Create an AML AI instance

To use AML AI, create an instance. The AML AI Instance resource sits at the root of all other AML AI resources. Multiple instances can be created in the same region within a Google Cloud project. If the same parties are used in the instances, then you can share party registrations between instances to reduce costs. For more information, see Party registration sharing for multiple instances . and the Pricing page .

Instances adhere to the following:

Each instance is specific to a Google Cloud region, ensuring data residency within the Google Cloud region.
Each instance requires all input and output data to exist in the same Google Cloud region and project.
Each instance requires a single associated customer-managed encryption key (CMEK) which is used to encrypt any data created by AML AI.
An instance's child resources inherit the parent instance's location and encryption settings.
Each instance supports customized access management.

The list of available Google Cloud regions can be found on the AML AI locations page. You can map one (or several) geographies in which you operate to one (or several) available AML AI locations, based on your policies. You need to create at least one AML AI instance per AML AI location that you use.

You can run risk scoring both for commercial and retail customers in one AML AI instance. However, create a separate instance to do any of the following:

Restrict access to different sets of AML data to disparate members within your organization.
Use different CMEK keys for different sets of AML data.
Keep production AML AI alerting pipelines separated from training and evaluation of new AML AI models. For more information, see Party registration sharing for multiple instances .

Steps

To create a Google Cloud project and enable the API, see Set up a project and permissions .

Follow these steps to create a CMEK key and an AML AI instance.

Create an encryption key

To create an encryption key, first create a key ring and then the key itself. For more information, see Create encryption keys with Cloud KMS .

Permissions required for this task

To perform this task, you must have been granted the following permissions:

Permissions

cloudkms.keyRings.create
cloudkms.cryptoKeys.create

Create a key ring

To create a key ring, use the projects.locations.keyRings.create method.

REST

Before using any of the request data, make the following replacements:

KMS_PROJECT_ID : the Google Cloud project ID for the project containing the key ring
LOCATION : the location of the key ring; use one of the supported regions
Show locations
- us-central1
- us-east1
- asia-south1
- europe-west1
- europe-west2
- europe-west4
- northamerica-northeast1
- southamerica-east1
- australia-southeast1
KEY_RING_ID : a user-defined identifier for the key ring

To send your request, choose one of these options:

curl

Execute the following command:

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d "" \
"https://cloudkms.googleapis.com/v1/projects/ KMS_PROJECT_ID 
/locations/ LOCATION 
/keyRings?key_ring_id= KEY_RING_ID 
"

PowerShell

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method POST `
-Headers $headers `
-Uri "https://cloudkms.googleapis.com/v1/projects/ KMS_PROJECT_ID 
/locations/ LOCATION 
/keyRings?key_ring_id= KEY_RING_ID 
" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "name": "projects/ KMS_PROJECT_ID 
/locations/ LOCATION 
/keyRings/ KEY_RING_ID 
",
  "createTime": "2023-03-14T15:52:55.358979323Z"
}

gcloud

Before using any of the command data below, make the following replacements:

KMS_PROJECT_ID : the Google Cloud project ID for the project containing the key ring
LOCATION : the location of the key ring; use one of the supported regions
Show locations
- us-central1
- us-east1
- asia-south1
- europe-west1
- europe-west2
- europe-west4
- northamerica-northeast1
- southamerica-east1
- australia-southeast1
KEY_RING_ID : a user-defined identifier for the key ring

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud  
kms  
keyrings  
create  
 KEY_RING_ID 
  
 \ 
  
--project  
 KMS_PROJECT_ID 
  
--location  
 LOCATION

Windows (PowerShell)

gcloud  
kms  
keyrings  
create  
 KEY_RING_ID 
  
 ` 
  
--project  
 KMS_PROJECT_ID 
  
--location  
 LOCATION

Windows (cmd.exe)

gcloud  
kms  
keyrings  
create  
 KEY_RING_ID 
  
^  
--project  
 KMS_PROJECT_ID 
  
--location  
 LOCATION

You should receive an empty response:

Create a key

To create a key, use the projects.locations.keyRings.cryptoKeys method.

REST

Before using any of the request data, make the following replacements:

KMS_PROJECT_ID : the Google Cloud project ID for the project containing the key ring
LOCATION : the location of the key ring; use one of the supported regions
Show locations
- us-central1
- us-east1
- asia-south1
- europe-west1
- europe-west2
- europe-west4
- northamerica-northeast1
- southamerica-east1
- australia-southeast1
KEY_RING_ID : the user-defined identifier for the key ring
KEY_ID : a user-defined identifier for the key

Request JSON body:

{
  "purpose": "ENCRYPT_DECRYPT"
}

To send your request, choose one of these options:

curl

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell , which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list .

Save the request body in a file named request.json . Run the following command in the terminal to create or overwrite this file in the current directory:

cat > request.json << 'EOF'
{
  "purpose": "ENCRYPT_DECRYPT"
}
EOF

Then execute the following command to send your REST request:

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://cloudkms.googleapis.com/v1/projects/ KMS_PROJECT_ID 
/locations/ LOCATION 
/keyRings/ KEY_RING_ID 
/cryptoKeys?crypto_key_id= KEY_ID 
"

PowerShell

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list .

Save the request body in a file named request.json . Run the following command in the terminal to create or overwrite this file in the current directory:

@'
{
  "purpose": "ENCRYPT_DECRYPT"
}
'@  | Out-File -FilePath request.json -Encoding utf8

Then execute the following command to send your REST request:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method POST `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://cloudkms.googleapis.com/v1/projects/ KMS_PROJECT_ID 
/locations/ LOCATION 
/keyRings/ KEY_RING_ID 
/cryptoKeys?crypto_key_id= KEY_ID 
" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "name": "projects/ KMS_PROJECT_ID 
/locations/ LOCATION 
/keyRings/ KEY_RING_ID 
/cryptoKeys/ KEY_ID 
",
  "primary": {
    "name": "projects/ KMS_PROJECT_ID 
/locations/ LOCATION 
/keyRings/ KEY_RING_ID 
/cryptoKeys/ KEY_ID 
/cryptoKeyVersions/1",
    "state": "ENABLED",
    "createTime": "2023-03-14T15:52:55.358979323Z",
    "protectionLevel": "SOFTWARE",
    "algorithm": "GOOGLE_SYMMETRIC_ENCRYPTION",
    "generateTime": "2023-03-14T15:52:55.358979323Z"
  },
  "purpose": "ENCRYPT_DECRYPT",
  "createTime": "2023-03-14T15:52:55.358979323Z",
  "versionTemplate": {
    "protectionLevel": "SOFTWARE",
    "algorithm": "GOOGLE_SYMMETRIC_ENCRYPTION"
  },
  "destroyScheduledDuration": "86400s"
}

gcloud

Before using any of the command data below, make the following replacements:

KMS_PROJECT_ID : the Google Cloud project ID for the project containing the key ring
LOCATION : the location of the key ring; use one of the supported regions
Show locations
- us-central1
- us-east1
- asia-south1
- europe-west1
- europe-west2
- europe-west4
- northamerica-northeast1
- southamerica-east1
- australia-southeast1
KEY_RING_ID : the user-defined identifier for the key ring
KEY_ID : a user-defined identifier for the key

Execute the following command:

Linux, macOS, or Cloud Shell

gcloud  
kms  
keys  
create  
 KEY_ID 
  
 \ 
  
--keyring  
 KEY_RING_ID 
  
 \ 
  
--project  
 KMS_PROJECT_ID 
  
 \ 
  
--location  
 LOCATION 
  
 \ 
  
--purpose  
 "encryption"

Windows (PowerShell)

gcloud  
kms  
keys  
create  
 KEY_ID 
  
 ` 
  
--keyring  
 KEY_RING_ID 
  
 ` 
  
--project  
 KMS_PROJECT_ID 
  
 ` 
  
--location  
 LOCATION 
  
 ` 
  
--purpose  
 "encryption"

Windows (cmd.exe)

gcloud  
kms  
keys  
create  
 KEY_ID 
  
^  
--keyring  
 KEY_RING_ID 
  
^  
--project  
 KMS_PROJECT_ID 
  
^  
--location  
 LOCATION 
  
^  
--purpose  
 "encryption"

You should receive an empty response:

Create an instance

Create an instance for the specific region where the data should reside. This instance references the encryption key you created. For more information, see Customer-managed encryption keys (CMEK) .

To create an instance, use the projects.locations.instances.create method.

Permissions required for this task

To perform this task, you must have been granted the following permissions:

Permissions

financialservices.v1instances.create

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://financialservices.googleapis.com/v1/projects/ PROJECT_ID /locations/ LOCATION /instances?instance_id= INSTANCE_ID "

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method POST `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://financialservices.googleapis.com/v1/projects/ PROJECT_ID /locations/ LOCATION /instances?instance_id= INSTANCE_ID " | Select-Object -Expand Content

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
-Method GET `
-Headers $headers `
-Uri "https://financialservices.googleapis.com/v1/projects/ PROJECT_ID /locations/ LOCATION /operations/ OPERATION_ID " | Select-Object -Expand Content

{ "name": "projects/ PROJECT_ID /locations/ LOCATION /operations/ OPERATION_ID ", "metadata": { "@type": "type.googleapis.com/google.cloud.financialservices.v1.OperationMetadata", "createTime": "2023-03-14T15:52:55.358979323Z", "endTime": "2023-03-14T16:52:55.358979323Z", "target": "projects/ PROJECT_ID /locations/ LOCATION /instances/ INSTANCE_ID ", "verb": "create", "requestedCancellation": false, "apiVersion": "v1" }, "done": true, "response": { "@type": "type.googleapis.com/google.cloud.financialservices.v1.Instance", "name": "projects/ PROJECT_ID /locations/ LOCATION /instances/ INSTANCE_ID ", "createTime": CREATE_TIME , "updateTime": UPDATE_TIME , "kmsKey": "projects/ KMS_PROJECT_ID /locations/ LOCATION /keyRings/ KEY_RING_ID /cryptoKeys/ KEY_ID ", "state": "ACTIVE" } }

gcloud kms keys add-iam-policy-binding "projects/ KMS_PROJECT_ID /locations/ LOCATION /keyRings/ KEY_RING_ID /cryptoKeys/ KEY_ID " \ --keyring "projects/ KMS_PROJECT_ID /locations/ LOCATION /keyRings/ KEY_RING_ID " \ --location " LOCATION " \ --member "serviceAccount:service- PROJECT_NUMBER @gcp-sa-financialservices.iam.gserviceaccount.com" \ --role = "roles/cloudkms.cryptoKeyEncrypterDecrypter" \ --project = " PROJECT_ID "

Create an AML AI instance

Steps

Create an encryption key

Permissions required for this task

Create a key ring

REST

curl

PowerShell

gcloud

Linux, macOS, or Cloud Shell

Windows (PowerShell)

Windows (cmd.exe)

Create a key

REST

curl

PowerShell

gcloud

Linux, macOS, or Cloud Shell

Windows (PowerShell)

Windows (cmd.exe)

Create an instance

Permissions required for this task

curl

PowerShell

Check for the result

Permissions required for this task

curl

PowerShell

Grant access to the CMEK key

Permissions required for this task

Contact support

Create an AML AI instance Stay organized with collections Save and categorize content based on your preferences.

Steps

Create an encryption key

Permissions required for this task

Create a key ring

REST

curl

PowerShell

gcloud

Linux, macOS, or Cloud Shell

Windows (PowerShell)

Windows (cmd.exe)

Create a key

REST

curl

PowerShell

gcloud

Linux, macOS, or Cloud Shell

Windows (PowerShell)

Windows (cmd.exe)

Create an instance

Permissions required for this task

curl

PowerShell

Check for the result

Permissions required for this task

curl

PowerShell

Grant access to the CMEK key

Permissions required for this task

Contact support

Create an AML AI instance