Manage regions

Console

1. Go to the Application Integration page.

   Go to Application Integration

2. In the navigation menu, click Regions

   The Regions page appears listing all the regions provisioned in your project.

3. Click Provision new region.
4. Configure the following fields in the Provision new region page:
   1. Region: Select the new regional location that you want to provision.

      For information about the supported Application Integration regions, see Application Integration locations.

   2. Advanced settings: Optionally, expand this section to enable or disable the HTTP access for integrations and configure the encryption method for the selected region.
      • HTTP: Click the Enable HTTP toggle to enable HTTP access for integrations within the selected region. When enabled, integrations in this region can be accessed over HTTP.
      • Google-managed encryption key: This is the default encryption method. Use this method if you want Google to manage the encryption keys that protect your data in the selected region.
      • Customer-managed encryption key (CMEK): Use this method if you want to manage the encryption keys that protect your data in the selected region.

        When configuring your encryption settings, you have two options for managing CMEK: Application Integration and Connectors (CMEK), and Use a different CMEK for Integration Connectors, as follows:

        • Application Integration and Connectors - CMEK: This is the default option and is suitable if you want to use the same encryption key for both Application Integration and Integration Connectors. To use this option, perform the following steps:
          1. Click Select a Cloud KMS key and choose an existing CMEK key available in the selected region. You can also create a new key or use the KMS resource ID of your existing key.
          2. Click Verify to check if your default service account has CryptoKey access to the selected CMEK key.
          3. If the verification fails, click Grant to assign the CryptoKey Encrypter/Decrypter IAM role to the default service account.
        • Use different CMEK for Integration Connectors: Select this checkbox if you prefer to use separate encryption keys for Application Integration and Integration Connectors. If selected, the following options appear:
          • Application Integration - CMEK
            1. Click Select a Cloud KMS key and choose an existing CMEK key for Application Integration in the selected region. Alternatively, you can create a new key or use the Key resource ID of an existing one.
            2. Click Verify to finish setting up CMEK for Application Integration.
          • Integration Connectors - CMEK
            1. Click Select a Cloud KMS key and choose an existing CMEK key for Integration Connectors in the selected region. Alternatively, you can create a new key or use the Key resource ID of an existing key.
            2. Click Verify to check if your default service account has CryptoKey access to the selected CMEK.

            If the verification for the selected CMEK key fails, click Grant to assign the CryptoKey Encrypter/Decrypter IAM role to the default service account.

        For more information about CMEK, see Customer-managed encryption keys.

5. Click Done.

Terraform

Use the google_integrations_client resource. The following example provisions the us-east1 region:

resource "random_id" "default" {
  byte_length = 8
}

resource "google_kms_key_ring" "default" {
  name     = "${random_id.default.hex}-example-keyring"
  location = "us-east1"
}

resource "google_kms_crypto_key" "default" {
  name            = "crypto-key-example"
  key_ring        = google_kms_key_ring.default.id
  rotation_period = "7776000s"
}

resource "google_kms_crypto_key_version" "default" {
  crypto_key = google_kms_crypto_key.default.id
}

resource "google_service_account" "default" {
  account_id   = "service-account-id"
  display_name = "Service Account"
}

resource "google_integrations_client" "example" {
  location                   = "us-east1"
  create_sample_integrations = true
  run_as_service_account     = google_service_account.default.email
  cloud_kms_config {
    kms_location   = "us-east1"
    kms_ring       = basename(google_kms_key_ring.default.id)
    key            = basename(google_kms_crypto_key.default.id)
    key_version    = basename(google_kms_crypto_key_version.default.id)
    kms_project_id = data.google_project.default.project_id
  }
}