Manage regions

Application Integration isregional, which means the infrastructure that runs your integrations is located in a specific region, and Google manages it so that it is available redundantly acrossall of the zones within that region. Apart from selecting the initial provisioning region for Application Integration during thesetup process, you can also enable or provision new regions to create and manage your integrations within the same Google Cloud project.

This page describes the steps needed to successfully provision a new Application Integration region and edit an existing region in your Google Cloud project.

Before you begin

Enable the following APIs:

• Application Integration API (integrations.googleapis.com)
• Connectors API (connectors.googleapis.com)

Provision new region

To provision a new region for Application Integration in your Google Cloud project, select one of the following options:

resource "random_id" "default" {  byte_length = 8}resource "google_kms_key_ring" "default" {  name     = "${random_id.default.hex}-example-keyring"  location = "us-east1"}resource "google_kms_crypto_key" "default" {  name            = "crypto-key-example"  key_ring        = google_kms_key_ring.default.id  rotation_period = "7776000s"}resource "google_kms_crypto_key_version" "default" {  crypto_key = google_kms_crypto_key.default.id}resource "google_service_account" "default" {  account_id   = "service-account-id"  display_name = "Service Account"}resource "google_integrations_client" "example" {  location                   = "us-east1"  create_sample_integrations = true  run_as_service_account     = google_service_account.default.email  cloud_kms_config {    kms_location   = "us-east1"    kms_ring       = basename(google_kms_key_ring.default.id)    key            = basename(google_kms_crypto_key.default.id)    key_version    = basename(google_kms_crypto_key_version.default.id)    kms_project_id = data.google_project.default.project_id  }}

Edit region

You can edit an existing region to enable or disable integration governance, and to update thedata encryption method for the region.

1. In the Google Cloud console, go to theApplication Integration page.

   Go to Application Integration

2. In the navigation menu, clickRegions.

TheRegions page appears, listing the provisioned regions in Application Integration.

3. For the existing region that you want to edit, in theActions column, click more_vertRegion actions and selectEdit.

   TheEdit region pane appears.

4. ExpandAdvanced settings.
5. To enable or disable integration governance for the selected region, click theEnable governance toggle.Note:
   • Enable governance to make service account authentication mandatory for the region. Once governance is enabled, you must manually add a service account to all the new integrations and integration versions created in this region. You can change or update the service account details of an integration any time from thesettingsIntegration settings pane in the integration toolbar.

     If governance is enabled, you can publish or test an integration only when a service account is attached to it.

   • If you disable governance for the selected region, then all the existing published integrations continue to use their respective attached service accounts until a new version of the integrations is created.
6. To enable or disable HTTP access for integrations in the selected region, click theEnable HTTP toggle. When enabled, integrations in this region can be accessed over HTTP.
7. To enable or disable AI features for integrations in the selected region, click theEnable AI features toggle. When enabled, you can use AI features like troubleshooting using Gemini AI in the selected region.
8. To enable masking for variables, in theVariable Masking section, click theEnable Variable Masking in logs toggle. This feature is inpreview.

   For information about masking, seeMask sensitive data in logs.

9. To enable CMEK encryption for selected region, selectCustomer-managed encryption key (CMEK), and do the following:
   1. Select a CMEK from the available drop-down list. The CMEKs listed in the drop-down are based on the provisioned region. To create a new key, seeCreate new CMEK.
   2. ClickVerify to check if your default service account has CryptoKey access to the selected CMEK.
   3. If the verification for the selected CMEK fails, clickGrant to assign theCryptoKey Encrypter/Decrypter IAM role to the default service account.
10. To enable CMEK encryption for Integration Connectors, selectUse different CMEK for Integration connectors, and do the following:
    1. Select a CMEK from the available drop-down list. The CMEKs listed in the drop-down are based on the provisioned region. To create a new key, seeCreate new CMEK.
    2. ClickVerify to finish setting up Integration Connectors CMEK.
11. ClickDone to complete editing the region.