTE] > NOTE > > The Google service account must have the role of Cloud KMS Admin. - Cloud Key Management Service KMS) API - Cloud Resource Manager API > [!NOTE] > NOTE > > Fortanix DSM internally uses the following OAuth 2.0 scopes when authenticating with Google Cloud Platform (GCP): [https://www.googleapis.com/auth/cloudkms](https://www.googleapis.com/auth/cloudkms) and [https://www.googleapis.com/auth/cloud-platform](https://www.googleapis.com/auth/cloud-platform). No manual scope configuration is required. - **Upload a Private Key**: Upload the JSON or PKCS#11 file containing the private key of the service account to authenticate with Google Cloud KMS. 3. Click **TEST CONNECTION** to test your GCP KMS connection. If Fortanix DSM can connect to your GCP KMS using your connection details, then it shows the status as “Connected” with a green tick ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (1812)(11).png). Otherwise, it shows the status as “**Not Connected**” with a yellow warning sign ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (1811)(7).png) . > [!NOTE] > NOTE > > Though it is an optional step, you can save your group details even if the connection information might be incorrect or incomplete, you can edit these details later. 4. After the connection is successful, select the **Key Ring Name** from the drop down menu that you want to configure for the GCP KMS group. A key ring organizes keys in a specific Google Cloud location and allows you to manage access control on groups of keys. > [!NOTE] > NOTE > > When you click **TEST CONNECTION** for the first time, Fortanix DSM tests the credentials provided and fetches the key rings. After you select the key ring, if you click **TEST CONNECTION** again, then Fortanix DSM checks the credentials and checks the accessibility of the selected key ring. 1. Click **SAVE** to create the group. After you save your group details, your group is created, and you will see a detailed view of your group. ### 4.2 Not Connected Scenario When you click the **TEST CONNECTION**, it is possible that Fortanix DSM is not able to connect to the GCP node. If that happens, it displays a “**Not Connected**” status with a warning symbol ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (1811)(8).png). You can save the details of the new connection details provided and edit them later. ### 4.3 HSM/KMS Tab The group details now include an **HSM/KMS** tab displaying information about your KMS. The **HSM/KMS** tab displays the details of the GCP KMS, including the service account email and name of the key ring. You can edit these connection details here. After editing and saving, click **TEST CONNECTION** to check the connection. Click **SYNC KEYS** to create virtual copies of all the keys present in the key ring of the location and project provided in the GCP KMS group. ### 4.4 Groups Table View After saving the group details, you can view the list of all groups and notice the special symbol ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Screenshot (1812)(12).png) next to the newly created group. This symbol indicates that it is a GCP CDC group, distinguishing it from other groups. ### 4.5 User’s View Navigate to the **Users** menu item in the DSM left navigation panel and on the **Users** page click the user that says “**You**” to view the user’s detailed view. The detailed view shows all the groups the user belongs to and indicates which groups are mapped to GCP KMS, displaying their status as "connected" or "not connected." ## 5.0 GCP Key Ring BYOK and Cloud Native Key Management *For more information on how to perform native key lifecycle management in GCP Key Ring using Fortanix DSM, refer to* [*Fortanix DSM - Google Cloud Platform Keyring KMS Cloud Native Key Management*](https://support.fortanix.com/docs/fortanix-data-security-manager-gcp-kms-keyring-setup-user-guide-1)*.* *For more information on how to perform BYOK key lifecycle management in GCP Key Ring using Fortanix DSM, refer to* [*Fortanix DSM - Google Cloud Platform Keyring KMS Bring Your Own Key*](https://support.fortanix.com/docs/users-guide-google-cloud-kms)*.* Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.