Troubleshoot CMEK issues

Disabled key

$KEY is not enabled, current state is: DISABLED

The provided Cloud KMS key has been disabled for an Eventarc resource. Events or messages associated with the resource are no longer protected.

Solution:

1. Display the key used for a channel .
2. Re-enable the Cloud KMS key .

Exceeded quota

Quota exceeded for limit

Your quota limit for Cloud KMS requests has been reached.

Solution:

• Limit the number of Cloud KMS calls.
• Increase the quota.

For more information, see Monitor and adjust Cloud KMS quotas .

Mismatched region

Key region $REGION must match the resource to be protected

The provided KMS key region is different from the region of the channel.

Solution:

Use a Cloud KMS key from the same region. Note that for channels in multi-region eu , you should protect it using a Cloud KMS key in multi-region europe . For more information, see Cloud KMS locations and Eventarc multi-region locations.

Organization policy constraint

project/PROJECT_ID violated org policy constraint

Eventarc is integrated with the following two organization policy constraints to help ensure CMEK usage across an organization. Any existing Eventarc resource isn't subject to a policy that is set after the resource is created; however, updating the resource might fail.

• constraints/gcp.restrictNonCmekServices causes all resource creation requests without a specified Cloud KMS key to fail.

  Solution:

  Specify a Cloud KMS key for the Eventarc resource. For more information, see Require CMEKs for new Eventarc resources .

• constraints/gcp.restrictCmekCryptoKeyProjects restricts the Cloud KMS keys that you can use to protect an Eventarc resource.

  Solution:

  Use a supported Cloud KMS key for the Eventarc project. For more information, see Restrict Cloud KMS keys for an Eventarc project .

Disabled key

$KEY is not enabled, current state is: DISABLED

The provided Cloud KMS key has been disabled for an Eventarc resource. Events or messages associated with the resource are no longer protected.

Solution:

1. Display the key used for a channel .
2. Re-enable the Cloud KMS key .

Exceeded quota

Quota exceeded for limit

Your quota limit for Cloud KMS requests has been reached.

Solution:

• Limit the number of Cloud KMS calls.
• Increase the quota.

For more information, see Monitor and adjust Cloud KMS quotas .

Permission error

Permission 'cloudkms.cryptoKeyVersions.useToEncrypt' denied on resource $KEY (or it may not exist)

Either the provided Cloud KMS key doesn't exist or the Identity and Access Management (IAM) permission is not properly configured.

Solution:

• Verify Cloud KMS usage:
  • Google event types
  • Third-party channel
• Ensure that the Eventarc service agent has been granted the cloudkms.cryptoKeyEncrypterDecrypter role and has been added as a principal to the Cloud KMS key. For more information, see Grant the Eventarc service account access to a key .