本頁面中的部分或全部資訊可能不適用於 Trusted Cloud by S3NS。
配額
Trusted Cloud by S3NS 會針對資源用量強制設定配額。就 Cloud KMS 而言，資源用量會受到強制配額限制的項目為金鑰、金鑰環、金鑰版本及位置。如要進一步瞭解如何管理或增加配額，請參閱「監控及調整 Cloud KMS 配額」。
查看 Cloud KMS 配額
KeyRing、CryptoKey 或 CryptoKeyVersion 資源的數量則無配額上限，只有作業數量有相關限制。
這些作業的部分配額適用於呼叫專案，也就是呼叫 Cloud KMS 服務的Trusted Cloud 專案。其他配額適用於託管專案，也就是 Trusted Cloud 專案，其中包含用於作業的金鑰。
呼叫專案配額不包含由Trusted Cloud 服務產生的用量，這些服務會使用 Cloud KMS 金鑰進行客戶管理式加密金鑰 (CMEK) 整合。舉例來說，直接來自 BigQuery、Bigtable 或 Spanner 的加密和解密要求，不會計入加密要求配額。
Trusted Cloud 控制台會以每分鐘查詢次數 (QPM) 列出各項配額的上限，但託管專案配額則以秒為單位。每秒查詢次數 (QPS) 的配額限制會拒絕超過 QPS 限制的要求，即使每分鐘用量低於所列的 QPM 限制也一樣。如果您超過每秒查詢次數限制，就會收到 RESOURCE_EXHAUSTED 錯誤。
Cloud KMS 資源的使用配額
下表列出適用於 Cloud KMS 資源的各項配額。表格會列出每個配額的名稱和限制、配額適用的專案，以及會計入配額的作業。您可以在欄位中輸入關鍵字來篩選表格。舉例來說，您可以輸入「calling」來查看僅適用於呼叫專案的配額，或是輸入「encrypt」來查看僅與加密作業相關的配額：
配額範例
以下各節列舉了使用以下範例專案的各項配額範例：
KEY_PROJECT - Trusted Cloud 專案，其中包含 Cloud KMS 金鑰，包括 Cloud HSM 和 Cloud EKM 金鑰。
SPANNER_PROJECT： Trusted Cloud 專案，其中包含使用 KEY_PROJECT 中客戶管理的加密金鑰 (CMEK) 的 Spanner 例項。
SERVICE_PROJECT： Trusted Cloud 專案，其中包含用於管理 KEY_PROJECT 中 Cloud KMS 資源的服務帳戶。
讀取要求數
「Read requests」配額會限制呼叫 Cloud KMS API 的Trusted Cloud 專案讀取要求數量。舉例來說，使用 Google Cloud CLI 查看 KEY_PROJECT 中的 KEY_PROJECT 金鑰清單，會計入 KEY_PROJECT
Read requests 配額。如果您在 SERVICE_PROJECT 中使用服務帳戶查看金鑰清單，讀取要求會計入 SERVICE_PROJECT 的「Read requests」配額。
使用 Trusted Cloud 主控台查看 Cloud KMS 資源不會影響讀取要求配額。
寫入要求數
「寫入要求」配額會限制呼叫 Cloud KMS API 的Trusted Cloud 專案寫入要求數。舉例來說，使用 gcloud CLI 在 KEY_PROJECT 中建立金鑰時，會計入 KEY_PROJECT 的寫入要求配額。如果您使用 SERVICE_PROJECT 中的服務帳戶建立金鑰，寫入要求會計入 SERVICE_PROJECT 的寫入要求配額。
使用 Trusted Cloud 控制台建立或管理 Cloud KMS 資源不會影響讀取要求配額。
密碼編譯要求
「密碼編譯要求」配額會限制呼叫 Cloud KMS API 的Trusted Cloud 專案密碼編譯作業。舉例來說，如果您使用 KEY_PROJECT 的金鑰，透過在 SERVICE_PROJECT 中執行的服務帳戶資源發出 API 呼叫來加密資料，就會計入 SERVICE_PROJECT 的密碼編譯要求配額。
使用 CMEK 整合功能，在 SPANNER_PROJECT 的 Spanner 資源中加密及解密資料，不會計入 SPANNER_PROJECT 的密碼編譯要求配額。
每個區域的 HSM 對稱密碼編譯要求
HSM 對稱加密編譯要求/區域 配額會限制使用對稱 Cloud HSM 金鑰的加密編譯作業，且只適用於包含這些金鑰的 Trusted Cloud專案。舉例來說，使用對稱 HSM 金鑰加密 Spanner 資源中的資料，會計入 KEY_PROJECT HSM 對稱加密編譯要求 (每個區域) 配額。
每個地區的 HSM 非對稱式密碼編譯要求
HSM 非對稱加密編譯要求/區域配額會限制使用非對稱 Cloud HSM 金鑰的加密編譯作業，且只適用於包含這些金鑰的 Trusted Cloud專案。舉例來說，使用非對稱 HSM 金鑰加密 Spanner 資源中的資料時，會計入 KEY_PROJECT HSM 非對稱密碼編譯要求 (每個區域) 配額。
HSM 會為每個區域產生隨機要求
HSM 產生隨機要求的每個區域配額限制會在要求訊息中指定的 Trusted Cloud 專案中，使用 Cloud HSM 產生隨機位元組作業。舉例來說，如果任何來源在 KEY_PROJECT 中產生隨機位元組的要求，都會計入 KEY_PROJECT
HSM 產生隨機要求的區域配額。
每個區域的外部密碼編譯要求
每個區域的外部加密編譯要求配額會限制使用外部 (Cloud EKM) 金鑰的加密編譯作業，且僅適用於包含這些金鑰的 Trusted Cloud 專案。舉例來說，使用 EKM 金鑰加密 Spanner 資源中的資料時，會計入 KEY_PROJECT 每個區域的外部密碼編譯要求配額。
配額錯誤資訊
如果您在達到配額上限之後提出要求，該項要求會產生 RESOURCE_EXHAUSTED 錯誤，並傳回 429 的 HTTP 狀態碼。如要瞭解用戶端程式庫如何顯示 RESOURCE_EXHAUSTED 錯誤，請參閱用戶端程式庫對應。
如果您收到 RESOURCE_EXHAUSTED 錯誤，表示您每秒傳送的加密作業要求過多。即使 Trusted Cloud 主控台顯示您已達到每分鐘查詢次數限制，您仍可能收到 RESOURCE_EXHAUSTED 錯誤。這個問題可能會發生，因為 Cloud KMS 代管專案配額每分鐘顯示一次，但以每秒的規模強制執行。如要進一步瞭解如何監控指標，請參閱「監控配額指標及設定相關快訊」。
如要進一步瞭解如何排解 Cloud KMS 配額問題，請參閱排解配額問題。
後續步驟
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-08-18 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-18 (世界標準時間)。"],[],[],null,["# Quotas\n\nGoogle Cloud enforces quotas on resource usage. For Cloud KMS,\nquotas are enforced on usage of resources such as keys, key rings, key versions,\nand locations. For details on how to manage or increase your quotas, see\n[Monitor and adjust Cloud KMS quotas](/kms/docs/monitor-adjust-quotas).\n\n[View Cloud KMS quotas](https://console.cloud.google.com/apis/api/cloudkms.googleapis.com/quotas)\n\nThere's no quota on the number of `KeyRing`, `CryptoKey`, or `CryptoKeyVersion`\nresources, only on the number of operations.\n\nSome quotas on these operations apply to the *calling project* , the\nGoogle Cloud project that **makes calls to the\nCloud KMS service** . Other quotas apply to the *hosting project* ,\nthe Google Cloud project that **contains the keys used for the\noperation**.\n\nCalling project quotas don't include usage generated by\nGoogle Cloud services using Cloud KMS keys for\n[customer-managed encryption key (CMEK) integration](/kms/docs/using-other-products#cmek_integrations).\nFor example, encryption and decryption requests coming directly from\nBigQuery, Bigtable, or Spanner don't contribute to\n[Cryptographic requests](#cryptographic_requests) quotas.\n\nThe Google Cloud console lists the limit for each quota in queries per minute\n(QPM), but hosting project quotas are enforced by the second. Quotas\nenforced in queries per second (QPS) deny requests that exceed the QPS limit,\neven if your per-minute usage is less than the listed QPM limit. If you exceed a\nQPS limit, you receive a [`RESOURCE_EXHAUSTED` error](#error).\n\nQuotas on the usage of Cloud KMS resources\n------------------------------------------\n\nThe following table lists each quota applied to Cloud KMS resources. The table gives the name and limit of each quota, which project the quota applies to, and the operations that count against the quota. You can enter a keyword\nin the field to filter the table. For example, you can enter *calling* to see\nonly quotas applied to the calling project or *encrypt* to see only quotas\nrelated to encryption operations: \n\nQuota examples\n--------------\n\nThe following sections include examples of each quota using the following\nexample projects:\n\n- `KEY_PROJECT` - A Google Cloud project that contains\n Cloud KMS keys including Cloud HSM and\n Cloud EKM keys.\n\n- `SPANNER_PROJECT` - A Google Cloud project that contains a\n Spanner instance which uses the customer-managed encryption keys\n (CMEKs) that reside in `KEY_PROJECT`.\n\n- `SERVICE_PROJECT` - A Google Cloud project that contains a\n service account that you use to manage Cloud KMS resources that\n reside in `KEY_PROJECT`.\n\n### Read requests\n\nThe **Read requests** quota limits read requests from the\nGoogle Cloud project calling the Cloud KMS API. For\nexample, viewing a list of keys in `KEY_PROJECT` from `KEY_PROJECT` using\nGoogle Cloud CLI counts against the `KEY_PROJECT`\n**Read requests** quota. If you use a service account in\n`SERVICE_PROJECT` to view your list of keys, the read request counts\nagainst the `SERVICE_PROJECT` **Read requests** quota.\n\nUsing the Google Cloud console to view Cloud KMS resources doesn't\ncontribute to the **Read requests** quota.\n\n### Write requests\n\nThe **Write requests** quota limits write requests from the\nGoogle Cloud project calling the Cloud KMS API. For\nexample, creating keys in `KEY_PROJECT` using gcloud CLI counts\nagainst the `KEY_PROJECT` **Write requests** quota. If you use a\nservice account in `SERVICE_PROJECT` to create keys, the write\nrequest counts against the `SERVICE_PROJECT` **Write requests** quota.\n\nUsing the Google Cloud console to create or manage Cloud KMS\nresources doesn't contribute to the **Read requests** quota.\n\n### Cryptographic requests\n\nThe **Cryptographic requests** quota limits cryptographic operations from the\nGoogle Cloud project calling the Cloud KMS API. For\nexample, encrypting data using API calls from a service account resource running\nin `SERVICE_PROJECT` using keys from `KEY_PROJECT` counts against the\n`SERVICE_PROJECT` **Cryptographic requests** quota.\n\nEncryption and decryption of data in a Spanner resource in\n`SPANNER_PROJECT` using CMEK integration doesn't count toward the\n**Cryptographic requests** quota of `SPANNER_PROJECT`.\n\n### HSM symmetric cryptographic requests per\nregion\n\nThe **HSM symmetric cryptographic requests per\nregion** quota limits cryptographic operations using\nsymmetric [Cloud HSM](/kms/docs/hsm) keys on the Google Cloud\nproject that contains those keys. For example, encrypting data in a\nSpanner resource using symmetric HSM keys counts against the\n`KEY_PROJECT` **HSM symmetric cryptographic requests per\nregion** quota.\n\n### HSM asymmetric cryptographic requests per\nregion\n\nThe **HSM asymmetric cryptographic requests per\nregion** quota limits cryptographic operations using\nasymmetric [Cloud HSM](/kms/docs/hsm) keys on the Google Cloud\nproject that contains those keys. For example, encrypting data in a\nSpanner resource using asymmetric HSM keys counts against the\n`KEY_PROJECT` **HSM asymmetric cryptographic requests per\nregion** quota.\n\n### HSM generate random requests per\nregion\n\nThe **HSM generate random requests per\nregion** quota limits generate random bytes operations using\n[Cloud HSM](/kms/docs/hsm) in the Google Cloud project specified in\nthe request message. For example, requests from any source to generate random\nbytes in `KEY_PROJECT` counts against the `KEY_PROJECT`\n**HSM generate random requests per\nregion** quota.\n\n### External cryptographic requests per\nregion\n\nThe **External cryptographic requests per\nregion** quota limits cryptographic operations using external\n([Cloud EKM](/kms/docs/ekm)) keys on the Google Cloud project that\ncontains those keys. For example, encrypting data in a Spanner resource\nusing EKM keys counts against the `KEY_PROJECT` **External cryptographic requests per\nregion** quota.\n\nQuota error information\n-----------------------\n\nIf you make a request after your quota is reached, your request results in a\n`RESOURCE_EXHAUSTED` error. The HTTP status code is `429`. For information on\nhow client libraries surface the `RESOURCE_EXHAUSTED` error, see [Client library\nmapping](/apis/design/errors#client_library_mapping).\n\nIf you receive the `RESOURCE_EXHAUSTED` error, you might be sending too many\n[cryptographic operation requests](#cryptographic_requests) per second. You can receive the\n`RESOURCE_EXHAUSTED` error even if the Google Cloud console shows that you are\nwithin the queries per minute limit. This issue can happen because\nCloud KMS hosting project quotas are displayed per minute, but are\nenforced on a per second scale. To learn more about monitoring metrics, see\n[Set up quota alerts and monitoring](/docs/quotas/set-up-quota-alerts).\n\nFor details about troubleshooting Cloud KMS quota issues, see\n[Troubleshoot quota issues](/kms/docs/monitor-adjust-quotas#troubleshoot_quotas).\n\nWhat's next\n-----------\n\n- Learn about [using Cloud Monitoring with Cloud KMS](/kms/docs/monitoring#rate_quota_metrics).\n- Learn how to [monitor and adjust Cloud KMS quotas](/kms/docs/monitor-adjust-quotas)."]]
