API hub needs to create a new service identity and grant it access to your selected KMS key so that we can encrypt and decrypt data using your KMS key, Apigee proxies to enable automatic import of your Apigee proxies from the host project and API Hub to call API Hub APIs. The new service identity will be granted below roles:
Service identity:
[email protected]
IAM role:
cloudkms.cryptoKeyEncrypterDecrypter
apihub.admin
apihub.runtimeProjectServiceAgent