Stay organized with collections
Save and categorize content based on your preferences.
This page provides instructions for how to migrate your volumes to
customer-managed encryption key (CMEK).
Before you begin
Volumes and their container storage pools can migrate from using Google-managed
encryption keys to using CMEK.
If you choose to migrate volumes to a CMEK policy, all volumes in the specified
region migrate to the CMEK policy. The CMEK policy setting applies to all
storage pools in the region.
Migrate volumes to CMEK
Use the following instructions to migrate volumes to CMEK using the
Google Cloud console or Google Cloud CLI.
Console
Use the following instructions to migrate volumes to CMEK using the
Google Cloud console:
Go to the NetApp Volumes page in the Google Cloud console.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-28 UTC."],[],[],null,["# Migrate volumes to CMEK\n\nThis page provides instructions for how to migrate your volumes to\ncustomer-managed encryption key (CMEK).\n\nBefore you begin\n----------------\n\nVolumes and their container storage pools can migrate from using Google-managed\nencryption keys to using CMEK.\n\nIf you choose to migrate volumes to a CMEK policy, all volumes in the specified\nregion migrate to the CMEK policy. The CMEK policy setting applies to all\nstorage pools in the region.\n\nMigrate volumes to CMEK\n-----------------------\n\nUse the following instructions to migrate volumes to CMEK using the\nGoogle Cloud console or Google Cloud CLI. \n\n### Console\n\nUse the following instructions to migrate volumes to CMEK using the\nGoogle Cloud console:\n\n1. Go to the **NetApp Volumes** page in the Google Cloud console.\n\n [Go to NetApp Volumes](https://console.cloud.google.com/netapp/volumes)\n2. Select **CMEK policies**.\n\n3. Find the CMEK policy you want to edit and click **Show more**.\n\n4. Select **Migrate volumes to CMEK**.\n\n5. Complete the **CMEK policy name** field to confirm migration.\n\n6. Click **Migrate**.\n\n### gcloud\n\nUse the following instructions to migrate volumes to CMEK using\nGoogle Cloud CLI:\n\nTrigger a key migration: \n\n```bash\n gcloud netapp kms-configs encrypt CONFIG_NAME \\\n --project=PROJECT_ID \\\n --location=LOCATION \\\n```\n\nReplace the following information:\n\n- \u003cvar translate=\"no\"\u003eCONFIG_NAME\u003c/var\u003e: the name of the config.\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the name of the project the volume\n is in.\n\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the region of the config you want to\n delete.\n\nFor more options, see [Google Cloud SDK documentation for Cloud Key Management Service](/sdk/gcloud/reference/netapp/kms-configs).\n\nWhat's next\n-----------\n\n[Monitor NetApp Volumes](/netapp/volumes/docs/monitor/cloud-monitoring-metrics)."]]
