google-cloud-kms-v1 1.14.0 → 1.15.0

data/lib/google/cloud/kms/v1/key_management_service/rest/client.rb

@@ -1516,7 +1516,7 @@ module Google
               #   @param options [::Gapic::CallOptions, ::Hash]
               #     Overrides the default settings for this call, e.g, timeout, retries etc. Optional.
               #
-              # @overload create_crypto_key(parent: nil, crypto_key_id: nil, crypto_key: nil, skip_initial_version_creation: nil)
+              # @overload create_crypto_key(parent: nil, crypto_key_id: nil, crypto_key: nil, skip_initial_version_creation: nil, trusted_wrapping_enabled: nil)
               #   Pass arguments to `create_crypto_key` via keyword arguments. Note that at
               #   least one keyword argument is required. To specify no parameters, or to keep all
               #   the default parameter values, pass an empty Hash as a request object (see above).
@@ -1539,6 +1539,16 @@ module Google
               #     or
               #     {::Google::Cloud::Kms::V1::KeyManagementService::Rest::Client#import_crypto_key_version ImportCryptoKeyVersion}
               #     before you can use this {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
+              #   @param trusted_wrapping_enabled [::Boolean]
+              #     Optional. Whether trusted wrapping will be enabled on the first
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersions} created for this
+              #     {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}. This field is only supported
+              #     for keys with
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersionTemplate#protection_level CryptoKeyVersionTemplate.protection_level}
+              #     {::Google::Cloud::Kms::V1::ProtectionLevel::HSM_SINGLE_TENANT HSM_SINGLE_TENANT}.
+              #     This field is supported for all
+              #     {::Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose CryptoKeyPurposes} except
+              #     {::Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}.
               # @yield [result, operation] Access the result along with the TransportOperation object
               # @yieldparam result [::Google::Cloud::Kms::V1::CryptoKey]
               # @yieldparam operation [::Gapic::Rest::TransportOperation]
@@ -1896,7 +1906,7 @@ module Google
               #   @param options [::Gapic::CallOptions, ::Hash]
               #     Overrides the default settings for this call, e.g, timeout, retries etc. Optional.
               #
-              # @overload import_crypto_key_version(parent: nil, crypto_key_version: nil, algorithm: nil, import_job: nil, wrapped_key: nil, rsa_aes_wrapped_key: nil)
+              # @overload import_crypto_key_version(parent: nil, crypto_key_version: nil, algorithm: nil, import_job: nil, wrapped_key: nil, rsa_aes_wrapped_key: nil, trusted_wrapping_enabled: nil)
               #   Pass arguments to `import_crypto_key_version` via keyword arguments. Note that at
               #   least one keyword argument is required. To specify no parameters, or to keep all
               #   the default parameter values, pass an empty Hash as a request object (see above).
@@ -1985,6 +1995,14 @@ module Google
               #     {::Google::Cloud::Kms::V1::ImportCryptoKeyVersionRequest#wrapped_key wrapped_key}.
               #     Prefer to use that field in new work. Either that field or this field
               #     (but not both) must be specified.
+              #   @param trusted_wrapping_enabled [::Boolean]
+              #     Optional. Whether trusted wrapping will be enabled on the imported
+              #     [CryptoKeyVersion]. This field is only supported for keys with
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersionTemplate#protection_level CryptoKeyVersionTemplate.protection_level}
+              #     {::Google::Cloud::Kms::V1::ProtectionLevel::HSM_SINGLE_TENANT HSM_SINGLE_TENANT}.
+              #     This field is supported for all
+              #     {::Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose CryptoKeyPurposes} besides
+              #     {::Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}.
               # @yield [result, operation] Access the result along with the TransportOperation object
               # @yieldparam result [::Google::Cloud::Kms::V1::CryptoKeyVersion]
               # @yieldparam operation [::Gapic::Rest::TransportOperation]
@@ -2043,6 +2061,228 @@ module Google
                 raise ::Google::Cloud::Error.from_error(e)
               end
 
+              ##
+              # Import wrapped key material into a
+              # {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} with a trusted
+              # key.
+              #
+              # All requests must specify a {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}. If
+              # a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} is additionally
+              # specified in the request, key material will be reimported into that
+              # version. Otherwise, a new version will be created, and will be assigned the
+              # next sequential id within the {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
+              #
+              # The {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} will have
+              # trusted_wrapping_enabled set to true.
+              #
+              # @overload import_trusted_key_wrapped_crypto_key_version(request, options = nil)
+              #   Pass arguments to `import_trusted_key_wrapped_crypto_key_version` via a request object, either of type
+              #   {::Google::Cloud::Kms::V1::ImportTrustedKeyWrappedCryptoKeyVersionRequest} or an equivalent Hash.
+              #
+              #   @param request [::Google::Cloud::Kms::V1::ImportTrustedKeyWrappedCryptoKeyVersionRequest, ::Hash]
+              #     A request object representing the call parameters. Required. To specify no
+              #     parameters, or to keep all the default parameter values, pass an empty Hash.
+              #   @param options [::Gapic::CallOptions, ::Hash]
+              #     Overrides the default settings for this call, e.g, timeout, retries etc. Optional.
+              #
+              # @overload import_trusted_key_wrapped_crypto_key_version(parent: nil, importing_key: nil, crypto_key_version: nil, wrapped_key: nil, algorithm: nil)
+              #   Pass arguments to `import_trusted_key_wrapped_crypto_key_version` via keyword arguments. Note that at
+              #   least one keyword argument is required. To specify no parameters, or to keep all
+              #   the default parameter values, pass an empty Hash as a request object (see above).
+              #
+              #   @param parent [::String]
+              #     Required. The {::Google::Cloud::Kms::V1::CryptoKey#name name} of the
+              #     {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} to be imported into.
+              #   @param importing_key [::String]
+              #     Required. Required - the CKV of the trusted key used to import.
+              #     This can be the name of a CryptoKeyVersion or a CryptoKey.
+              #   @param crypto_key_version [::String]
+              #     Optional. The optional {::Google::Cloud::Kms::V1::CryptoKeyVersion#name name} of
+              #     an existing {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to
+              #     target for an import operation. If this field is not present, a new
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} containing the
+              #     supplied key material is created.
+              #
+              #     If this field is present, the supplied key material is imported into
+              #     the existing {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. To
+              #     import into an existing
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, the
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} must be a child of
+              #     {::Google::Cloud::Kms::V1::ImportTrustedKeyWrappedCryptoKeyVersionRequest#parent ImportTrustedKeyWrappedCryptoKeyVersionRequest.parent},
+              #     have been previously created via
+              #     {::Google::Cloud::Kms::V1::KeyManagementService::Rest::Client#import_trusted_key_wrapped_crypto_key_version ImportTrustedKeyWrappedCryptoKeyVersion},
+              #     and be in
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROYED DESTROYED}
+              #     or
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::IMPORT_FAILED IMPORT_FAILED}
+              #     state. The key material and algorithm must match the previous
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} exactly if the
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} has ever contained
+              #     key material
+              #   @param wrapped_key [::String]
+              #     Required. The target key pre-wrapped on premises.
+              #   @param algorithm [::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm]
+              #     Required. Required - The
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm algorithm}
+              #     of the key being imported. This does not need to match the
+              #     {::Google::Cloud::Kms::V1::CryptoKey#version_template version_template} of the
+              #     {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} this version imports into.
+              # @yield [result, operation] Access the result along with the TransportOperation object
+              # @yieldparam result [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+              # @yieldparam operation [::Gapic::Rest::TransportOperation]
+              #
+              # @return [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+              #
+              # @raise [::Google::Cloud::Error] if the REST call is aborted.
+              #
+              # @example Basic example
+              #   require "google/cloud/kms/v1"
+              #
+              #   # Create a client object. The client can be reused for multiple calls.
+              #   client = Google::Cloud::Kms::V1::KeyManagementService::Rest::Client.new
+              #
+              #   # Create a request. To set request fields, pass in keyword arguments.
+              #   request = Google::Cloud::Kms::V1::ImportTrustedKeyWrappedCryptoKeyVersionRequest.new
+              #
+              #   # Call the import_trusted_key_wrapped_crypto_key_version method.
+              #   result = client.import_trusted_key_wrapped_crypto_key_version request
+              #
+              #   # The returned object is of type Google::Cloud::Kms::V1::CryptoKeyVersion.
+              #   p result
+              #
+              def import_trusted_key_wrapped_crypto_key_version request, options = nil
+                raise ::ArgumentError, "request must be provided" if request.nil?
+
+                request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::ImportTrustedKeyWrappedCryptoKeyVersionRequest
+
+                # Converts hash and nil to an options object
+                options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h
+
+                # Customize the options with defaults
+                call_metadata = @config.rpcs.import_trusted_key_wrapped_crypto_key_version.metadata.to_h
+
+                # Set x-goog-api-client, x-goog-user-project and x-goog-api-version headers
+                call_metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
+                  lib_name: @config.lib_name, lib_version: @config.lib_version,
+                  gapic_version: ::Google::Cloud::Kms::V1::VERSION,
+                  transports_version_send: [:rest]
+
+                call_metadata[:"x-goog-api-version"] = API_VERSION unless API_VERSION.empty?
+                call_metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id
+
+                options.apply_defaults timeout:      @config.rpcs.import_trusted_key_wrapped_crypto_key_version.timeout,
+                                       metadata:     call_metadata,
+                                       retry_policy: @config.rpcs.import_trusted_key_wrapped_crypto_key_version.retry_policy
+
+                options.apply_defaults timeout:      @config.timeout,
+                                       metadata:     @config.metadata,
+                                       retry_policy: @config.retry_policy
+
+                @key_management_service_stub.import_trusted_key_wrapped_crypto_key_version request, options do |result, operation|
+                  yield result, operation if block_given?
+                end
+              rescue ::Gapic::Rest::Error => e
+                raise ::Google::Cloud::Error.from_error(e)
+              end
+
+              ##
+              # Exports a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} with a
+              # trusted key.
+              #
+              # The {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} must have
+              # trusted_wrapping_enabled set to true. The
+              # {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} of the
+              # [wrapping_key] must have the
+              # {::Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::AES_WRAPPING AES_WRAPPING}
+              # purpose. The [wrapping_key] must have the
+              # {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm::AES_256_KWP AES_256_KWP}
+              # algorithm.
+              #
+              # @overload export_trusted_key_wrapped_crypto_key_version(request, options = nil)
+              #   Pass arguments to `export_trusted_key_wrapped_crypto_key_version` via a request object, either of type
+              #   {::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionRequest} or an equivalent Hash.
+              #
+              #   @param request [::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionRequest, ::Hash]
+              #     A request object representing the call parameters. Required. To specify no
+              #     parameters, or to keep all the default parameter values, pass an empty Hash.
+              #   @param options [::Gapic::CallOptions, ::Hash]
+              #     Overrides the default settings for this call, e.g, timeout, retries etc. Optional.
+              #
+              # @overload export_trusted_key_wrapped_crypto_key_version(name: nil, wrapping_key: nil)
+              #   Pass arguments to `export_trusted_key_wrapped_crypto_key_version` via keyword arguments. Note that at
+              #   least one keyword argument is required. To specify no parameters, or to keep all
+              #   the default parameter values, pass an empty Hash as a request object (see above).
+              #
+              #   @param name [::String]
+              #     Required. The {::Google::Cloud::Kms::V1::CryptoKeyVersion#name name} of the
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to export. The
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} must have
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion#trusted_wrapping_enabled trusted_wrapping_enabled}
+              #     set to true.
+              #   @param wrapping_key [::String]
+              #     Required. The {::Google::Cloud::Kms::V1::CryptoKeyVersion#name name} of the
+              #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to use as a
+              #     wrapping key. The {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}
+              #     must have {::Google::Cloud::Kms::V1::CryptoKeyVersion#hsm_trusted hsm_trusted}
+              #     set to true.
+              # @yield [result, operation] Access the result along with the TransportOperation object
+              # @yieldparam result [::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionResponse]
+              # @yieldparam operation [::Gapic::Rest::TransportOperation]
+              #
+              # @return [::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionResponse]
+              #
+              # @raise [::Google::Cloud::Error] if the REST call is aborted.
+              #
+              # @example Basic example
+              #   require "google/cloud/kms/v1"
+              #
+              #   # Create a client object. The client can be reused for multiple calls.
+              #   client = Google::Cloud::Kms::V1::KeyManagementService::Rest::Client.new
+              #
+              #   # Create a request. To set request fields, pass in keyword arguments.
+              #   request = Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionRequest.new
+              #
+              #   # Call the export_trusted_key_wrapped_crypto_key_version method.
+              #   result = client.export_trusted_key_wrapped_crypto_key_version request
+              #
+              #   # The returned object is of type Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionResponse.
+              #   p result
+              #
+              def export_trusted_key_wrapped_crypto_key_version request, options = nil
+                raise ::ArgumentError, "request must be provided" if request.nil?
+
+                request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionRequest
+
+                # Converts hash and nil to an options object
+                options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h
+
+                # Customize the options with defaults
+                call_metadata = @config.rpcs.export_trusted_key_wrapped_crypto_key_version.metadata.to_h
+
+                # Set x-goog-api-client, x-goog-user-project and x-goog-api-version headers
+                call_metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
+                  lib_name: @config.lib_name, lib_version: @config.lib_version,
+                  gapic_version: ::Google::Cloud::Kms::V1::VERSION,
+                  transports_version_send: [:rest]
+
+                call_metadata[:"x-goog-api-version"] = API_VERSION unless API_VERSION.empty?
+                call_metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id
+
+                options.apply_defaults timeout:      @config.rpcs.export_trusted_key_wrapped_crypto_key_version.timeout,
+                                       metadata:     call_metadata,
+                                       retry_policy: @config.rpcs.export_trusted_key_wrapped_crypto_key_version.retry_policy
+
+                options.apply_defaults timeout:      @config.timeout,
+                                       metadata:     @config.metadata,
+                                       retry_policy: @config.retry_policy
+
+                @key_management_service_stub.export_trusted_key_wrapped_crypto_key_version request, options do |result, operation|
+                  yield result, operation if block_given?
+                end
+              rescue ::Gapic::Rest::Error => e
+                raise ::Google::Cloud::Error.from_error(e)
+              end
+
               ##
               # Create a new {::Google::Cloud::Kms::V1::ImportJob ImportJob} within a
               # {::Google::Cloud::Kms::V1::KeyRing KeyRing}.
@@ -4083,6 +4323,16 @@ module Google
                   #
                   attr_reader :import_crypto_key_version
                   ##
+                  # RPC-specific configuration for `import_trusted_key_wrapped_crypto_key_version`
+                  # @return [::Gapic::Config::Method]
+                  #
+                  attr_reader :import_trusted_key_wrapped_crypto_key_version
+                  ##
+                  # RPC-specific configuration for `export_trusted_key_wrapped_crypto_key_version`
+                  # @return [::Gapic::Config::Method]
+                  #
+                  attr_reader :export_trusted_key_wrapped_crypto_key_version
+                  ##
                   # RPC-specific configuration for `create_import_job`
                   # @return [::Gapic::Config::Method]
                   #
@@ -4199,6 +4449,10 @@ module Google
                     @delete_crypto_key_version = ::Gapic::Config::Method.new delete_crypto_key_version_config
                     import_crypto_key_version_config = parent_rpcs.import_crypto_key_version if parent_rpcs.respond_to? :import_crypto_key_version
                     @import_crypto_key_version = ::Gapic::Config::Method.new import_crypto_key_version_config
+                    import_trusted_key_wrapped_crypto_key_version_config = parent_rpcs.import_trusted_key_wrapped_crypto_key_version if parent_rpcs.respond_to? :import_trusted_key_wrapped_crypto_key_version
+                    @import_trusted_key_wrapped_crypto_key_version = ::Gapic::Config::Method.new import_trusted_key_wrapped_crypto_key_version_config
+                    export_trusted_key_wrapped_crypto_key_version_config = parent_rpcs.export_trusted_key_wrapped_crypto_key_version if parent_rpcs.respond_to? :export_trusted_key_wrapped_crypto_key_version
+                    @export_trusted_key_wrapped_crypto_key_version = ::Gapic::Config::Method.new export_trusted_key_wrapped_crypto_key_version_config
                     create_import_job_config = parent_rpcs.create_import_job if parent_rpcs.respond_to? :create_import_job
                     @create_import_job = ::Gapic::Config::Method.new create_import_job_config
                     update_crypto_key_config = parent_rpcs.update_crypto_key if parent_rpcs.respond_to? :update_crypto_key

data/lib/google/cloud/kms/v1/key_management_service/rest/service_stub.rb

@@ -753,6 +753,86 @@ module Google
                 end
               end
 
+              ##
+              # Baseline implementation for the import_trusted_key_wrapped_crypto_key_version REST call
+              #
+              # @param request_pb [::Google::Cloud::Kms::V1::ImportTrustedKeyWrappedCryptoKeyVersionRequest]
+              #   A request object representing the call parameters. Required.
+              # @param options [::Gapic::CallOptions]
+              #   Overrides the default settings for this call, e.g, timeout, retries etc. Optional.
+              #
+              # @yield [result, operation] Access the result along with the TransportOperation object
+              # @yieldparam result [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+              # @yieldparam operation [::Gapic::Rest::TransportOperation]
+              #
+              # @return [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+              #   A result object deserialized from the server's reply
+              def import_trusted_key_wrapped_crypto_key_version request_pb, options = nil
+                raise ::ArgumentError, "request must be provided" if request_pb.nil?
+
+                verb, uri, query_string_params, body = ServiceStub.transcode_import_trusted_key_wrapped_crypto_key_version_request request_pb
+                query_string_params = if query_string_params.any?
+                                        query_string_params.to_h { |p| p.split "=", 2 }
+                                      else
+                                        {}
+                                      end
+
+                response = @client_stub.make_http_request(
+                  verb,
+                  uri: uri,
+                  body: body || "",
+                  params: query_string_params,
+                  method_name: "import_trusted_key_wrapped_crypto_key_version",
+                  options: options
+                )
+                operation = ::Gapic::Rest::TransportOperation.new response
+                result = ::Google::Cloud::Kms::V1::CryptoKeyVersion.decode_json response.body, ignore_unknown_fields: true
+                catch :response do
+                  yield result, operation if block_given?
+                  result
+                end
+              end
+
+              ##
+              # Baseline implementation for the export_trusted_key_wrapped_crypto_key_version REST call
+              #
+              # @param request_pb [::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionRequest]
+              #   A request object representing the call parameters. Required.
+              # @param options [::Gapic::CallOptions]
+              #   Overrides the default settings for this call, e.g, timeout, retries etc. Optional.
+              #
+              # @yield [result, operation] Access the result along with the TransportOperation object
+              # @yieldparam result [::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionResponse]
+              # @yieldparam operation [::Gapic::Rest::TransportOperation]
+              #
+              # @return [::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionResponse]
+              #   A result object deserialized from the server's reply
+              def export_trusted_key_wrapped_crypto_key_version request_pb, options = nil
+                raise ::ArgumentError, "request must be provided" if request_pb.nil?
+
+                verb, uri, query_string_params, body = ServiceStub.transcode_export_trusted_key_wrapped_crypto_key_version_request request_pb
+                query_string_params = if query_string_params.any?
+                                        query_string_params.to_h { |p| p.split "=", 2 }
+                                      else
+                                        {}
+                                      end
+
+                response = @client_stub.make_http_request(
+                  verb,
+                  uri: uri,
+                  body: body || "",
+                  params: query_string_params,
+                  method_name: "export_trusted_key_wrapped_crypto_key_version",
+                  options: options
+                )
+                operation = ::Gapic::Rest::TransportOperation.new response
+                result = ::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionResponse.decode_json response.body, ignore_unknown_fields: true
+                catch :response do
+                  yield result, operation if block_given?
+                  result
+                end
+              end
+
               ##
               # Baseline implementation for the create_import_job REST call
               #
@@ -1754,6 +1834,49 @@ module Google
                 transcoder.transcode request_pb
               end
 
+              ##
+              # @private
+              #
+              # GRPC transcoding helper method for the import_trusted_key_wrapped_crypto_key_version REST call
+              #
+              # @param request_pb [::Google::Cloud::Kms::V1::ImportTrustedKeyWrappedCryptoKeyVersionRequest]
+              #   A request object representing the call parameters. Required.
+              # @return [Array(String, [String, nil], Hash{String => String})]
+              #   Uri, Body, Query string parameters
+              def self.transcode_import_trusted_key_wrapped_crypto_key_version_request request_pb
+                transcoder = Gapic::Rest::GrpcTranscoder.new
+                                                        .with_bindings(
+                                                          uri_method: :post,
+                                                          uri_template: "/v1/{parent}/cryptoKeyVersions:importTrustedKeyWrappedCryptoKeyVersion",
+                                                          body: "*",
+                                                          matches: [
+                                                            ["parent", %r{^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+/?$}, false]
+                                                          ]
+                                                        )
+                transcoder.transcode request_pb
+              end
+
+              ##
+              # @private
+              #
+              # GRPC transcoding helper method for the export_trusted_key_wrapped_crypto_key_version REST call
+              #
+              # @param request_pb [::Google::Cloud::Kms::V1::ExportTrustedKeyWrappedCryptoKeyVersionRequest]
+              #   A request object representing the call parameters. Required.
+              # @return [Array(String, [String, nil], Hash{String => String})]
+              #   Uri, Body, Query string parameters
+              def self.transcode_export_trusted_key_wrapped_crypto_key_version_request request_pb
+                transcoder = Gapic::Rest::GrpcTranscoder.new
+                                                        .with_bindings(
+                                                          uri_method: :get,
+                                                          uri_template: "/v1/{name}:exportTrustedKeyWrappedCryptoKeyVersion",
+                                                          matches: [
+                                                            ["name", %r{^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+/cryptoKeyVersions/[^/]+/?$}, false]
+                                                          ]
+                                                        )
+                transcoder.transcode request_pb
+              end
+
               ##
               # @private
               #

data/lib/google/cloud/kms/v1/resources_pb.rb

@@ -11,7 +11,7 @@ require 'google/protobuf/timestamp_pb'
 require 'google/protobuf/wrappers_pb'
 
 
-descriptor_data = "\n#google/cloud/kms/v1/resources.proto\x12\x13google.cloud.kms.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/api/resource.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1egoogle/protobuf/wrappers.proto\"\xb5\x01\n\x07KeyRing\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x03\x12\x34\n\x0b\x63reate_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03:a\xea\x41^\n\x1f\x63loudkms.googleapis.com/KeyRing\x12;projects/{project}/locations/{location}/keyRings/{key_ring}\"\xa8\x08\n\tCryptoKey\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x03\x12;\n\x07primary\x18\x02 \x01(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersionB\x03\xe0\x41\x03\x12\x45\n\x07purpose\x18\x03 \x01(\x0e\x32/.google.cloud.kms.v1.CryptoKey.CryptoKeyPurposeB\x03\xe0\x41\x05\x12\x34\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x36\n\x12next_rotation_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x0frotation_period\x18\x08 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12G\n\x10version_template\x18\x0b \x01(\x0b\x32-.google.cloud.kms.v1.CryptoKeyVersionTemplate\x12:\n\x06labels\x18\n \x03(\x0b\x32*.google.cloud.kms.v1.CryptoKey.LabelsEntry\x12\x18\n\x0bimport_only\x18\r \x01(\x08\x42\x03\xe0\x41\x05\x12\x42\n\x1a\x64\x65stroy_scheduled_duration\x18\x0e \x01(\x0b\x32\x19.google.protobuf.DurationB\x03\xe0\x41\x05\x12%\n\x12\x63rypto_key_backend\x18\x0f \x01(\tB\t\xe0\x41\x05\xfa\x41\x03\n\x01*\x12\x61\n key_access_justifications_policy\x18\x11 \x01(\x0b\x32\x32.google.cloud.kms.v1.KeyAccessJustificationsPolicyB\x03\xe0\x41\x01\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xb1\x01\n\x10\x43ryptoKeyPurpose\x12\"\n\x1e\x43RYPTO_KEY_PURPOSE_UNSPECIFIED\x10\x00\x12\x13\n\x0f\x45NCRYPT_DECRYPT\x10\x01\x12\x13\n\x0f\x41SYMMETRIC_SIGN\x10\x05\x12\x16\n\x12\x41SYMMETRIC_DECRYPT\x10\x06\x12\x17\n\x13RAW_ENCRYPT_DECRYPT\x10\x07\x12\x07\n\x03MAC\x10\t\x12\x15\n\x11KEY_ENCAPSULATION\x10\n:{\xea\x41x\n!cloudkms.googleapis.com/CryptoKey\x12Sprojects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}B\x13\n\x11rotation_schedule\"\xb3\x01\n\x18\x43ryptoKeyVersionTemplate\x12>\n\x10protection_level\x18\x01 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevel\x12W\n\talgorithm\x18\x03 \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithmB\x03\xe0\x41\x02\"\xb1\x03\n\x17KeyOperationAttestation\x12S\n\x06\x66ormat\x18\x04 \x01(\x0e\x32>.google.cloud.kms.v1.KeyOperationAttestation.AttestationFormatB\x03\xe0\x41\x03\x12\x14\n\x07\x63ontent\x18\x05 \x01(\x0c\x42\x03\xe0\x41\x03\x12X\n\x0b\x63\x65rt_chains\x18\x06 \x01(\x0b\x32>.google.cloud.kms.v1.KeyOperationAttestation.CertificateChainsB\x03\xe0\x41\x03\x1a\x64\n\x11\x43\x65rtificateChains\x12\x14\n\x0c\x63\x61vium_certs\x18\x01 \x03(\t\x12\x19\n\x11google_card_certs\x18\x02 \x03(\t\x12\x1e\n\x16google_partition_certs\x18\x03 \x03(\t\"k\n\x11\x41ttestationFormat\x12\"\n\x1e\x41TTESTATION_FORMAT_UNSPECIFIED\x10\x00\x12\x18\n\x14\x43\x41VIUM_V1_COMPRESSED\x10\x03\x12\x18\n\x14\x43\x41VIUM_V2_COMPRESSED\x10\x04\"\xa9\x15\n\x10\x43ryptoKeyVersion\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x03\x12J\n\x05state\x18\x03 \x01(\x0e\x32;.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState\x12\x43\n\x10protection_level\x18\x07 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevelB\x03\xe0\x41\x03\x12W\n\talgorithm\x18\n \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithmB\x03\xe0\x41\x03\x12\x46\n\x0b\x61ttestation\x18\x08 \x01(\x0b\x32,.google.cloud.kms.v1.KeyOperationAttestationB\x03\xe0\x41\x03\x12\x34\n\x0b\x63reate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x36\n\rgenerate_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x35\n\x0c\x64\x65stroy_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12;\n\x12\x64\x65stroy_event_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x17\n\nimport_job\x18\x0e \x01(\tB\x03\xe0\x41\x03\x12\x34\n\x0bimport_time\x18\x0f \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\"\n\x15import_failure_reason\x18\x10 \x01(\tB\x03\xe0\x41\x03\x12&\n\x19generation_failure_reason\x18\x13 \x01(\tB\x03\xe0\x41\x03\x12\x30\n#external_destruction_failure_reason\x18\x14 \x01(\tB\x03\xe0\x41\x03\x12^\n!external_protection_level_options\x18\x11 \x01(\x0b\x32\x33.google.cloud.kms.v1.ExternalProtectionLevelOptions\x12\x1e\n\x11reimport_eligible\x18\x12 \x01(\x08\x42\x03\xe0\x41\x03\"\x8a\n\n\x19\x43ryptoKeyVersionAlgorithm\x12,\n(CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED\x10\x00\x12\x1f\n\x1bGOOGLE_SYMMETRIC_ENCRYPTION\x10\x01\x12\x0f\n\x0b\x41\x45S_128_GCM\x10)\x12\x0f\n\x0b\x41\x45S_256_GCM\x10\x13\x12\x0f\n\x0b\x41\x45S_128_CBC\x10*\x12\x0f\n\x0b\x41\x45S_256_CBC\x10+\x12\x0f\n\x0b\x41\x45S_128_CTR\x10,\x12\x0f\n\x0b\x41\x45S_256_CTR\x10-\x12\x1c\n\x18RSA_SIGN_PSS_2048_SHA256\x10\x02\x12\x1c\n\x18RSA_SIGN_PSS_3072_SHA256\x10\x03\x12\x1c\n\x18RSA_SIGN_PSS_4096_SHA256\x10\x04\x12\x1c\n\x18RSA_SIGN_PSS_4096_SHA512\x10\x0f\x12\x1e\n\x1aRSA_SIGN_PKCS1_2048_SHA256\x10\x05\x12\x1e\n\x1aRSA_SIGN_PKCS1_3072_SHA256\x10\x06\x12\x1e\n\x1aRSA_SIGN_PKCS1_4096_SHA256\x10\x07\x12\x1e\n\x1aRSA_SIGN_PKCS1_4096_SHA512\x10\x10\x12\x1b\n\x17RSA_SIGN_RAW_PKCS1_2048\x10\x1c\x12\x1b\n\x17RSA_SIGN_RAW_PKCS1_3072\x10\x1d\x12\x1b\n\x17RSA_SIGN_RAW_PKCS1_4096\x10\x1e\x12 \n\x1cRSA_DECRYPT_OAEP_2048_SHA256\x10\x08\x12 \n\x1cRSA_DECRYPT_OAEP_3072_SHA256\x10\t\x12 \n\x1cRSA_DECRYPT_OAEP_4096_SHA256\x10\n\x12 \n\x1cRSA_DECRYPT_OAEP_4096_SHA512\x10\x11\x12\x1e\n\x1aRSA_DECRYPT_OAEP_2048_SHA1\x10%\x12\x1e\n\x1aRSA_DECRYPT_OAEP_3072_SHA1\x10&\x12\x1e\n\x1aRSA_DECRYPT_OAEP_4096_SHA1\x10\'\x12\x17\n\x13\x45\x43_SIGN_P256_SHA256\x10\x0c\x12\x17\n\x13\x45\x43_SIGN_P384_SHA384\x10\r\x12\x1c\n\x18\x45\x43_SIGN_SECP256K1_SHA256\x10\x1f\x12\x13\n\x0f\x45\x43_SIGN_ED25519\x10(\x12\x0f\n\x0bHMAC_SHA256\x10 \x12\r\n\tHMAC_SHA1\x10!\x12\x0f\n\x0bHMAC_SHA384\x10\"\x12\x0f\n\x0bHMAC_SHA512\x10#\x12\x0f\n\x0bHMAC_SHA224\x10$\x12!\n\x1d\x45XTERNAL_SYMMETRIC_ENCRYPTION\x10\x12\x12\x0e\n\nML_KEM_768\x10/\x12\x0f\n\x0bML_KEM_1024\x10\x30\x12\r\n\tKEM_XWING\x10?\x12\x15\n\x11PQ_SIGN_ML_DSA_44\x10\x44\x12\x15\n\x11PQ_SIGN_ML_DSA_65\x10\x38\x12\x15\n\x11PQ_SIGN_ML_DSA_87\x10\x45\x12\x1d\n\x19PQ_SIGN_SLH_DSA_SHA2_128S\x10\x39\x12)\n%PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256\x10<\x12!\n\x1dPQ_SIGN_ML_DSA_44_EXTERNAL_MU\x10\x46\x12!\n\x1dPQ_SIGN_ML_DSA_65_EXTERNAL_MU\x10\x43\x12!\n\x1dPQ_SIGN_ML_DSA_87_EXTERNAL_MU\x10G\"\x9b\x02\n\x15\x43ryptoKeyVersionState\x12(\n$CRYPTO_KEY_VERSION_STATE_UNSPECIFIED\x10\x00\x12\x16\n\x12PENDING_GENERATION\x10\x05\x12\x0b\n\x07\x45NABLED\x10\x01\x12\x0c\n\x08\x44ISABLED\x10\x02\x12\r\n\tDESTROYED\x10\x03\x12\x15\n\x11\x44\x45STROY_SCHEDULED\x10\x04\x12\x12\n\x0ePENDING_IMPORT\x10\x06\x12\x11\n\rIMPORT_FAILED\x10\x07\x12\x15\n\x11GENERATION_FAILED\x10\x08\x12 \n\x1cPENDING_EXTERNAL_DESTRUCTION\x10\t\x12\x1f\n\x1b\x45XTERNAL_DESTRUCTION_FAILED\x10\n\"I\n\x14\x43ryptoKeyVersionView\x12\'\n#CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED\x10\x00\x12\x08\n\x04\x46ULL\x10\x01:\xaa\x01\xea\x41\xa6\x01\n(cloudkms.googleapis.com/CryptoKeyVersion\x12zprojects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}\"U\n\x0f\x43hecksummedData\x12\x0c\n\x04\x64\x61ta\x18\x03 \x01(\x0c\x12\x34\n\x0f\x63rc32c_checksum\x18\x02 \x01(\x0b\x32\x1b.google.protobuf.Int64Value\"\x8c\x05\n\tPublicKey\x12\x0b\n\x03pem\x18\x01 \x01(\t\x12R\n\talgorithm\x18\x02 \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm\x12/\n\npem_crc32c\x18\x03 \x01(\x0b\x32\x1b.google.protobuf.Int64Value\x12\x0c\n\x04name\x18\x04 \x01(\t\x12>\n\x10protection_level\x18\x05 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevel\x12I\n\x11public_key_format\x18\x07 \x01(\x0e\x32..google.cloud.kms.v1.PublicKey.PublicKeyFormat\x12\x38\n\npublic_key\x18\x08 \x01(\x0b\x32$.google.cloud.kms.v1.ChecksummedData\"i\n\x0fPublicKeyFormat\x12!\n\x1dPUBLIC_KEY_FORMAT_UNSPECIFIED\x10\x00\x12\x07\n\x03PEM\x10\x01\x12\x07\n\x03\x44\x45R\x10\x02\x12\x0c\n\x08NIST_PQC\x10\x03\x12\x13\n\x0fXWING_RAW_BYTES\x10\x04:\xae\x01\xea\x41\xaa\x01\n!cloudkms.googleapis.com/PublicKey\x12\x84\x01projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}/publicKey\"\xed\n\n\tImportJob\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x03\x12J\n\rimport_method\x18\x02 \x01(\x0e\x32+.google.cloud.kms.v1.ImportJob.ImportMethodB\x06\xe0\x41\x02\xe0\x41\x05\x12\x46\n\x10protection_level\x18\t \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevelB\x06\xe0\x41\x02\xe0\x41\x05\x12\x34\n\x0b\x63reate_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x36\n\rgenerate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x34\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12:\n\x11\x65xpire_event_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x41\n\x05state\x18\x06 \x01(\x0e\x32-.google.cloud.kms.v1.ImportJob.ImportJobStateB\x03\xe0\x41\x03\x12I\n\npublic_key\x18\x07 \x01(\x0b\x32\x30.google.cloud.kms.v1.ImportJob.WrappingPublicKeyB\x03\xe0\x41\x03\x12N\n\x11public_key_format\x18\x0c \x01(\x0e\x32..google.cloud.kms.v1.PublicKey.PublicKeyFormatB\x03\xe0\x41\x03\x12\x46\n\x0b\x61ttestation\x18\x08 \x01(\x0b\x32,.google.cloud.kms.v1.KeyOperationAttestationB\x03\xe0\x41\x03\x12%\n\x12\x63rypto_key_backend\x18\x0b \x01(\tB\t\xe0\x41\x05\xfa\x41\x03\n\x01*\x1a\x33\n\x11WrappingPublicKey\x12\x0b\n\x03pem\x18\x01 \x01(\t\x12\x11\n\x04\x64\x61ta\x18\x02 \x01(\x0c\x42\x03\xe0\x41\x03\"\xf4\x02\n\x0cImportMethod\x12\x1d\n\x19IMPORT_METHOD_UNSPECIFIED\x10\x00\x12\x1e\n\x1aRSA_OAEP_3072_SHA1_AES_256\x10\x01\x12\x1e\n\x1aRSA_OAEP_4096_SHA1_AES_256\x10\x02\x12 \n\x1cRSA_OAEP_3072_SHA256_AES_256\x10\x03\x12 \n\x1cRSA_OAEP_4096_SHA256_AES_256\x10\x04\x12\x18\n\x14RSA_OAEP_3072_SHA256\x10\x05\x12\x18\n\x14RSA_OAEP_4096_SHA256\x10\x06\x12/\n+HPKE_KEM_ML_KEM_768_HKDF_SHA256_AES_256_GCM\x10\x08\x12\x30\n,HPKE_KEM_ML_KEM_1024_HKDF_SHA256_AES_256_GCM\x10\t\x12*\n&HPKE_KEM_XWING_HKDF_SHA256_AES_256_GCM\x10\n\"c\n\x0eImportJobState\x12 \n\x1cIMPORT_JOB_STATE_UNSPECIFIED\x10\x00\x12\x16\n\x12PENDING_GENERATION\x10\x01\x12\n\n\x06\x41\x43TIVE\x10\x02\x12\x0b\n\x07\x45XPIRED\x10\x03:{\xea\x41x\n!cloudkms.googleapis.com/ImportJob\x12Sprojects/{project}/locations/{location}/keyRings/{key_ring}/importJobs/{import_job}\"[\n\x1e\x45xternalProtectionLevelOptions\x12\x18\n\x10\x65xternal_key_uri\x18\x01 \x01(\t\x12\x1f\n\x17\x65km_connection_key_path\x18\x02 \x01(\t\"b\n\x1dKeyAccessJustificationsPolicy\x12\x41\n\x16\x61llowed_access_reasons\x18\x01 \x03(\x0e\x32!.google.cloud.kms.v1.AccessReason\"\xb9\x02\n\x0fRetiredResource\x12\x14\n\x04name\x18\x01 \x01(\tB\x06\xe0\x41\x03\xe0\x41\x08\x12\x1e\n\x11original_resource\x18\x02 \x01(\tB\x03\xe0\x41\x03\x12\x1a\n\rresource_type\x18\x03 \x01(\tB\x03\xe0\x41\x03\x12\x34\n\x0b\x64\x65lete_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03:\x9d\x01\xea\x41\x99\x01\n\'cloudkms.googleapis.com/RetiredResource\x12Kprojects/{project}/locations/{location}/retiredResources/{retired_resource}*\x10retiredResources2\x0fretiredResource*\x81\x01\n\x0fProtectionLevel\x12 \n\x1cPROTECTION_LEVEL_UNSPECIFIED\x10\x00\x12\x0c\n\x08SOFTWARE\x10\x01\x12\x07\n\x03HSM\x10\x02\x12\x0c\n\x08\x45XTERNAL\x10\x03\x12\x10\n\x0c\x45XTERNAL_VPC\x10\x04\x12\x15\n\x11HSM_SINGLE_TENANT\x10\x05*\xb3\x03\n\x0c\x41\x63\x63\x65ssReason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x1e\n\x1a\x43USTOMER_INITIATED_SUPPORT\x10\x01\x12\x1c\n\x18GOOGLE_INITIATED_SERVICE\x10\x02\x12\x1c\n\x18THIRD_PARTY_DATA_REQUEST\x10\x03\x12\x1b\n\x17GOOGLE_INITIATED_REVIEW\x10\x04\x12\x1d\n\x19\x43USTOMER_INITIATED_ACCESS\x10\x05\x12%\n!GOOGLE_INITIATED_SYSTEM_OPERATION\x10\x06\x12\x17\n\x13REASON_NOT_EXPECTED\x10\x07\x12*\n\"MODIFIED_CUSTOMER_INITIATED_ACCESS\x10\x08\x1a\x02\x08\x01\x12\x32\n*MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION\x10\t\x1a\x02\x08\x01\x12\'\n#GOOGLE_RESPONSE_TO_PRODUCTION_ALERT\x10\n\x12*\n&CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING\x10\x0b\x42\x85\x01\n\x17\x63om.google.cloud.kms.v1B\x11KmsResourcesProtoP\x01Z)cloud.google.com/go/kms/apiv1/kmspb;kmspb\xaa\x02\x13Google.Cloud.Kms.V1\xca\x02\x13Google\\Cloud\\Kms\\V1b\x06proto3"
+descriptor_data = "\n#google/cloud/kms/v1/resources.proto\x12\x13google.cloud.kms.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/api/resource.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1egoogle/protobuf/wrappers.proto\"\xb5\x01\n\x07KeyRing\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x03\x12\x34\n\x0b\x63reate_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03:a\xea\x41^\n\x1f\x63loudkms.googleapis.com/KeyRing\x12;projects/{project}/locations/{location}/keyRings/{key_ring}\"\xba\x08\n\tCryptoKey\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x03\x12;\n\x07primary\x18\x02 \x01(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersionB\x03\xe0\x41\x03\x12\x45\n\x07purpose\x18\x03 \x01(\x0e\x32/.google.cloud.kms.v1.CryptoKey.CryptoKeyPurposeB\x03\xe0\x41\x05\x12\x34\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x36\n\x12next_rotation_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x0frotation_period\x18\x08 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12G\n\x10version_template\x18\x0b \x01(\x0b\x32-.google.cloud.kms.v1.CryptoKeyVersionTemplate\x12:\n\x06labels\x18\n \x03(\x0b\x32*.google.cloud.kms.v1.CryptoKey.LabelsEntry\x12\x18\n\x0bimport_only\x18\r \x01(\x08\x42\x03\xe0\x41\x05\x12\x42\n\x1a\x64\x65stroy_scheduled_duration\x18\x0e \x01(\x0b\x32\x19.google.protobuf.DurationB\x03\xe0\x41\x05\x12%\n\x12\x63rypto_key_backend\x18\x0f \x01(\tB\t\xe0\x41\x05\xfa\x41\x03\n\x01*\x12\x61\n key_access_justifications_policy\x18\x11 \x01(\x0b\x32\x32.google.cloud.kms.v1.KeyAccessJustificationsPolicyB\x03\xe0\x41\x01\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc3\x01\n\x10\x43ryptoKeyPurpose\x12\"\n\x1e\x43RYPTO_KEY_PURPOSE_UNSPECIFIED\x10\x00\x12\x13\n\x0f\x45NCRYPT_DECRYPT\x10\x01\x12\x13\n\x0f\x41SYMMETRIC_SIGN\x10\x05\x12\x16\n\x12\x41SYMMETRIC_DECRYPT\x10\x06\x12\x17\n\x13RAW_ENCRYPT_DECRYPT\x10\x07\x12\x07\n\x03MAC\x10\t\x12\x15\n\x11KEY_ENCAPSULATION\x10\n\x12\x10\n\x0c\x41\x45S_WRAPPING\x10\x0b:{\xea\x41x\n!cloudkms.googleapis.com/CryptoKey\x12Sprojects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}B\x13\n\x11rotation_schedule\"\xb3\x01\n\x18\x43ryptoKeyVersionTemplate\x12>\n\x10protection_level\x18\x01 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevel\x12W\n\talgorithm\x18\x03 \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithmB\x03\xe0\x41\x02\"\xb1\x03\n\x17KeyOperationAttestation\x12S\n\x06\x66ormat\x18\x04 \x01(\x0e\x32>.google.cloud.kms.v1.KeyOperationAttestation.AttestationFormatB\x03\xe0\x41\x03\x12\x14\n\x07\x63ontent\x18\x05 \x01(\x0c\x42\x03\xe0\x41\x03\x12X\n\x0b\x63\x65rt_chains\x18\x06 \x01(\x0b\x32>.google.cloud.kms.v1.KeyOperationAttestation.CertificateChainsB\x03\xe0\x41\x03\x1a\x64\n\x11\x43\x65rtificateChains\x12\x14\n\x0c\x63\x61vium_certs\x18\x01 \x03(\t\x12\x19\n\x11google_card_certs\x18\x02 \x03(\t\x12\x1e\n\x16google_partition_certs\x18\x03 \x03(\t\"k\n\x11\x41ttestationFormat\x12\"\n\x1e\x41TTESTATION_FORMAT_UNSPECIFIED\x10\x00\x12\x18\n\x14\x43\x41VIUM_V1_COMPRESSED\x10\x03\x12\x18\n\x14\x43\x41VIUM_V2_COMPRESSED\x10\x04\"\xfb\x15\n\x10\x43ryptoKeyVersion\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x03\x12J\n\x05state\x18\x03 \x01(\x0e\x32;.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState\x12\x43\n\x10protection_level\x18\x07 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevelB\x03\xe0\x41\x03\x12W\n\talgorithm\x18\n \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithmB\x03\xe0\x41\x03\x12\x46\n\x0b\x61ttestation\x18\x08 \x01(\x0b\x32,.google.cloud.kms.v1.KeyOperationAttestationB\x03\xe0\x41\x03\x12\x34\n\x0b\x63reate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x36\n\rgenerate_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x35\n\x0c\x64\x65stroy_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12;\n\x12\x64\x65stroy_event_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x17\n\nimport_job\x18\x0e \x01(\tB\x03\xe0\x41\x03\x12\x34\n\x0bimport_time\x18\x0f \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\"\n\x15import_failure_reason\x18\x10 \x01(\tB\x03\xe0\x41\x03\x12&\n\x19generation_failure_reason\x18\x13 \x01(\tB\x03\xe0\x41\x03\x12\x30\n#external_destruction_failure_reason\x18\x14 \x01(\tB\x03\xe0\x41\x03\x12^\n!external_protection_level_options\x18\x11 \x01(\x0b\x32\x33.google.cloud.kms.v1.ExternalProtectionLevelOptions\x12\x1e\n\x11reimport_eligible\x18\x12 \x01(\x08\x42\x03\xe0\x41\x03\x12%\n\x18trusted_wrapping_enabled\x18\x15 \x01(\x08\x42\x03\xe0\x41\x05\x12\x18\n\x0bhsm_trusted\x18\x17 \x01(\x08\x42\x03\xe0\x41\x03\"\x9b\n\n\x19\x43ryptoKeyVersionAlgorithm\x12,\n(CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED\x10\x00\x12\x1f\n\x1bGOOGLE_SYMMETRIC_ENCRYPTION\x10\x01\x12\x0f\n\x0b\x41\x45S_128_GCM\x10)\x12\x0f\n\x0b\x41\x45S_256_GCM\x10\x13\x12\x0f\n\x0b\x41\x45S_128_CBC\x10*\x12\x0f\n\x0b\x41\x45S_256_CBC\x10+\x12\x0f\n\x0b\x41\x45S_128_CTR\x10,\x12\x0f\n\x0b\x41\x45S_256_CTR\x10-\x12\x1c\n\x18RSA_SIGN_PSS_2048_SHA256\x10\x02\x12\x1c\n\x18RSA_SIGN_PSS_3072_SHA256\x10\x03\x12\x1c\n\x18RSA_SIGN_PSS_4096_SHA256\x10\x04\x12\x1c\n\x18RSA_SIGN_PSS_4096_SHA512\x10\x0f\x12\x1e\n\x1aRSA_SIGN_PKCS1_2048_SHA256\x10\x05\x12\x1e\n\x1aRSA_SIGN_PKCS1_3072_SHA256\x10\x06\x12\x1e\n\x1aRSA_SIGN_PKCS1_4096_SHA256\x10\x07\x12\x1e\n\x1aRSA_SIGN_PKCS1_4096_SHA512\x10\x10\x12\x1b\n\x17RSA_SIGN_RAW_PKCS1_2048\x10\x1c\x12\x1b\n\x17RSA_SIGN_RAW_PKCS1_3072\x10\x1d\x12\x1b\n\x17RSA_SIGN_RAW_PKCS1_4096\x10\x1e\x12 \n\x1cRSA_DECRYPT_OAEP_2048_SHA256\x10\x08\x12 \n\x1cRSA_DECRYPT_OAEP_3072_SHA256\x10\t\x12 \n\x1cRSA_DECRYPT_OAEP_4096_SHA256\x10\n\x12 \n\x1cRSA_DECRYPT_OAEP_4096_SHA512\x10\x11\x12\x1e\n\x1aRSA_DECRYPT_OAEP_2048_SHA1\x10%\x12\x1e\n\x1aRSA_DECRYPT_OAEP_3072_SHA1\x10&\x12\x1e\n\x1aRSA_DECRYPT_OAEP_4096_SHA1\x10\'\x12\x17\n\x13\x45\x43_SIGN_P256_SHA256\x10\x0c\x12\x17\n\x13\x45\x43_SIGN_P384_SHA384\x10\r\x12\x1c\n\x18\x45\x43_SIGN_SECP256K1_SHA256\x10\x1f\x12\x13\n\x0f\x45\x43_SIGN_ED25519\x10(\x12\x0f\n\x0bHMAC_SHA256\x10 \x12\r\n\tHMAC_SHA1\x10!\x12\x0f\n\x0bHMAC_SHA384\x10\"\x12\x0f\n\x0bHMAC_SHA512\x10#\x12\x0f\n\x0bHMAC_SHA224\x10$\x12!\n\x1d\x45XTERNAL_SYMMETRIC_ENCRYPTION\x10\x12\x12\x0e\n\nML_KEM_768\x10/\x12\x0f\n\x0bML_KEM_1024\x10\x30\x12\r\n\tKEM_XWING\x10?\x12\x15\n\x11PQ_SIGN_ML_DSA_44\x10\x44\x12\x15\n\x11PQ_SIGN_ML_DSA_65\x10\x38\x12\x15\n\x11PQ_SIGN_ML_DSA_87\x10\x45\x12\x1d\n\x19PQ_SIGN_SLH_DSA_SHA2_128S\x10\x39\x12)\n%PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256\x10<\x12!\n\x1dPQ_SIGN_ML_DSA_44_EXTERNAL_MU\x10\x46\x12!\n\x1dPQ_SIGN_ML_DSA_65_EXTERNAL_MU\x10\x43\x12!\n\x1dPQ_SIGN_ML_DSA_87_EXTERNAL_MU\x10G\x12\x0f\n\x0b\x41\x45S_256_KWP\x10I\"\x9b\x02\n\x15\x43ryptoKeyVersionState\x12(\n$CRYPTO_KEY_VERSION_STATE_UNSPECIFIED\x10\x00\x12\x16\n\x12PENDING_GENERATION\x10\x05\x12\x0b\n\x07\x45NABLED\x10\x01\x12\x0c\n\x08\x44ISABLED\x10\x02\x12\r\n\tDESTROYED\x10\x03\x12\x15\n\x11\x44\x45STROY_SCHEDULED\x10\x04\x12\x12\n\x0ePENDING_IMPORT\x10\x06\x12\x11\n\rIMPORT_FAILED\x10\x07\x12\x15\n\x11GENERATION_FAILED\x10\x08\x12 \n\x1cPENDING_EXTERNAL_DESTRUCTION\x10\t\x12\x1f\n\x1b\x45XTERNAL_DESTRUCTION_FAILED\x10\n\"I\n\x14\x43ryptoKeyVersionView\x12\'\n#CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED\x10\x00\x12\x08\n\x04\x46ULL\x10\x01:\xaa\x01\xea\x41\xa6\x01\n(cloudkms.googleapis.com/CryptoKeyVersion\x12zprojects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}\"U\n\x0f\x43hecksummedData\x12\x0c\n\x04\x64\x61ta\x18\x03 \x01(\x0c\x12\x34\n\x0f\x63rc32c_checksum\x18\x02 \x01(\x0b\x32\x1b.google.protobuf.Int64Value\"\x8c\x05\n\tPublicKey\x12\x0b\n\x03pem\x18\x01 \x01(\t\x12R\n\talgorithm\x18\x02 \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm\x12/\n\npem_crc32c\x18\x03 \x01(\x0b\x32\x1b.google.protobuf.Int64Value\x12\x0c\n\x04name\x18\x04 \x01(\t\x12>\n\x10protection_level\x18\x05 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevel\x12I\n\x11public_key_format\x18\x07 \x01(\x0e\x32..google.cloud.kms.v1.PublicKey.PublicKeyFormat\x12\x38\n\npublic_key\x18\x08 \x01(\x0b\x32$.google.cloud.kms.v1.ChecksummedData\"i\n\x0fPublicKeyFormat\x12!\n\x1dPUBLIC_KEY_FORMAT_UNSPECIFIED\x10\x00\x12\x07\n\x03PEM\x10\x01\x12\x07\n\x03\x44\x45R\x10\x02\x12\x0c\n\x08NIST_PQC\x10\x03\x12\x13\n\x0fXWING_RAW_BYTES\x10\x04:\xae\x01\xea\x41\xaa\x01\n!cloudkms.googleapis.com/PublicKey\x12\x84\x01projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}/publicKey\"\xed\n\n\tImportJob\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x03\x12J\n\rimport_method\x18\x02 \x01(\x0e\x32+.google.cloud.kms.v1.ImportJob.ImportMethodB\x06\xe0\x41\x02\xe0\x41\x05\x12\x46\n\x10protection_level\x18\t \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevelB\x06\xe0\x41\x02\xe0\x41\x05\x12\x34\n\x0b\x63reate_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x36\n\rgenerate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x34\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12:\n\x11\x65xpire_event_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03\x12\x41\n\x05state\x18\x06 \x01(\x0e\x32-.google.cloud.kms.v1.ImportJob.ImportJobStateB\x03\xe0\x41\x03\x12I\n\npublic_key\x18\x07 \x01(\x0b\x32\x30.google.cloud.kms.v1.ImportJob.WrappingPublicKeyB\x03\xe0\x41\x03\x12N\n\x11public_key_format\x18\x0c \x01(\x0e\x32..google.cloud.kms.v1.PublicKey.PublicKeyFormatB\x03\xe0\x41\x03\x12\x46\n\x0b\x61ttestation\x18\x08 \x01(\x0b\x32,.google.cloud.kms.v1.KeyOperationAttestationB\x03\xe0\x41\x03\x12%\n\x12\x63rypto_key_backend\x18\x0b \x01(\tB\t\xe0\x41\x05\xfa\x41\x03\n\x01*\x1a\x33\n\x11WrappingPublicKey\x12\x0b\n\x03pem\x18\x01 \x01(\t\x12\x11\n\x04\x64\x61ta\x18\x02 \x01(\x0c\x42\x03\xe0\x41\x03\"\xf4\x02\n\x0cImportMethod\x12\x1d\n\x19IMPORT_METHOD_UNSPECIFIED\x10\x00\x12\x1e\n\x1aRSA_OAEP_3072_SHA1_AES_256\x10\x01\x12\x1e\n\x1aRSA_OAEP_4096_SHA1_AES_256\x10\x02\x12 \n\x1cRSA_OAEP_3072_SHA256_AES_256\x10\x03\x12 \n\x1cRSA_OAEP_4096_SHA256_AES_256\x10\x04\x12\x18\n\x14RSA_OAEP_3072_SHA256\x10\x05\x12\x18\n\x14RSA_OAEP_4096_SHA256\x10\x06\x12/\n+HPKE_KEM_ML_KEM_768_HKDF_SHA256_AES_256_GCM\x10\x08\x12\x30\n,HPKE_KEM_ML_KEM_1024_HKDF_SHA256_AES_256_GCM\x10\t\x12*\n&HPKE_KEM_XWING_HKDF_SHA256_AES_256_GCM\x10\n\"c\n\x0eImportJobState\x12 \n\x1cIMPORT_JOB_STATE_UNSPECIFIED\x10\x00\x12\x16\n\x12PENDING_GENERATION\x10\x01\x12\n\n\x06\x41\x43TIVE\x10\x02\x12\x0b\n\x07\x45XPIRED\x10\x03:{\xea\x41x\n!cloudkms.googleapis.com/ImportJob\x12Sprojects/{project}/locations/{location}/keyRings/{key_ring}/importJobs/{import_job}\"[\n\x1e\x45xternalProtectionLevelOptions\x12\x18\n\x10\x65xternal_key_uri\x18\x01 \x01(\t\x12\x1f\n\x17\x65km_connection_key_path\x18\x02 \x01(\t\"b\n\x1dKeyAccessJustificationsPolicy\x12\x41\n\x16\x61llowed_access_reasons\x18\x01 \x03(\x0e\x32!.google.cloud.kms.v1.AccessReason\"\xb9\x02\n\x0fRetiredResource\x12\x14\n\x04name\x18\x01 \x01(\tB\x06\xe0\x41\x03\xe0\x41\x08\x12\x1e\n\x11original_resource\x18\x02 \x01(\tB\x03\xe0\x41\x03\x12\x1a\n\rresource_type\x18\x03 \x01(\tB\x03\xe0\x41\x03\x12\x34\n\x0b\x64\x65lete_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x03\xe0\x41\x03:\x9d\x01\xea\x41\x99\x01\n\'cloudkms.googleapis.com/RetiredResource\x12Kprojects/{project}/locations/{location}/retiredResources/{retired_resource}*\x10retiredResources2\x0fretiredResource*\x81\x01\n\x0fProtectionLevel\x12 \n\x1cPROTECTION_LEVEL_UNSPECIFIED\x10\x00\x12\x0c\n\x08SOFTWARE\x10\x01\x12\x07\n\x03HSM\x10\x02\x12\x0c\n\x08\x45XTERNAL\x10\x03\x12\x10\n\x0c\x45XTERNAL_VPC\x10\x04\x12\x15\n\x11HSM_SINGLE_TENANT\x10\x05*\xb3\x03\n\x0c\x41\x63\x63\x65ssReason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x1e\n\x1a\x43USTOMER_INITIATED_SUPPORT\x10\x01\x12\x1c\n\x18GOOGLE_INITIATED_SERVICE\x10\x02\x12\x1c\n\x18THIRD_PARTY_DATA_REQUEST\x10\x03\x12\x1b\n\x17GOOGLE_INITIATED_REVIEW\x10\x04\x12\x1d\n\x19\x43USTOMER_INITIATED_ACCESS\x10\x05\x12%\n!GOOGLE_INITIATED_SYSTEM_OPERATION\x10\x06\x12\x17\n\x13REASON_NOT_EXPECTED\x10\x07\x12*\n\"MODIFIED_CUSTOMER_INITIATED_ACCESS\x10\x08\x1a\x02\x08\x01\x12\x32\n*MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION\x10\t\x1a\x02\x08\x01\x12\'\n#GOOGLE_RESPONSE_TO_PRODUCTION_ALERT\x10\n\x12*\n&CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING\x10\x0b\x42\x85\x01\n\x17\x63om.google.cloud.kms.v1B\x11KmsResourcesProtoP\x01Z)cloud.google.com/go/kms/apiv1/kmspb;kmspb\xaa\x02\x13Google.Cloud.Kms.V1\xca\x02\x13Google\\Cloud\\Kms\\V1b\x06proto3"
 
 pool = ::Google::Protobuf::DescriptorPool.generated_pool
 pool.add_serialized_file(descriptor_data)