gcp_kms_crypto_key

ancestors

Type: UNORDERED_LIST_STRING

create_time

Type: TIMESTAMP
Provider name: createTime
Description: Output only. The time at which this CryptoKey was created.

crypto_key_backend

Type: STRING
Provider name: cryptoKeyBackend
Description: Immutable. The resource name of the backend environment where the key material for all CryptoKeyVersions associated with this CryptoKey reside and where all related cryptographic operations are performed. Only applicable if CryptoKeyVersions have a ProtectionLevel of EXTERNAL_VPC, with the resource name in the format projects/*/locations/*/ekmConnections/*. Note, this list is non-exhaustive and may apply to additional ProtectionLevels in the future.

destroy_scheduled_duration

Type: STRING
Provider name: destroyScheduledDuration
Description: Immutable. The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED. If not specified at creation time, the default duration is 24 hours.

import_only

Type: BOOLEAN
Provider name: importOnly
Description: Immutable. Whether this key may contain imported versions only.

labels

Type: UNORDERED_LIST_STRING

name

Type: STRING
Provider name: name
Description: Output only. The resource name for this CryptoKey in the format projects/*/locations/*/keyRings/*/cryptoKeys/*.

next_rotation_time

Type: TIMESTAMP
Provider name: nextRotationTime
Description: At next_rotation_time, the Key Management Service will automatically: 1. Create a new version of this CryptoKey. 2. Mark the new version as primary. Key rotations performed manually via CreateCryptoKeyVersion and UpdateCryptoKeyPrimaryVersion do not affect next_rotation_time. Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted.

organization_id

Type: STRING

parent

Type: STRING

primary

Type: STRUCT
Provider name: primary
Description: Output only. A copy of the “primary” CryptoKeyVersion that will be used by Encrypt when this CryptoKey is given in EncryptRequest.name. The CryptoKey’s primary version can be updated via UpdateCryptoKeyPrimaryVersion. Keys with purpose ENCRYPT_DECRYPT may have a primary. For other keys, this field will be omitted.

• algorithm
  Type: STRING
  Provider name: algorithm
  Description: Output only. The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
  Possible values:
  
  • CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED - Not specified.
    
  • GOOGLE_SYMMETRIC_ENCRYPTION - Creates symmetric encryption keys.
    
  • AES_128_GCM - AES-GCM (Galois Counter Mode) using 128-bit keys.
    
  • AES_256_GCM - AES-GCM (Galois Counter Mode) using 256-bit keys.
    
  • RSA_SIGN_PSS_2048_SHA256 - RSASSA-PSS 2048 bit key with a SHA256 digest.
    
  • RSA_SIGN_PSS_3072_SHA256 - RSASSA-PSS 3072 bit key with a SHA256 digest.
    
  • RSA_SIGN_PSS_4096_SHA256 - RSASSA-PSS 4096 bit key with a SHA256 digest.
    
  • RSA_SIGN_PSS_4096_SHA512 - RSASSA-PSS 4096 bit key with a SHA512 digest.
    
  • RSA_SIGN_PKCS1_2048_SHA256 - RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
    
  • RSA_SIGN_PKCS1_3072_SHA256 - RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
    
  • RSA_SIGN_PKCS1_4096_SHA256 - RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
    
  • RSA_SIGN_PKCS1_4096_SHA512 - RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
    
  • RSA_SIGN_RAW_PKCS1_2048 - RSASSA-PKCS1-v1_5 signing without encoding, with a 2048 bit key.
    
  • RSA_SIGN_RAW_PKCS1_3072 - RSASSA-PKCS1-v1_5 signing without encoding, with a 3072 bit key.
    
  • RSA_SIGN_RAW_PKCS1_4096 - RSASSA-PKCS1-v1_5 signing without encoding, with a 4096 bit key.
    
  • RSA_DECRYPT_OAEP_2048_SHA256 - RSAES-OAEP 2048 bit key with a SHA256 digest.
    
  • RSA_DECRYPT_OAEP_3072_SHA256 - RSAES-OAEP 3072 bit key with a SHA256 digest.
    
  • RSA_DECRYPT_OAEP_4096_SHA256 - RSAES-OAEP 4096 bit key with a SHA256 digest.
    
  • RSA_DECRYPT_OAEP_4096_SHA512 - RSAES-OAEP 4096 bit key with a SHA512 digest.
    
  • RSA_DECRYPT_OAEP_2048_SHA1 - RSAES-OAEP 2048 bit key with a SHA1 digest.
    
  • RSA_DECRYPT_OAEP_3072_SHA1 - RSAES-OAEP 3072 bit key with a SHA1 digest.
    
  • RSA_DECRYPT_OAEP_4096_SHA1 - RSAES-OAEP 4096 bit key with a SHA1 digest.
    
  • EC_SIGN_P256_SHA256 - ECDSA on the NIST P-256 curve with a SHA256 digest. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms
    
  • EC_SIGN_P384_SHA384 - ECDSA on the NIST P-384 curve with a SHA384 digest. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms
    
  • EC_SIGN_SECP256K1_SHA256 - ECDSA on the non-NIST secp256k1 curve. This curve is only supported for HSM protection level. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms
    
  • HMAC_SHA256 - HMAC-SHA256 signing with a 256 bit key.
    
  • HMAC_SHA1 - HMAC-SHA1 signing with a 160 bit key.
    
  • HMAC_SHA384 - HMAC-SHA384 signing with a 384 bit key.
    
  • HMAC_SHA512 - HMAC-SHA512 signing with a 512 bit key.
    
  • HMAC_SHA224 - HMAC-SHA224 signing with a 224 bit key.
    
  • EXTERNAL_SYMMETRIC_ENCRYPTION - Algorithm representing symmetric encryption by an external key manager.
    
• attestation
  Type: STRUCT
  Provider name: attestation
  Description: Output only. Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protection_level HSM.
  
  • cert_chains
    Type: STRUCT
    Provider name: certChains
    Description: Output only. The certificate chains needed to validate the attestation
    
    • cavium_certs
      Type: UNORDERED_LIST_STRING
      Provider name: caviumCerts
      Description: Cavium certificate chain corresponding to the attestation.
      
    • google_card_certs
      Type: UNORDERED_LIST_STRING
      Provider name: googleCardCerts
      Description: Google card certificate chain corresponding to the attestation.
      
    • google_partition_certs
      Type: UNORDERED_LIST_STRING
      Provider name: googlePartitionCerts
      Description: Google partition certificate chain corresponding to the attestation.
      
  • format
    Type: STRING
    Provider name: format
    Description: Output only. The format of the attestation data.
    Possible values:
    
    • ATTESTATION_FORMAT_UNSPECIFIED - Not specified.
      
    • CAVIUM_V1_COMPRESSED - Cavium HSM attestation compressed with gzip. Note that this format is defined by Cavium and subject to change at any time. See https://www.marvell.com/products/security-solutions/nitrox-hs-adapters/software-key-attestation.html.
      
    • CAVIUM_V2_COMPRESSED - Cavium HSM attestation V2 compressed with gzip. This is a new format introduced in Cavium’s version 3.2-08.
      
• create_time
  Type: TIMESTAMP
  Provider name: createTime
  Description: Output only. The time at which this CryptoKeyVersion was created.
  
• destroy_event_time
  Type: TIMESTAMP
  Provider name: destroyEventTime
  Description: Output only. The time this CryptoKeyVersion’s key material was destroyed. Only present if state is DESTROYED.
  
• destroy_time
  Type: TIMESTAMP
  Provider name: destroyTime
  Description: Output only. The time this CryptoKeyVersion’s key material is scheduled for destruction. Only present if state is DESTROY_SCHEDULED.
  
• external_destruction_failure_reason
  Type: STRING
  Provider name: externalDestructionFailureReason
  Description: Output only. The root cause of the most recent external destruction failure. Only present if state is EXTERNAL_DESTRUCTION_FAILED.
  
• external_protection_level_options
  Type: STRUCT
  Provider name: externalProtectionLevelOptions
  Description: ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
  
  • ekm_connection_key_path
    Type: STRING
    Provider name: ekmConnectionKeyPath
    Description: The path to the external key material on the EKM when using EkmConnection e.g., “v0/my/key”. Set this field instead of external_key_uri when using an EkmConnection.
    
  • external_key_uri
    Type: STRING
    Provider name: externalKeyUri
    Description: The URI for an external resource that this CryptoKeyVersion represents.
    
• generate_time
  Type: TIMESTAMP
  Provider name: generateTime
  Description: Output only. The time this CryptoKeyVersion’s key material was generated.
  
• generation_failure_reason
  Type: STRING
  Provider name: generationFailureReason
  Description: Output only. The root cause of the most recent generation failure. Only present if state is GENERATION_FAILED.
  
• import_failure_reason
  Type: STRING
  Provider name: importFailureReason
  Description: Output only. The root cause of the most recent import failure. Only present if state is IMPORT_FAILED.
  
• import_job
  Type: STRING
  Provider name: importJob
  Description: Output only. The name of the ImportJob used in the most recent import of this CryptoKeyVersion. Only present if the underlying key material was imported.
  
• import_time
  Type: TIMESTAMP
  Provider name: importTime
  Description: Output only. The time at which this CryptoKeyVersion’s key material was most recently imported.
  
• name
  Type: STRING
  Provider name: name
  Description: Output only. The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*.
  
• protection_level
  Type: STRING
  Provider name: protectionLevel
  Description: Output only. The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.
  Possible values:
  
  • PROTECTION_LEVEL_UNSPECIFIED - Not specified.
    
  • SOFTWARE - Crypto operations are performed in software.
    
  • HSM - Crypto operations are performed in a Hardware Security Module.
    
  • EXTERNAL - Crypto operations are performed by an external key manager.
    
  • EXTERNAL_VPC - Crypto operations are performed in an EKM-over-VPC backend.
    
• reimport_eligible
  Type: BOOLEAN
  Provider name: reimportEligible
  Description: Output only. Whether or not this key version is eligible for reimport, by being specified as a target in ImportCryptoKeyVersionRequest.crypto_key_version.
  
• state
  Type: STRING
  Provider name: state
  Description: The current state of the CryptoKeyVersion.
  Possible values:
  
  • CRYPTO_KEY_VERSION_STATE_UNSPECIFIED - Not specified.
    
  • PENDING_GENERATION - This version is still being generated. It may not be used, enabled, disabled, or destroyed yet. Cloud KMS will automatically mark this version ENABLED as soon as the version is ready.
    
  • ENABLED - This version may be used for cryptographic operations.
    
  • DISABLED - This version may not be used, but the key material is still available, and the version can be placed back into the ENABLED state.
    
  • DESTROYED - This version is destroyed, and the key material is no longer stored. This version may only become ENABLED again if this version is reimport_eligible and the original key material is reimported with a call to KeyManagementService.ImportCryptoKeyVersion.
    
  • DESTROY_SCHEDULED - This version is scheduled for destruction, and will be destroyed soon. Call RestoreCryptoKeyVersion to put it back into the DISABLED state.
    
  • PENDING_IMPORT - This version is still being imported. It may not be used, enabled, disabled, or destroyed yet. Cloud KMS will automatically mark this version ENABLED as soon as the version is ready.
    
  • IMPORT_FAILED - This version was not imported successfully. It may not be used, enabled, disabled, or destroyed. The submitted key material has been discarded. Additional details can be found in CryptoKeyVersion.import_failure_reason.
    
  • GENERATION_FAILED - This version was not generated successfully. It may not be used, enabled, disabled, or destroyed. Additional details can be found in CryptoKeyVersion.generation_failure_reason.
    
  • PENDING_EXTERNAL_DESTRUCTION - This version was destroyed, and it may not be used or enabled again. Cloud KMS is waiting for the corresponding key material residing in an external key manager to be destroyed.
    
  • EXTERNAL_DESTRUCTION_FAILED - This version was destroyed, and it may not be used or enabled again. However, Cloud KMS could not confirm that the corresponding key material residing in an external key manager was destroyed. Additional details can be found in CryptoKeyVersion.external_destruction_failure_reason.
    

project_id

Type: STRING

project_number

Type: STRING

purpose

Type: STRING
Provider name: purpose
Description: Immutable. The immutable purpose of this CryptoKey.
Possible values:

• CRYPTO_KEY_PURPOSE_UNSPECIFIED - Not specified.
  
• ENCRYPT_DECRYPT - CryptoKeys with this purpose may be used with Encrypt and Decrypt.
  
• ASYMMETRIC_SIGN - CryptoKeys with this purpose may be used with AsymmetricSign and GetPublicKey.
  
• ASYMMETRIC_DECRYPT - CryptoKeys with this purpose may be used with AsymmetricDecrypt and GetPublicKey.
  
• RAW_ENCRYPT_DECRYPT - CryptoKeys with this purpose may be used with RawEncrypt and RawDecrypt. This purpose is meant to be used for interoperable symmetric encryption and does not support automatic CryptoKey rotation.
  
• MAC - CryptoKeys with this purpose may be used with MacSign.
  

resource_name

Type: STRING

rotation_period

Type: STRING
Provider name: rotationPeriod
Description: next_rotation_time will be advanced by this period when the service automatically rotates a key. Must be at least 24 hours and at most 876,000 hours. If rotation_period is set, next_rotation_time must also be set. Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted.

tags

Type: UNORDERED_LIST_STRING

version_template

Type: STRUCT
Provider name: versionTemplate
Description: A template describing settings for new CryptoKeyVersion instances. The properties of new CryptoKeyVersion instances created by either CreateCryptoKeyVersion or auto-rotation are controlled by this template.

• algorithm
  Type: STRING
  Provider name: algorithm
  Description: Required. Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
  Possible values:
  
  • CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED - Not specified.
    
  • GOOGLE_SYMMETRIC_ENCRYPTION - Creates symmetric encryption keys.
    
  • AES_128_GCM - AES-GCM (Galois Counter Mode) using 128-bit keys.
    
  • AES_256_GCM - AES-GCM (Galois Counter Mode) using 256-bit keys.
    
  • RSA_SIGN_PSS_2048_SHA256 - RSASSA-PSS 2048 bit key with a SHA256 digest.
    
  • RSA_SIGN_PSS_3072_SHA256 - RSASSA-PSS 3072 bit key with a SHA256 digest.
    
  • RSA_SIGN_PSS_4096_SHA256 - RSASSA-PSS 4096 bit key with a SHA256 digest.
    
  • RSA_SIGN_PSS_4096_SHA512 - RSASSA-PSS 4096 bit key with a SHA512 digest.
    
  • RSA_SIGN_PKCS1_2048_SHA256 - RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
    
  • RSA_SIGN_PKCS1_3072_SHA256 - RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
    
  • RSA_SIGN_PKCS1_4096_SHA256 - RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
    
  • RSA_SIGN_PKCS1_4096_SHA512 - RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
    
  • RSA_SIGN_RAW_PKCS1_2048 - RSASSA-PKCS1-v1_5 signing without encoding, with a 2048 bit key.
    
  • RSA_SIGN_RAW_PKCS1_3072 - RSASSA-PKCS1-v1_5 signing without encoding, with a 3072 bit key.
    
  • RSA_SIGN_RAW_PKCS1_4096 - RSASSA-PKCS1-v1_5 signing without encoding, with a 4096 bit key.
    
  • RSA_DECRYPT_OAEP_2048_SHA256 - RSAES-OAEP 2048 bit key with a SHA256 digest.
    
  • RSA_DECRYPT_OAEP_3072_SHA256 - RSAES-OAEP 3072 bit key with a SHA256 digest.
    
  • RSA_DECRYPT_OAEP_4096_SHA256 - RSAES-OAEP 4096 bit key with a SHA256 digest.
    
  • RSA_DECRYPT_OAEP_4096_SHA512 - RSAES-OAEP 4096 bit key with a SHA512 digest.
    
  • RSA_DECRYPT_OAEP_2048_SHA1 - RSAES-OAEP 2048 bit key with a SHA1 digest.
    
  • RSA_DECRYPT_OAEP_3072_SHA1 - RSAES-OAEP 3072 bit key with a SHA1 digest.
    
  • RSA_DECRYPT_OAEP_4096_SHA1 - RSAES-OAEP 4096 bit key with a SHA1 digest.
    
  • EC_SIGN_P256_SHA256 - ECDSA on the NIST P-256 curve with a SHA256 digest. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms
    
  • EC_SIGN_P384_SHA384 - ECDSA on the NIST P-384 curve with a SHA384 digest. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms
    
  • EC_SIGN_SECP256K1_SHA256 - ECDSA on the non-NIST secp256k1 curve. This curve is only supported for HSM protection level. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms
    
  • HMAC_SHA256 - HMAC-SHA256 signing with a 256 bit key.
    
  • HMAC_SHA1 - HMAC-SHA1 signing with a 160 bit key.
    
  • HMAC_SHA384 - HMAC-SHA384 signing with a 384 bit key.
    
  • HMAC_SHA512 - HMAC-SHA512 signing with a 512 bit key.
    
  • HMAC_SHA224 - HMAC-SHA224 signing with a 224 bit key.
    
  • EXTERNAL_SYMMETRIC_ENCRYPTION - Algorithm representing symmetric encryption by an external key manager.
    
• protection_level
  Type: STRING
  Provider name: protectionLevel
  Description: ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
  Possible values:
  
  • PROTECTION_LEVEL_UNSPECIFIED - Not specified.
    
  • SOFTWARE - Crypto operations are performed in software.
    
  • HSM - Crypto operations are performed in a Hardware Security Module.
    
  • EXTERNAL - Crypto operations are performed by an external key manager.
    
  • EXTERNAL_VPC - Crypto operations are performed in an EKM-over-VPC backend.