构建DataFlow Flex模板遇HTTPError 412，已配置CMEK仍报错求助

问题场景 #

构建DataFlow示例Flex模板getting_started-java时，已配置好所有必要角色与权限，且GCP存储桶已设置自定义托管CMEK，但执行构建命令后仍收到报错：

ERROR: (gcloud.dataflow.flex-template.build) HTTPError 412: A default customer-managed encryption key (CMEK) on the bucket is required by an org policy in effect.

执行的构建命令：

gcloud dataflow flex-template build gs://$BUCKETNAME/getting_started-java.json \ 
--image-gcr-path "europe-west2-docker.pkg.dev/my-project-id/test-repository/getting-started-java:latest" \ 
--sdk-language "JAVA" \ 
--dataflow-kms-key="projects/kms-project-id/locations/europe-west2/keyRings/computeEngine/cryptoKeys/computeEngine" \ 
--flex-template-base-image JAVA11 \ 
--metadata-file "metadata.json" \ 
--jar "target/flex-template-getting-started-1.0.jar" \ 
--env FLEX_TEMPLATE_JAVA_MAIN_CLASS="com.example.dataflow.FlexTemplateGettingStarted"

已尝试操作：

• 使用相同CMEK重新创建存储桶
• 测试存储桶上传下载，确认网络与权限无异常

可行解决方案 #

1. 检查CMEK与存储桶的区域一致性 #

确保CMEK密钥所在区域（europe-west2）和存储桶的区域完全匹配。区域不匹配会导致org policy检查失败，可通过以下命令查看桶的区域：

gsutil ls -L gs://$BUCKETNAME

2. 验证DataFlow服务账号的CMEK权限 #

确认DataFlow服务账号（格式为service-$PROJECT_NUMBER@dataflow-service-producer-prod.iam.gserviceaccount.com）拥有CMEK密钥的cloudkms.cryptoKeyEncrypterDecrypter角色，执行命令添加权限：

gcloud kms keys add-iam-policy-binding computeEngine \
  --keyring computeEngine \
  --location europe-west2 \
  --project kms-project-id \
  --member serviceAccount:service-$PROJECT_NUMBER@dataflow-service-producer-prod.iam.gserviceaccount.com \
  --role roles/cloudkms.cryptoKeyEncrypterDecrypter

替换$PROJECT_NUMBER为你的GCP项目编号

3. 添加--storage-kms-key参数强制对象加密 #

部分org policy会要求对象级加密也使用指定CMEK，在构建命令中添加与桶默认一致的CMEK参数：

gcloud dataflow flex-template build gs://$BUCKETNAME/getting_started-java.json \ 
--image-gcr-path "europe-west2-docker.pkg.dev/my-project-id/test-repository/getting-started-java:latest" \ 
--sdk-language "JAVA" \ 
--dataflow-kms-key="projects/kms-project-id/locations/europe-west2/keyRings/computeEngine/cryptoKeys/computeEngine" \ 
--storage-kms-key="projects/kms-project-id/locations/europe-west2/keyRings/computeEngine/cryptoKeys/computeEngine" \ 
--flex-template-base-image JAVA11 \ 
--metadata-file "metadata.json" \ 
--jar "target/flex-template-getting-started-1.0.jar" \ 
--env FLEX_TEMPLATE_JAVA_MAIN_CLASS="com.example.dataflow.FlexTemplateGettingStarted"

4. 检查Artifact Registry仓库的CMEK配置 #

构建过程中会推送镜像到europe-west2-docker.pkg.dev的仓库，需确认该Artifact Registry仓库也配置了符合org policy的CMEK，可在控制台给仓库设置对应密钥。

5. 刷新gcloud配置后重试 #

本地gcloud缓存可能存在异常，执行以下命令刷新配置后重新构建：

gcloud auth refresh
gcloud config set project my-project-id

内容的提问来源于stack exchange，提问作者JUN JIAN CHEN