google-cloud-kms 1.6.0 → 2.1.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (27) hide show
  1. checksums.yaml +4 -4
  2. data/.yardopts +2 -1
  3. data/AUTHENTICATION.md +56 -59
  4. data/LICENSE.md +201 -0
  5. data/MIGRATING.md +326 -0
  6. data/README.md +94 -46
  7. data/lib/{google/cloud/kms/v1/doc/google/iam/v1/iam_policy.rb → google-cloud-kms.rb} +4 -6
  8. data/lib/google/cloud/kms.rb +92 -122
  9. data/lib/google/cloud/kms/version.rb +6 -2
  10. metadata +52 -59
  11. data/LICENSE +0 -201
  12. data/lib/google/cloud/kms/v1.rb +0 -159
  13. data/lib/google/cloud/kms/v1/credentials.rb +0 -42
  14. data/lib/google/cloud/kms/v1/doc/google/cloud/kms/v1/resources.rb +0 -540
  15. data/lib/google/cloud/kms/v1/doc/google/cloud/kms/v1/service.rb +0 -491
  16. data/lib/google/cloud/kms/v1/doc/google/iam/v1/options.rb +0 -21
  17. data/lib/google/cloud/kms/v1/doc/google/iam/v1/policy.rb +0 -21
  18. data/lib/google/cloud/kms/v1/doc/google/protobuf/duration.rb +0 -91
  19. data/lib/google/cloud/kms/v1/doc/google/protobuf/field_mask.rb +0 -222
  20. data/lib/google/cloud/kms/v1/doc/google/protobuf/timestamp.rb +0 -113
  21. data/lib/google/cloud/kms/v1/doc/google/type/expr.rb +0 -19
  22. data/lib/google/cloud/kms/v1/helpers.rb +0 -80
  23. data/lib/google/cloud/kms/v1/key_management_service_client.rb +0 -1805
  24. data/lib/google/cloud/kms/v1/key_management_service_client_config.json +0 -162
  25. data/lib/google/cloud/kms/v1/resources_pb.rb +0 -161
  26. data/lib/google/cloud/kms/v1/service_pb.rb +0 -209
  27. data/lib/google/cloud/kms/v1/service_services_pb.rb +0 -151
data/lib/google/cloud/kms/v1/credentials.rb DELETED
@@ -1,42 +0,0 @@
1
- # Copyright 2020 Google LLC
2
- #
3
- # Licensed under the Apache License, Version 2.0 (the "License");
4
- # you may not use this file except in compliance with the License.
5
- # You may obtain a copy of the License at
6
- #
7
- # https://www.apache.org/licenses/LICENSE-2.0
8
- #
9
- # Unless required by applicable law or agreed to in writing, software
10
- # distributed under the License is distributed on an "AS IS" BASIS,
11
- # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
- # See the License for the specific language governing permissions and
13
- # limitations under the License.
14
-
15
-
16
- require "googleauth"
17
-
18
- module Google
19
- module Cloud
20
- module Kms
21
- module V1
22
- class Credentials < Google::Auth::Credentials
23
- SCOPE = [
24
- "https://www.googleapis.com/auth/cloud-platform",
25
- "https://www.googleapis.com/auth/cloudkms"
26
- ].freeze
27
- PATH_ENV_VARS = %w(KMS_CREDENTIALS
28
- KMS_KEYFILE
29
- GOOGLE_CLOUD_CREDENTIALS
30
- GOOGLE_CLOUD_KEYFILE
31
- GCLOUD_KEYFILE)
32
- JSON_ENV_VARS = %w(KMS_CREDENTIALS_JSON
33
- KMS_KEYFILE_JSON
34
- GOOGLE_CLOUD_CREDENTIALS_JSON
35
- GOOGLE_CLOUD_KEYFILE_JSON
36
- GCLOUD_KEYFILE_JSON)
37
- DEFAULT_PATHS = ["~/.config/gcloud/application_default_credentials.json"]
38
- end
39
- end
40
- end
41
- end
42
- end
data/lib/google/cloud/kms/v1/doc/google/cloud/kms/v1/resources.rb DELETED
@@ -1,540 +0,0 @@
1
- # Copyright 2020 Google LLC
2
- #
3
- # Licensed under the Apache License, Version 2.0 (the "License");
4
- # you may not use this file except in compliance with the License.
5
- # You may obtain a copy of the License at
6
- #
7
- # https://www.apache.org/licenses/LICENSE-2.0
8
- #
9
- # Unless required by applicable law or agreed to in writing, software
10
- # distributed under the License is distributed on an "AS IS" BASIS,
11
- # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
- # See the License for the specific language governing permissions and
13
- # limitations under the License.
14
-
15
-
16
- module Google
17
- module Cloud
18
- module Kms
19
- module V1
20
- # A {Google::Cloud::Kms::V1::KeyRing KeyRing} is a toplevel logical grouping of {Google::Cloud::Kms::V1::CryptoKey CryptoKeys}.
21
- # @!attribute [rw] name
22
- # @return [String]
23
- # Output only. The resource name for the {Google::Cloud::Kms::V1::KeyRing KeyRing} in the format
24
- # `projects/*/locations/*/keyRings/*`.
25
- # @!attribute [rw] create_time
26
- # @return [Google::Protobuf::Timestamp]
27
- # Output only. The time at which this {Google::Cloud::Kms::V1::KeyRing KeyRing} was created.
28
- class KeyRing; end
29
-
30
- # A {Google::Cloud::Kms::V1::CryptoKey CryptoKey} represents a logical key that can be used for cryptographic
31
- # operations.
32
- #
33
- # A {Google::Cloud::Kms::V1::CryptoKey CryptoKey} is made up of one or more {Google::Cloud::Kms::V1::CryptoKeyVersion versions}, which
34
- # represent the actual key material used in cryptographic operations.
35
- # @!attribute [rw] name
36
- # @return [String]
37
- # Output only. The resource name for this {Google::Cloud::Kms::V1::CryptoKey CryptoKey} in the format
38
- # `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
39
- # @!attribute [rw] primary
40
- # @return [Google::Cloud::Kms::V1::CryptoKeyVersion]
41
- # Output only. A copy of the "primary" {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} that will be used
42
- # by {Google::Cloud::Kms::V1::KeyManagementService::Encrypt Encrypt} when this {Google::Cloud::Kms::V1::CryptoKey CryptoKey} is given
43
- # in {Google::Cloud::Kms::V1::EncryptRequest#name EncryptRequest#name}.
44
- #
45
- # The {Google::Cloud::Kms::V1::CryptoKey CryptoKey}'s primary version can be updated via
46
- # {Google::Cloud::Kms::V1::KeyManagementService::UpdateCryptoKeyPrimaryVersion UpdateCryptoKeyPrimaryVersion}.
47
- #
48
- # Keys with {Google::Cloud::Kms::V1::CryptoKey#purpose purpose}
49
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT} may have a
50
- # primary. For other keys, this field will be omitted.
51
- # @!attribute [rw] purpose
52
- # @return [Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose]
53
- # Immutable. The immutable purpose of this {Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
54
- # @!attribute [rw] create_time
55
- # @return [Google::Protobuf::Timestamp]
56
- # Output only. The time at which this {Google::Cloud::Kms::V1::CryptoKey CryptoKey} was created.
57
- # @!attribute [rw] next_rotation_time
58
- # @return [Google::Protobuf::Timestamp]
59
- # At {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time}, the Key Management Service will automatically:
60
- #
61
- # 1. Create a new version of this {Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
62
- # 2. Mark the new version as primary.
63
- #
64
- # Key rotations performed manually via
65
- # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion} and
66
- # {Google::Cloud::Kms::V1::KeyManagementService::UpdateCryptoKeyPrimaryVersion UpdateCryptoKeyPrimaryVersion}
67
- # do not affect {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time}.
68
- #
69
- # Keys with {Google::Cloud::Kms::V1::CryptoKey#purpose purpose}
70
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT} support
71
- # automatic rotation. For other keys, this field must be omitted.
72
- # @!attribute [rw] rotation_period
73
- # @return [Google::Protobuf::Duration]
74
- # {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time} will be advanced by this period when the service
75
- # automatically rotates a key. Must be at least 24 hours and at most
76
- # 876,000 hours.
77
- #
78
- # If {Google::Cloud::Kms::V1::CryptoKey#rotation_period rotation_period} is set, {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time} must also be set.
79
- #
80
- # Keys with {Google::Cloud::Kms::V1::CryptoKey#purpose purpose}
81
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT} support
82
- # automatic rotation. For other keys, this field must be omitted.
83
- # @!attribute [rw] version_template
84
- # @return [Google::Cloud::Kms::V1::CryptoKeyVersionTemplate]
85
- # A template describing settings for new {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} instances.
86
- # The properties of new {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} instances created by either
87
- # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion} or
88
- # auto-rotation are controlled by this template.
89
- # @!attribute [rw] labels
90
- # @return [Hash{String => String}]
91
- # Labels with user-defined metadata. For more information, see
92
- # [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
93
- class CryptoKey
94
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose CryptoKeyPurpose} describes the cryptographic capabilities of a
95
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKey}. A given key can only be used for the operations allowed by
96
- # its purpose. For more information, see
97
- # [Key purposes](https://cloud.google.com/kms/docs/algorithms#key_purposes).
98
- module CryptoKeyPurpose
99
- # Not specified.
100
- CRYPTO_KEY_PURPOSE_UNSPECIFIED = 0
101
-
102
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} with this purpose may be used with
103
- # {Google::Cloud::Kms::V1::KeyManagementService::Encrypt Encrypt} and
104
- # {Google::Cloud::Kms::V1::KeyManagementService::Decrypt Decrypt}.
105
- ENCRYPT_DECRYPT = 1
106
-
107
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} with this purpose may be used with
108
- # {Google::Cloud::Kms::V1::KeyManagementService::AsymmetricSign AsymmetricSign} and
109
- # {Google::Cloud::Kms::V1::KeyManagementService::GetPublicKey GetPublicKey}.
110
- ASYMMETRIC_SIGN = 5
111
-
112
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} with this purpose may be used with
113
- # {Google::Cloud::Kms::V1::KeyManagementService::AsymmetricDecrypt AsymmetricDecrypt} and
114
- # {Google::Cloud::Kms::V1::KeyManagementService::GetPublicKey GetPublicKey}.
115
- ASYMMETRIC_DECRYPT = 6
116
- end
117
- end
118
-
119
- # A {Google::Cloud::Kms::V1::CryptoKeyVersionTemplate CryptoKeyVersionTemplate} specifies the properties to use when creating
120
- # a new {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, either manually with
121
- # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion} or
122
- # automatically as a result of auto-rotation.
123
- # @!attribute [rw] protection_level
124
- # @return [Google::Cloud::Kms::V1::ProtectionLevel]
125
- # {Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} to use when creating a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} based on
126
- # this template. Immutable. Defaults to {Google::Cloud::Kms::V1::ProtectionLevel::SOFTWARE SOFTWARE}.
127
- # @!attribute [rw] algorithm
128
- # @return [Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm]
129
- # Required. {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm Algorithm} to use
130
- # when creating a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} based on this template.
131
- #
132
- # For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both
133
- # this field is omitted and {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose} is
134
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}.
135
- class CryptoKeyVersionTemplate; end
136
-
137
- # Contains an HSM-generated attestation about a key operation. For more
138
- # information, see [Verifying attestations]
139
- # (https://cloud.google.com/kms/docs/attest-key).
140
- # @!attribute [rw] format
141
- # @return [Google::Cloud::Kms::V1::KeyOperationAttestation::AttestationFormat]
142
- # Output only. The format of the attestation data.
143
- # @!attribute [rw] content
144
- # @return [String]
145
- # Output only. The attestation data provided by the HSM when the key
146
- # operation was performed.
147
- class KeyOperationAttestation
148
- # Attestation formats provided by the HSM.
149
- module AttestationFormat
150
- # Not specified.
151
- ATTESTATION_FORMAT_UNSPECIFIED = 0
152
-
153
- # Cavium HSM attestation compressed with gzip. Note that this format is
154
- # defined by Cavium and subject to change at any time.
155
- CAVIUM_V1_COMPRESSED = 3
156
-
157
- # Cavium HSM attestation V2 compressed with gzip. This is a new format
158
- # introduced in Cavium's version 3.2-08.
159
- CAVIUM_V2_COMPRESSED = 4
160
- end
161
- end
162
-
163
- # A {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} represents an individual cryptographic key, and the
164
- # associated key material.
165
- #
166
- # An {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED} version can be
167
- # used for cryptographic operations.
168
- #
169
- # For security reasons, the raw cryptographic key material represented by a
170
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} can never be viewed or exported. It can only be used to
171
- # encrypt, decrypt, or sign data when an authorized user or application invokes
172
- # Cloud KMS.
173
- # @!attribute [rw] name
174
- # @return [String]
175
- # Output only. The resource name for this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} in the format
176
- # `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
177
- # @!attribute [rw] state
178
- # @return [Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState]
179
- # The current state of the {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}.
180
- # @!attribute [rw] protection_level
181
- # @return [Google::Cloud::Kms::V1::ProtectionLevel]
182
- # Output only. The {Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} describing how crypto operations are
183
- # performed with this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}.
184
- # @!attribute [rw] algorithm
185
- # @return [Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm]
186
- # Output only. The {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm CryptoKeyVersionAlgorithm} that this
187
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} supports.
188
- # @!attribute [rw] attestation
189
- # @return [Google::Cloud::Kms::V1::KeyOperationAttestation]
190
- # Output only. Statement that was generated and signed by the HSM at key
191
- # creation time. Use this statement to verify attributes of the key as stored
192
- # on the HSM, independently of Google. Only provided for key versions with
193
- # {Google::Cloud::Kms::V1::CryptoKeyVersion#protection_level protection_level} {Google::Cloud::Kms::V1::ProtectionLevel::HSM HSM}.
194
- # @!attribute [rw] create_time
195
- # @return [Google::Protobuf::Timestamp]
196
- # Output only. The time at which this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} was created.
197
- # @!attribute [rw] generate_time
198
- # @return [Google::Protobuf::Timestamp]
199
- # Output only. The time this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}'s key material was
200
- # generated.
201
- # @!attribute [rw] destroy_time
202
- # @return [Google::Protobuf::Timestamp]
203
- # Output only. The time this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}'s key material is scheduled
204
- # for destruction. Only present if {Google::Cloud::Kms::V1::CryptoKeyVersion#state state} is
205
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROY_SCHEDULED DESTROY_SCHEDULED}.
206
- # @!attribute [rw] destroy_event_time
207
- # @return [Google::Protobuf::Timestamp]
208
- # Output only. The time this CryptoKeyVersion's key material was
209
- # destroyed. Only present if {Google::Cloud::Kms::V1::CryptoKeyVersion#state state} is
210
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROYED DESTROYED}.
211
- # @!attribute [rw] import_job
212
- # @return [String]
213
- # Output only. The name of the {Google::Cloud::Kms::V1::ImportJob ImportJob} used to import this
214
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. Only present if the underlying key material was
215
- # imported.
216
- # @!attribute [rw] import_time
217
- # @return [Google::Protobuf::Timestamp]
218
- # Output only. The time at which this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}'s key material
219
- # was imported.
220
- # @!attribute [rw] import_failure_reason
221
- # @return [String]
222
- # Output only. The root cause of an import failure. Only present if
223
- # {Google::Cloud::Kms::V1::CryptoKeyVersion#state state} is
224
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::IMPORT_FAILED IMPORT_FAILED}.
225
- # @!attribute [rw] external_protection_level_options
226
- # @return [Google::Cloud::Kms::V1::ExternalProtectionLevelOptions]
227
- # ExternalProtectionLevelOptions stores a group of additional fields for
228
- # configuring a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} that are specific to the
229
- # {Google::Cloud::Kms::V1::ProtectionLevel::EXTERNAL EXTERNAL} protection level.
230
- class CryptoKeyVersion
231
- # The algorithm of the {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, indicating what
232
- # parameters must be used for each cryptographic operation.
233
- #
234
- # The
235
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm::GOOGLE_SYMMETRIC_ENCRYPTION GOOGLE_SYMMETRIC_ENCRYPTION}
236
- # algorithm is usable with {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
237
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}.
238
- #
239
- # Algorithms beginning with "RSA_SIGN_" are usable with {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
240
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ASYMMETRIC_SIGN ASYMMETRIC_SIGN}.
241
- #
242
- # The fields in the name after "RSA_SIGN_" correspond to the following
243
- # parameters: padding algorithm, modulus bit length, and digest algorithm.
244
- #
245
- # For PSS, the salt length used is equal to the length of digest
246
- # algorithm. For example,
247
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm::RSA_SIGN_PSS_2048_SHA256 RSA_SIGN_PSS_2048_SHA256}
248
- # will use PSS with a salt length of 256 bits or 32 bytes.
249
- #
250
- # Algorithms beginning with "RSA_DECRYPT_" are usable with
251
- # {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
252
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ASYMMETRIC_DECRYPT ASYMMETRIC_DECRYPT}.
253
- #
254
- # The fields in the name after "RSA_DECRYPT_" correspond to the following
255
- # parameters: padding algorithm, modulus bit length, and digest algorithm.
256
- #
257
- # Algorithms beginning with "EC_SIGN_" are usable with {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
258
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ASYMMETRIC_SIGN ASYMMETRIC_SIGN}.
259
- #
260
- # The fields in the name after "EC_SIGN_" correspond to the following
261
- # parameters: elliptic curve, digest algorithm.
262
- #
263
- # For more information, see [Key purposes and algorithms]
264
- # (https://cloud.google.com/kms/docs/algorithms).
265
- module CryptoKeyVersionAlgorithm
266
- # Not specified.
267
- CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED = 0
268
-
269
- # Creates symmetric encryption keys.
270
- GOOGLE_SYMMETRIC_ENCRYPTION = 1
271
-
272
- # RSASSA-PSS 2048 bit key with a SHA256 digest.
273
- RSA_SIGN_PSS_2048_SHA256 = 2
274
-
275
- # RSASSA-PSS 3072 bit key with a SHA256 digest.
276
- RSA_SIGN_PSS_3072_SHA256 = 3
277
-
278
- # RSASSA-PSS 4096 bit key with a SHA256 digest.
279
- RSA_SIGN_PSS_4096_SHA256 = 4
280
-
281
- # RSASSA-PSS 4096 bit key with a SHA512 digest.
282
- RSA_SIGN_PSS_4096_SHA512 = 15
283
-
284
- # RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
285
- RSA_SIGN_PKCS1_2048_SHA256 = 5
286
-
287
- # RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
288
- RSA_SIGN_PKCS1_3072_SHA256 = 6
289
-
290
- # RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
291
- RSA_SIGN_PKCS1_4096_SHA256 = 7
292
-
293
- # RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
294
- RSA_SIGN_PKCS1_4096_SHA512 = 16
295
-
296
- # RSAES-OAEP 2048 bit key with a SHA256 digest.
297
- RSA_DECRYPT_OAEP_2048_SHA256 = 8
298
-
299
- # RSAES-OAEP 3072 bit key with a SHA256 digest.
300
- RSA_DECRYPT_OAEP_3072_SHA256 = 9
301
-
302
- # RSAES-OAEP 4096 bit key with a SHA256 digest.
303
- RSA_DECRYPT_OAEP_4096_SHA256 = 10
304
-
305
- # RSAES-OAEP 4096 bit key with a SHA512 digest.
306
- RSA_DECRYPT_OAEP_4096_SHA512 = 17
307
-
308
- # ECDSA on the NIST P-256 curve with a SHA256 digest.
309
- EC_SIGN_P256_SHA256 = 12
310
-
311
- # ECDSA on the NIST P-384 curve with a SHA384 digest.
312
- EC_SIGN_P384_SHA384 = 13
313
-
314
- # Algorithm representing symmetric encryption by an external key manager.
315
- EXTERNAL_SYMMETRIC_ENCRYPTION = 18
316
- end
317
-
318
- # The state of a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, indicating if it can be used.
319
- module CryptoKeyVersionState
320
- # Not specified.
321
- CRYPTO_KEY_VERSION_STATE_UNSPECIFIED = 0
322
-
323
- # This version is still being generated. It may not be used, enabled,
324
- # disabled, or destroyed yet. Cloud KMS will automatically mark this
325
- # version {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED} as soon as the version is ready.
326
- PENDING_GENERATION = 5
327
-
328
- # This version may be used for cryptographic operations.
329
- ENABLED = 1
330
-
331
- # This version may not be used, but the key material is still available,
332
- # and the version can be placed back into the {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED} state.
333
- DISABLED = 2
334
-
335
- # This version is destroyed, and the key material is no longer stored.
336
- # A version may not leave this state once entered.
337
- DESTROYED = 3
338
-
339
- # This version is scheduled for destruction, and will be destroyed soon.
340
- # Call
341
- # {Google::Cloud::Kms::V1::KeyManagementService::RestoreCryptoKeyVersion RestoreCryptoKeyVersion}
342
- # to put it back into the {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DISABLED DISABLED} state.
343
- DESTROY_SCHEDULED = 4
344
-
345
- # This version is still being imported. It may not be used, enabled,
346
- # disabled, or destroyed yet. Cloud KMS will automatically mark this
347
- # version {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED} as soon as the version is ready.
348
- PENDING_IMPORT = 6
349
-
350
- # This version was not imported successfully. It may not be used, enabled,
351
- # disabled, or destroyed. The submitted key material has been discarded.
352
- # Additional details can be found in
353
- # {Google::Cloud::Kms::V1::CryptoKeyVersion#import_failure_reason CryptoKeyVersion#import_failure_reason}.
354
- IMPORT_FAILED = 7
355
- end
356
-
357
- # A view for {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}s. Controls the level of detail returned
358
- # for {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersions} in
359
- # {Google::Cloud::Kms::V1::KeyManagementService::ListCryptoKeyVersions KeyManagementService::ListCryptoKeyVersions} and
360
- # {Google::Cloud::Kms::V1::KeyManagementService::ListCryptoKeys KeyManagementService::ListCryptoKeys}.
361
- module CryptoKeyVersionView
362
- # Default view for each {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. Does not include
363
- # the {Google::Cloud::Kms::V1::CryptoKeyVersion#attestation attestation} field.
364
- CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED = 0
365
-
366
- # Provides all fields in each {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, including the
367
- # {Google::Cloud::Kms::V1::CryptoKeyVersion#attestation attestation}.
368
- FULL = 1
369
- end
370
- end
371
-
372
- # The public key for a given {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. Obtained via
373
- # {Google::Cloud::Kms::V1::KeyManagementService::GetPublicKey GetPublicKey}.
374
- # @!attribute [rw] pem
375
- # @return [String]
376
- # The public key, encoded in PEM format. For more information, see the
377
- # [RFC 7468](https://tools.ietf.org/html/rfc7468) sections for
378
- # [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
379
- # [Textual Encoding of Subject Public Key Info]
380
- # (https://tools.ietf.org/html/rfc7468#section-13).
381
- # @!attribute [rw] algorithm
382
- # @return [Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm]
383
- # The {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm Algorithm} associated
384
- # with this key.
385
- class PublicKey; end
386
-
387
- # An {Google::Cloud::Kms::V1::ImportJob ImportJob} can be used to create {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} and
388
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersions} using pre-existing key material,
389
- # generated outside of Cloud KMS.
390
- #
391
- # When an {Google::Cloud::Kms::V1::ImportJob ImportJob} is created, Cloud KMS will generate a "wrapping key",
392
- # which is a public/private key pair. You use the wrapping key to encrypt (also
393
- # known as wrap) the pre-existing key material to protect it during the import
394
- # process. The nature of the wrapping key depends on the choice of
395
- # {Google::Cloud::Kms::V1::ImportJob#import_method import_method}. When the wrapping key generation
396
- # is complete, the {Google::Cloud::Kms::V1::ImportJob#state state} will be set to
397
- # {Google::Cloud::Kms::V1::ImportJob::ImportJobState::ACTIVE ACTIVE} and the {Google::Cloud::Kms::V1::ImportJob#public_key public_key}
398
- # can be fetched. The fetched public key can then be used to wrap your
399
- # pre-existing key material.
400
- #
401
- # Once the key material is wrapped, it can be imported into a new
402
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} in an existing {Google::Cloud::Kms::V1::CryptoKey CryptoKey} by calling
403
- # {Google::Cloud::Kms::V1::KeyManagementService::ImportCryptoKeyVersion ImportCryptoKeyVersion}.
404
- # Multiple {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersions} can be imported with a single
405
- # {Google::Cloud::Kms::V1::ImportJob ImportJob}. Cloud KMS uses the private key portion of the wrapping key to
406
- # unwrap the key material. Only Cloud KMS has access to the private key.
407
- #
408
- # An {Google::Cloud::Kms::V1::ImportJob ImportJob} expires 3 days after it is created. Once expired, Cloud KMS
409
- # will no longer be able to import or unwrap any key material that was wrapped
410
- # with the {Google::Cloud::Kms::V1::ImportJob ImportJob}'s public key.
411
- #
412
- # For more information, see
413
- # [Importing a key](https://cloud.google.com/kms/docs/importing-a-key).
414
- # @!attribute [rw] name
415
- # @return [String]
416
- # Output only. The resource name for this {Google::Cloud::Kms::V1::ImportJob ImportJob} in the format
417
- # `projects/*/locations/*/keyRings/*/importJobs/*`.
418
- # @!attribute [rw] import_method
419
- # @return [Google::Cloud::Kms::V1::ImportJob::ImportMethod]
420
- # Required. Immutable. The wrapping method to be used for incoming key material.
421
- # @!attribute [rw] protection_level
422
- # @return [Google::Cloud::Kms::V1::ProtectionLevel]
423
- # Required. Immutable. The protection level of the {Google::Cloud::Kms::V1::ImportJob ImportJob}. This must match the
424
- # {Google::Cloud::Kms::V1::CryptoKeyVersionTemplate#protection_level protection_level} of the
425
- # {Google::Cloud::Kms::V1::CryptoKey#version_template version_template} on the {Google::Cloud::Kms::V1::CryptoKey CryptoKey} you
426
- # attempt to import into.
427
- # @!attribute [rw] create_time
428
- # @return [Google::Protobuf::Timestamp]
429
- # Output only. The time at which this {Google::Cloud::Kms::V1::ImportJob ImportJob} was created.
430
- # @!attribute [rw] generate_time
431
- # @return [Google::Protobuf::Timestamp]
432
- # Output only. The time this {Google::Cloud::Kms::V1::ImportJob ImportJob}'s key material was generated.
433
- # @!attribute [rw] expire_time
434
- # @return [Google::Protobuf::Timestamp]
435
- # Output only. The time at which this {Google::Cloud::Kms::V1::ImportJob ImportJob} is scheduled for
436
- # expiration and can no longer be used to import key material.
437
- # @!attribute [rw] expire_event_time
438
- # @return [Google::Protobuf::Timestamp]
439
- # Output only. The time this {Google::Cloud::Kms::V1::ImportJob ImportJob} expired. Only present if
440
- # {Google::Cloud::Kms::V1::ImportJob#state state} is {Google::Cloud::Kms::V1::ImportJob::ImportJobState::EXPIRED EXPIRED}.
441
- # @!attribute [rw] state
442
- # @return [Google::Cloud::Kms::V1::ImportJob::ImportJobState]
443
- # Output only. The current state of the {Google::Cloud::Kms::V1::ImportJob ImportJob}, indicating if it can
444
- # be used.
445
- # @!attribute [rw] public_key
446
- # @return [Google::Cloud::Kms::V1::ImportJob::WrappingPublicKey]
447
- # Output only. The public key with which to wrap key material prior to
448
- # import. Only returned if {Google::Cloud::Kms::V1::ImportJob#state state} is
449
- # {Google::Cloud::Kms::V1::ImportJob::ImportJobState::ACTIVE ACTIVE}.
450
- # @!attribute [rw] attestation
451
- # @return [Google::Cloud::Kms::V1::KeyOperationAttestation]
452
- # Output only. Statement that was generated and signed by the key creator
453
- # (for example, an HSM) at key creation time. Use this statement to verify
454
- # attributes of the key as stored on the HSM, independently of Google.
455
- # Only present if the chosen {Google::Cloud::Kms::V1::ImportJob::ImportMethod ImportMethod} is one with a protection
456
- # level of {Google::Cloud::Kms::V1::ProtectionLevel::HSM HSM}.
457
- class ImportJob
458
- # The public key component of the wrapping key. For details of the type of
459
- # key this public key corresponds to, see the {Google::Cloud::Kms::V1::ImportJob::ImportMethod ImportMethod}.
460
- # @!attribute [rw] pem
461
- # @return [String]
462
- # The public key, encoded in PEM format. For more information, see the [RFC
463
- # 7468](https://tools.ietf.org/html/rfc7468) sections for [General
464
- # Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
465
- # [Textual Encoding of Subject Public Key Info]
466
- # (https://tools.ietf.org/html/rfc7468#section-13).
467
- class WrappingPublicKey; end
468
-
469
- # The state of the {Google::Cloud::Kms::V1::ImportJob ImportJob}, indicating if it can be used.
470
- module ImportJobState
471
- # Not specified.
472
- IMPORT_JOB_STATE_UNSPECIFIED = 0
473
-
474
- # The wrapping key for this job is still being generated. It may not be
475
- # used. Cloud KMS will automatically mark this job as
476
- # {Google::Cloud::Kms::V1::ImportJob::ImportJobState::ACTIVE ACTIVE} as soon as the wrapping key is generated.
477
- PENDING_GENERATION = 1
478
-
479
- # This job may be used in
480
- # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKey CreateCryptoKey} and
481
- # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion}
482
- # requests.
483
- ACTIVE = 2
484
-
485
- # This job can no longer be used and may not leave this state once entered.
486
- EXPIRED = 3
487
- end
488
-
489
- # {Google::Cloud::Kms::V1::ImportJob::ImportMethod ImportMethod} describes the key wrapping method chosen for this
490
- # {Google::Cloud::Kms::V1::ImportJob ImportJob}.
491
- module ImportMethod
492
- # Not specified.
493
- IMPORT_METHOD_UNSPECIFIED = 0
494
-
495
- # This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
496
- # scheme defined in the PKCS #11 standard. In summary, this involves
497
- # wrapping the raw key with an ephemeral AES key, and wrapping the
498
- # ephemeral AES key with a 3072 bit RSA key. For more details, see
499
- # [RSA AES key wrap
500
- # mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
501
- RSA_OAEP_3072_SHA1_AES_256 = 1
502
-
503
- # This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
504
- # scheme defined in the PKCS #11 standard. In summary, this involves
505
- # wrapping the raw key with an ephemeral AES key, and wrapping the
506
- # ephemeral AES key with a 4096 bit RSA key. For more details, see
507
- # [RSA AES key wrap
508
- # mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
509
- RSA_OAEP_4096_SHA1_AES_256 = 2
510
- end
511
- end
512
-
513
- # ExternalProtectionLevelOptions stores a group of additional fields for
514
- # configuring a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} that are specific to the
515
- # {Google::Cloud::Kms::V1::ProtectionLevel::EXTERNAL EXTERNAL} protection level.
516
- # @!attribute [rw] external_key_uri
517
- # @return [String]
518
- # The URI for an external resource that this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} represents.
519
- class ExternalProtectionLevelOptions; end
520
-
521
- # {Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} specifies how cryptographic operations are performed.
522
- # For more information, see [Protection levels]
523
- # (https://cloud.google.com/kms/docs/algorithms#protection_levels).
524
- module ProtectionLevel
525
- # Not specified.
526
- PROTECTION_LEVEL_UNSPECIFIED = 0
527
-
528
- # Crypto operations are performed in software.
529
- SOFTWARE = 1
530
-
531
- # Crypto operations are performed in a Hardware Security Module.
532
- HSM = 2
533
-
534
- # Crypto operations are performed by an external key manager.
535
- EXTERNAL = 3
536
- end
537
- end
538
- end
539
- end
540
- end