cmek-google-cloud-kms changedmanage-claude/cmek-google-cloud-kms
Nearest release: v2.1.310, published 11 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+92added
Lines−492removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits16to this page, all time
## Before you start ## In Google Cloud: create the key ### Add the organization label to a key you already have ## In Claude: add and attach the key ## Prerequisites ## Anthropic service account email ## Encryption key setup ## Register the key with Anthropic ## Troubleshoot validation ## Terraform
The whole hunk
from line 1, old and new numbered
/
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 1
11---
2title: Configure Google Cloud KMS for CMEK
2title: Set up CMEK with Google Cloud KMS
33url: https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms
4description: Use Google Cloud KMS to provide an encryption key for your organization.
4description: Create a Google Cloud KMS key, give Anthropic access to it, and put it to use in Claude Platform or Claude Enterprise.
55---
66
77Let Claude Code set up this feature for you
from line 10
1010/claude-api help me configure a customer-managed encryption key with Google Cloud KMS
1111```
1212
13This guide shows how to use a Google Cloud KMS key as a [customer-managed encryption key (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) for your Anthropic organization.
14
15<Warning>
16 Enabling CMEK is permanent. If your key is deleted or disabled, Anthropic cannot recover the data encrypted under it. Review the [warnings and limitations](https://platform.claude.com/docs/en/manage-claude/cmek) before you start.
17</Warning>
18
19## Prerequisites
20
21* A Google Cloud project with billing enabled.
22* The Cloud KMS API enabled (`cloudkms.googleapis.com`).
23* Permissions to create KMS key rings and keys, and to set IAM policy on them (`roles/cloudkms.admin` or equivalent).
24* Cloud KMS Data Access audit logs (Data Read and Data Write) turned on for the project, so that Cloud Logging records Anthropic's use of your key. They're off by default. To turn them on, see Google's [Enable Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access).
25* To create the key from the command line, the [`gcloud` CLI](https://cloud.google.com/cli) installed and authenticated.
26* To register the key through the API, an Anthropic Admin API key for your organization.
27
28## Anthropic service account email
29
30In this guide, you give the following Anthropic service account access to your key:
13## Before you start
14
15In Claude:
16
17* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
18* You have your Anthropic organization ID, the UUID without the `org_` prefix. Copy it from [Organization](https://platform.claude.com/settings/organization) in the Claude Console, or from **Organization settings > Organization and access** on claude.ai. Whoever creates the key needs it.
19* You're an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
20* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
21* On Claude Enterprise, you know [which features turn off or change](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
22
23In Google Cloud:
24
25* The Cloud KMS API is turned on.
26* You can create key rings and keys, and set IAM policy on them (`roles/cloudkms.admin` or equivalent).
27* Cloud KMS [Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access) (Data Read and Data Write) are on, so Cloud Logging records Anthropic's use of your key. They're off by default.
28* If your Google Cloud organization enforces domain restricted sharing (`constraints/iam.allowedPolicyMemberDomains`), it blocks the grant to Anthropic's service account. Add a project-level exception, or allow Anthropic's Cloud Identity customer ID. Contact Anthropic for the ID.
29
30## In Google Cloud: create the key
31
32After a failed **Verify** or **Add**, see the [fixes for Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#google-cloud-kms).
33
34These steps label the key with your Anthropic organization ID in lowercase (`<ORGANIZATION_UUID>`) and grant access to Anthropic's service account:
3135
3236```text wrap
3337anthropic-cmek-client-us@gcp-anthropic-cmek-clients.iam.gserviceaccount.com
3438```
3539
36<Warning>
37 Use only this published service account email. Never trust an identifier provided over email, chat, or any onboarding channel.
38</Warning>
39
40<Note>
41 **Domain restricted sharing:** If your Google Cloud organization enforces `constraints/iam.allowedPolicyMemberDomains`, it rejects the IAM bindings for this service account. Add a project-level exception to that constraint, or add Anthropic's Cloud Identity customer ID (format `C0xxxxxxxx`) to the allowed list. Contact Anthropic for the customer ID.
42</Note>
43
44## Encryption key setup
45
46The key must meet these requirements:
47
48* **Location:** Use a single-region US location, such as `us-east5`. Multi-region locations such as `us` and `global` aren't supported. See [Availability and regions](https://platform.claude.com/docs/en/manage-claude/cmek#availability-and-regions).
49* **Type:** Use a symmetric key with the `ENCRYPT_DECRYPT` purpose. Anthropic strongly recommends HSM protection.
50* **Organization label:** Add the label `anthropic-org-<ORGANIZATION_UUID>` with the value `true`. Replace `<ORGANIZATION_UUID>` with your Anthropic organization ID in lowercase. Validation fails without this label. To label an existing key, see [Keys you already have](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#existing-key-label).
51* **Access:** Give Anthropic's service account the `roles/cloudkms.cryptoKeyEncrypterDecrypter` and `roles/cloudkms.viewer` roles on the key itself.
52
53<Note>
54 **Finding your organization ID:** Use the bare UUID, not the `org_`-prefixed ID. Copy it from one of these places:
55
56 * **Claude Console:** the **Organization ID** field on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`)
57 * **claude.ai:** the **Organization ID** field under **Organization settings > Organization**
58 * **Admin API:** the `id` field from the [Organization Info](https://platform.claude.com/docs/en/api/organization/retrieve) endpoint
59</Note>
40Use only this address, never one sent by email or chat.
41
42For the lowest latency, use `us-east5` or `us-central1`. Anthropic strongly recommends HSM protection.
43
44To use a key you already have, [add the organization label](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#organization-label) first.
6045
6146<Tabs>
6247 <Tab title="Google Cloud Console">
from line 168
183168 </Tab>
184169</Tabs>
185170
186You register the key with its full resource name, in this format:
171Whoever adds the key in Claude needs its full resource name, in this format:
187172
188173```text wrap
189174projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>
190175```
191176
192<Note>
193 **Keys you already have:** Add the organization label with this command, in Cloud Shell or with the gcloud CLI:
194
195 ```bash
196 gcloud kms keys update <your-key-name> \
197 --project=<your-project-id> \
198 --location=<region> \
199 --keyring=<your-keyring-name> \
200 --update-labels=anthropic-org-<ORGANIZATION_UUID>=true
201 ```
202
203 The placeholders match the parts of the key's full resource name. The command merges the label with any labels the key already has. Then grant access and copy the resource name as the preceding steps describe.
204
205 To share one key among several Anthropic organizations, add one organization label for each.
206</Note>
207
208## Register the key with Anthropic
177### Add the organization label to a key you already have
178
179Verification fails unless the key has the label `anthropic-org-<ORGANIZATION_UUID>` set to `true`, with your Anthropic organization ID in lowercase. To add the label, run:
180
181```bash
182gcloud kms keys update <your-key-name> \
183 --project=<your-project-id> \
184 --location=<region> \
185 --keyring=<your-keyring-name> \
186 --update-labels=anthropic-org-<ORGANIZATION_UUID>=true
187```
188
189The other values are in the key's full resource name, and the command keeps existing labels. Then skip to [the steps that grant access](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup).
190
191## In Claude: add and attach the key
192
193To script this part on Claude Platform, [use the Admin API](https://platform.claude.com/docs/en/manage-claude/cmek-admin-api) instead.
209194
210195<Tabs>
211196 <Tab title="Claude Platform">
212 <Tabs>
213 <Tab title="Claude Console">
214 <Steps>
215 <Step title="Open the encryption key settings">
216 In the Claude Console, go to the [Data retention](https://platform.claude.com/settings/privacy#encryption-keys) page (`platform.claude.com/settings/privacy`). If you don't see **Encryption keys**, select **Organization** from the dropdown menu at the top of the page.
217 </Step>
218
219 <Step title="Add the key">
220 Under **Encryption keys**, click **Add key**. Enter a **Display name** and select **Google Cloud KMS**. Click **Continue**.
221 </Step>
222
223 <Step title="Enter the key resource name">
224 The dialog box shows an **Organization label**. Check that your key has this label. Paste the full key resource name into **Key resource name** and click **Add**.
225 </Step>
226
227 <Step title="Validate the key">
228 In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If it fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#troubleshoot-validation) for common causes.
229 </Step>
230
231 <Step title="Attach the key to a workspace">
232 Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
233
234 On the Data retention page, select the workspace from the dropdown menu at the top of the page. Under **Encryption key**, select the key and click **Save**.
235 </Step>
236
237 <Step title="Confirm the change">
238 Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
239 </Step>
240 </Steps>
241 </Tab>
242
243 <Tab title="API">
244 <Steps>
245 <Step title="Create the external key">
246 Replace `<friendly-name>` with a display name. Replace the value that starts with `projects/` with the full key resource name.
247
248 <CodeGroup>
249 ```bash cURL
250 curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
251 -H "x-api-key: $ANTHROPIC_API_KEY" \
252 -H "anthropic-version: 2023-06-01" \
253 -H "content-type: application/json" \
254 -d '{
255 "display_name": "<friendly-name>",
256 "geo": "us",
257 "provider_config": {
258 "type": "gcp",
259 "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
260 }
261 }'
262 ```
263
264 ```bash CLI
265 ant organization:external-keys create <<'YAML'
266 display_name: "<friendly-name>"
267 geo: us
268 provider_config:
269 type: gcp
270 key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
271 YAML
272 ```
273
274 ```python Python
275 client = anthropic.Anthropic()
276
277 external_key = client.organization.external_keys.create(
278 display_name="<friendly-name>",
279 geo="us",
280 provider_config={
281 "type": "gcp",
282 "key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
283 },
284 )
285
286 print(f"id: {external_key.id}")
287 print(f"display_name: {external_key.display_name}")
288 ```
289
290 ```typescript TypeScript
291 const client = new Anthropic();
292
293 const externalKey = await client.organization.externalKeys.create({
294 display_name: "<friendly-name>",
295 geo: "us",
296 provider_config: {
297 type: "gcp",
298 key_name:
299 "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
300 }
301 });
302
303 console.log(`id: ${externalKey.id}`);
304 console.log(`display_name: ${externalKey.display_name}`);
305 ```
306
307 ```csharp C#
308 using Anthropic.Models.Organization.ExternalKeys;
309
310 AnthropicClient client = new();
311
312 var externalKey = await client.Organization.ExternalKeys.Create(new()
313 {
314 DisplayName = "<friendly-name>",
315 Geo = Geo.Us,
316 ProviderConfig = new GcpExternalKeyConfig
317 {
318 KeyName = "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
319 }
320 });
321
322 Console.WriteLine($"id: {externalKey.ID}");
323 Console.WriteLine($"display_name: {externalKey.DisplayName}");
324 ```
325
326 ```go Go
327 client := anthropic.NewClient()
328
329 externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
330 DisplayName: anthropic.String("<friendly-name>"),
331 Geo: anthropic.OrganizationExternalKeyNewParamsGeoUs,
332 ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
333 OfGCP: &anthropic.GCPExternalKeyConfigParam{
334 KeyName: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
335 },
336 },
337 })
338 if err != nil {
339 log.Fatal(err)
340 }
341
342 fmt.Printf("id: %s\n", externalKey.ID)
343 fmt.Printf("display_name: %s\n", externalKey.DisplayName)
344 ```
345
346 ```java Java
347 import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
348
349 void main() {
350 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
351
352 var params = ExternalKeyCreateParams.builder()
353 .displayName("<friendly-name>")
354 .geo(ExternalKeyCreateParams.Geo.US)
355 .gcpProviderConfig("projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>")
356 .build();
357 var externalKey = client.organization().externalKeys().create(params);
358
359 IO.println("id: " + externalKey.id());
360 IO.println("display_name: " + externalKey.displayName().orElseThrow());
361 }
362 ```
363
364 ```php PHP
365 use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
366 // ...
367
368 $client = new Client();
369
370 $externalKey = $client->organization->externalKeys->create(
371 displayName: '<friendly-name>',
372 geo: Geo::US,
373 providerConfig: [
374 'type' => 'gcp',
375 'keyName' => 'projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>',
376 ],
377 );
378
379 echo "id: {$externalKey->id}\n";
380 echo "display_name: {$externalKey->displayName}\n";
381 ```
382
383 ```ruby Ruby
384 client = Anthropic::Client.new
385
386 external_key = client.organization.external_keys.create(
387 display_name: "<friendly-name>",
388 geo: :us,
389 provider_config: {
390 type: :gcp,
391 key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
392 }
393 )
394
395 puts "id: #{external_key.id}"
396 puts "display_name: #{external_key.display_name}"
397 ```
398 </CodeGroup>
399
400 The `id` field of the response contains the external key ID. Copy it for the next two steps:
401
402 ```json
403 {
404 "type": "external_key",
405 "id": "ekey_<id>",
406 "display_name": "<friendly-name>"
407 }
408 ```
409 </Step>
410
411 <Step title="Validate the key">
412 Replace `ekey_<id>` with the external key ID.
413
414 <CodeGroup>
415 ```bash cURL
416 curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
417 -H "x-api-key: $ANTHROPIC_API_KEY" \
418 -H "anthropic-version: 2023-06-01"
419 ```
420
421 ```bash CLI
422 ant organization:external-keys validate --external-key-id "ekey_<id>"
423 ```
424
425 ```python Python
426 client = anthropic.Anthropic()
427
428 validation = client.organization.external_keys.validate("ekey_<id>")
429
430 print(f"status: {validation.status}")
431 print(f"error: {validation.error}")
432 ```
433
434 ```typescript TypeScript
435 const client = new Anthropic();
436
437 const validation = await client.organization.externalKeys.validate("ekey_<id>");
438
439 console.log(`status: ${validation.status}`);
440 console.log(`error: ${validation.error}`);
441 ```
442
443 ```csharp C#
444 AnthropicClient client = new();
445
446 var validation = await client.Organization.ExternalKeys.Validate("ekey_<id>");
447
448 Console.WriteLine($"status: {validation.Status.Raw()}");
449 Console.WriteLine($"error: {validation.Error}");
450 ```
451
452 ```go Go
453 client := anthropic.NewClient()
454
455 validation, err := client.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
456 if err != nil {
457 log.Fatal(err)
458 }
459
460 fmt.Printf("status: %s\n", validation.Status)
461 fmt.Printf("error: %s\n", validation.Error)
462 ```
463
464 ```java Java
465 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
466
467 var validation = client.organization().externalKeys().validate("ekey_<id>");
468
469 IO.println("status: " + validation.status().asString());
470 IO.println("error: " + validation.error().orElse(""));
471 ```
472
473 ```php PHP
474 $client = new Client();
475
476 $validation = $client->organization->externalKeys->validate(
477 externalKeyID: 'ekey_<id>',
478 );
479
480 echo "status: {$validation->status}\n";
481 echo "error: {$validation->error}\n";
482 ```
483
484 ```ruby Ruby
485 client = Anthropic::Client.new
486
487 external_key_id = "ekey_<id>"
488 validation = client.organization.external_keys.validate(external_key_id)
489
490 puts "status: #{validation.status}"
491 puts "error: #{validation.error}"
492 ```
493 </CodeGroup>
494
495 A successful response looks like this:
496
497 ```json
498 { "type": "external_key_validation", "status": "success", "error": null }
499 ```
500
501 If validation fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#troubleshoot-validation).
502 </Step>
503
504 <Step title="Attach the key to a workspace">
505 Attaching a key can't be undone. If you can, attach it to a new workspace before that workspace receives any requests. In a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
506
507 Replace `<workspace-id>` with the workspace ID and `ekey_<id>` with the external key ID.
508
509 <CodeGroup>
510 ```bash cURL
511 curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
512 -H "x-api-key: $ANTHROPIC_API_KEY" \
513 -H "anthropic-version: 2023-06-01" \
514 -H "content-type: application/json" \
515 -d '{
516 "external_key_id": "ekey_<id>"
517 }'
518 ```
519
520 ```bash CLI
521 ant organization:workspaces update \
522 --workspace-id "<workspace-id>" \
523 --external-key-id "ekey_<id>"
524 ```
525
526 ```python Python
527 client = anthropic.Anthropic()
528
529 workspace = client.organization.workspaces.update(
530 "<workspace-id>", external_key_id="ekey_<id>"
531 )
532
533 print(f"id: {workspace.id}")
534 print(f"external_key_id: {workspace.external_key_id}")
535 ```
536
537 ```typescript TypeScript
538 const client = new Anthropic();
539
540 const workspace = await client.organization.workspaces.update("<workspace-id>", {
541 external_key_id: "ekey_<id>"
542 });
543
544 console.log(`id: ${workspace.id}`);
545 console.log(`external_key_id: ${workspace.external_key_id}`);
546 ```
547
548 ```csharp C#
549 AnthropicClient client = new();
550
551 var workspace = await client.Organization.Workspaces.Update("<workspace-id>", new()
552 {
553 ExternalKeyID = "ekey_<id>"
554 });
555
556 Console.WriteLine($"id: {workspace.ID}");
557 Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
558 ```
559
560 ```go Go
561 client := anthropic.NewClient()
562
563 workspace, err := client.Organization.Workspaces.Update(
564 context.Background(),
565 "<workspace-id>",
566 anthropic.OrganizationWorkspaceUpdateParams{
567 ExternalKeyID: anthropic.String("ekey_<id>"),
568 },
569 )
570 if err != nil {
571 log.Fatal(err)
572 }
573
574 fmt.Printf("id: %s\n", workspace.ID)
575 fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
576 ```
577
578 ```java Java
579 import com.anthropic.models.organization.workspaces.WorkspaceUpdateParams;
580
581 void main() {
582 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
583
584 var params = WorkspaceUpdateParams.builder()
585 .externalKeyId("ekey_<id>")
586 .build();
587 var workspace = client.organization().workspaces().update("<workspace-id>", params);
588
589 IO.println("id: " + workspace.id());
590 IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
591 }
592 ```
593
594 ```php PHP
595 $client = new Client();
596
597 $workspace = $client->organization->workspaces->update(
598 workspaceID: '<workspace-id>',
599 externalKeyID: 'ekey_<id>',
600 );
601
602 echo "id: {$workspace->id}\n";
603 echo "external_key_id: {$workspace->externalKeyID}\n";
604 ```
605
606 ```ruby Ruby
607 client = Anthropic::Client.new
608
609 workspace_id = "<workspace-id>"
610 workspace = client.organization.workspaces.update(
611 workspace_id,
612 external_key_id: "ekey_<id>"
613 )
614
615 puts "id: #{workspace.id}"
616 puts "external_key_id: #{workspace.external_key_id}"
617 ```
618 </CodeGroup>
619 </Step>
620 </Steps>
621 </Tab>
622 </Tabs>
197 <Steps>
198 <Step title="Open the encryption key settings">
199 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
200 </Step>
201
202 <Step title="Add the key">
203 Under **Encryption keys**, click **Add key**. Enter a **Display name**, select **Google Cloud KMS**, and click **Continue**.
204 </Step>
205
206 <Step title="Enter the key resource name">
207 Check that your key has the **Organization label** shown in the dialog box. Paste the key's full resource name into **Key resource name** and click **Add**.
208 </Step>
209
210 <Step title="Verify the key">
211 In the **Encryption keys** list, click **Verify** next to the key. **Connected** appears when the check passes. If **Connection failed** appears instead, see [Troubleshoot CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting).
212 </Step>
213
214 <Step title="Attach the key to a workspace">
215 <Warning>
216 Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
217 </Warning>
218
219 1. At the top of the Data retention page, select the workspace from the dropdown menu.
220 2. Under **Encryption key**, select the key and click **Save**.
221 3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
222
223 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider's audit log shows Anthropic's calls to the key.
224
225 In a [ZDR organization](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), after you select the workspace, select **Standard data retention** so that **Encryption key** appears. After you click **Save**, click **Accept** on the data retention terms.
226 </Step>
227 </Steps>
623228 </Tab>
624229
625230 <Tab title="Claude Enterprise">
626 On Claude Enterprise, CMEK applies to the whole organization, and an organization can have only one key.
231 On Claude Enterprise, CMEK applies to the whole organization, and you can add only one key.
232
233 <Warning>
234 Adding a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the organization or replace it. If the key is deleted, Anthropic can't recover the data it protects.
235 </Warning>
236
237 Adding the key [turns off or changes some features](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed) for every user. To try CMEK first, use a separate organization.
627238
628239 <Steps>
629240 <Step title="Open the encryption key settings">
from line 246
635246 </Step>
636247
637248 <Step title="Enter the key resource name">
638 The dialog box shows an **Organization label**. Check that your key has this label. Paste the full key resource name into **Key resource name** and click **Add**.
639 </Step>
640
641 <Step title="Confirm that validation passed">
642 When the check passes, **Encryption key configured** appears, and your organization is CMEK-protected from then on. If the check fails, see [Troubleshoot validation](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#troubleshoot-validation).
249 Check that your key has the **Organization label** shown in the dialog box. Paste the key's full resource name into **Key resource name** and click **Add**.
250 </Step>
251
252 <Step title="Confirm that the key was added">
253 The check can take up to 30 seconds. When **Encryption key configured.** appears, click **Done**. If **The encryption key couldn’t be added.** appears instead, [find the cause and retry](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#claude-ai-add-fails).
254
255 Your key protects data written from then on. Tell your users [which features changed](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
643256 </Step>
644257 </Steps>
645258 </Tab>
646259</Tabs>
647
648## Troubleshoot validation
649
650If validation fails, common causes are:
651
652* **Wrong organization label:** Make sure the key has the [organization label](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#organization-label), with your bare organization ID in lowercase.
653* **VPC Service Controls:** A service perimeter that protects Cloud KMS in your project can block Anthropic. Add Anthropic to an access level on the perimeter, or exclude the key's project from it.
654* **Domain restricted sharing:** The `constraints/iam.allowedPolicyMemberDomains` org policy blocks the binding for Anthropic's service account. To check that the binding is there, run `gcloud kms keys get-iam-policy <your-key-name> --project=<your-project-id> --location=<region> --keyring=<your-keyring-name>`. To allow it, see [Anthropic service account email](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#anthropic-service-account-email).
655* **Disabled or destroyed key version:** Confirm that the key's primary version is enabled.
656
657## Terraform
658
659To create the key with Terraform, use the `google_kms_key_ring`, `google_kms_crypto_key`, and `google_kms_crypto_key_iam_member` resources from the `google` provider.
660260
No line in this hunk matches that.