google-cloud-kms 1.0.2 → 1.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (12) hide show
  1. checksums.yaml +4 -4
  2. data/lib/google/cloud/kms/v1/credentials.rb +2 -1
  3. data/lib/google/cloud/kms/v1/doc/google/cloud/kms/v1/resources.rb +258 -149
  4. data/lib/google/cloud/kms/v1/doc/google/cloud/kms/v1/service.rb +213 -157
  5. data/lib/google/cloud/kms/v1/helpers.rb +10 -0
  6. data/lib/google/cloud/kms/v1/key_management_service_client.rb +399 -143
  7. data/lib/google/cloud/kms/v1/key_management_service_client_config.json +20 -0
  8. data/lib/google/cloud/kms/v1/resources_pb.rb +38 -0
  9. data/lib/google/cloud/kms/v1/service_pb.rb +41 -2
  10. data/lib/google/cloud/kms/v1/service_services_pb.rb +49 -64
  11. data/lib/google/cloud/kms/version.rb +1 -1
  12. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 3435174d6d95af25a352f8a5c7f3eaca84d5dbb3a4ce314dda344fcaa8278006
4
- data.tar.gz: aa981529b7c9903b2e845e9b5033ff65b2edcfe877ef6e85b8b4e39caa87e54c
3
+ metadata.gz: 5db965ca05a2730295562c67ca7aabba12f0514f65334cf8af4365393c4f74b3
4
+ data.tar.gz: 00e160157392f2daa985ff3f04ede025c587804b0cb8e850f8e391e9dc01097a
5
5
  SHA512:
6
- metadata.gz: b95dcd8e9706515732428353da166177e7a872b3c307b2908dd68bf4f1e01f65d739316c5f0a0c814b908ce695a31c045f77a9413ffc114be4ee27e73d120b3a
7
- data.tar.gz: 6344f662a0c796df9c643ff7826c135a72d4b9927cc300a852931a876206021d3c6453b700cc64ffe3e890ee8291e6b82bce75ceb127b3819f62cf9980317af0
6
+ metadata.gz: 68862a97c1900e8f9d36248332539527ac69c3308bca22d2329b7105acdb5044569f22d4a9098ac9490e2270341b34223154856cf256b81051247c8b5233068c
7
+ data.tar.gz: 0c27f690f539ecbd3df14dc7c83d5ecc7be332dbef9ce99e47dd0e121e2265236d5219549e901cb7f83314cb0d770f6ffba3c0d565b0048ec41b3b5b70534e5a
data/lib/google/cloud/kms/v1/credentials.rb CHANGED
@@ -21,7 +21,8 @@ module Google
21
21
  module V1
22
22
  class Credentials < Google::Auth::Credentials
23
23
  SCOPE = [
24
- "https://www.googleapis.com/auth/cloud-platform"
24
+ "https://www.googleapis.com/auth/cloud-platform",
25
+ "https://www.googleapis.com/auth/cloudkms"
25
26
  ].freeze
26
27
  PATH_ENV_VARS = %w(KMS_CREDENTIALS
27
28
  KMS_KEYFILE
data/lib/google/cloud/kms/v1/doc/google/cloud/kms/v1/resources.rb CHANGED
@@ -17,153 +17,125 @@ module Google
17
17
  module Cloud
18
18
  module Kms
19
19
  module V1
20
- # A {Google::Cloud::Kms::V1::KeyRing KeyRing} is a toplevel logical grouping of
21
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys}.
20
+ # A {Google::Cloud::Kms::V1::KeyRing KeyRing} is a toplevel logical grouping of {Google::Cloud::Kms::V1::CryptoKey CryptoKeys}.
22
21
  # @!attribute [rw] name
23
22
  # @return [String]
24
- # Output only. The resource name for the
25
- # {Google::Cloud::Kms::V1::KeyRing KeyRing} in the format
23
+ # Output only. The resource name for the {Google::Cloud::Kms::V1::KeyRing KeyRing} in the format
26
24
  # `projects/*/locations/*/keyRings/*`.
27
25
  # @!attribute [rw] create_time
28
26
  # @return [Google::Protobuf::Timestamp]
29
- # Output only. The time at which this {Google::Cloud::Kms::V1::KeyRing KeyRing}
30
- # was created.
27
+ # Output only. The time at which this {Google::Cloud::Kms::V1::KeyRing KeyRing} was created.
31
28
  class KeyRing; end
32
29
 
33
- # A {Google::Cloud::Kms::V1::CryptoKey CryptoKey} represents a logical key that
34
- # can be used for cryptographic operations.
30
+ # A {Google::Cloud::Kms::V1::CryptoKey CryptoKey} represents a logical key that can be used for cryptographic
31
+ # operations.
35
32
  #
36
- # A {Google::Cloud::Kms::V1::CryptoKey CryptoKey} is made up of one or more
37
- # {Google::Cloud::Kms::V1::CryptoKeyVersion versions}, which represent the actual
38
- # key material used in cryptographic operations.
33
+ # A {Google::Cloud::Kms::V1::CryptoKey CryptoKey} is made up of one or more {Google::Cloud::Kms::V1::CryptoKeyVersion versions}, which
34
+ # represent the actual key material used in cryptographic operations.
39
35
  # @!attribute [rw] name
40
36
  # @return [String]
41
- # Output only. The resource name for this
42
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKey} in the format
37
+ # Output only. The resource name for this {Google::Cloud::Kms::V1::CryptoKey CryptoKey} in the format
43
38
  # `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
44
39
  # @!attribute [rw] primary
45
40
  # @return [Google::Cloud::Kms::V1::CryptoKeyVersion]
46
- # Output only. A copy of the "primary"
47
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} that will be used
48
- # by {Google::Cloud::Kms::V1::KeyManagementService::Encrypt Encrypt} when this
49
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKey} is given in
50
- # {Google::Cloud::Kms::V1::EncryptRequest#name EncryptRequest#name}.
41
+ # Output only. A copy of the "primary" {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} that will be used
42
+ # by {Google::Cloud::Kms::V1::KeyManagementService::Encrypt Encrypt} when this {Google::Cloud::Kms::V1::CryptoKey CryptoKey} is given
43
+ # in {Google::Cloud::Kms::V1::EncryptRequest#name EncryptRequest#name}.
51
44
  #
52
- # The {Google::Cloud::Kms::V1::CryptoKey CryptoKey}'s primary version can be
53
- # updated via
45
+ # The {Google::Cloud::Kms::V1::CryptoKey CryptoKey}'s primary version can be updated via
54
46
  # {Google::Cloud::Kms::V1::KeyManagementService::UpdateCryptoKeyPrimaryVersion UpdateCryptoKeyPrimaryVersion}.
55
47
  #
56
48
  # All keys with {Google::Cloud::Kms::V1::CryptoKey#purpose purpose}
57
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}
58
- # have a primary. For other keys, this field will be omitted.
49
+ # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT} have a
50
+ # primary. For other keys, this field will be omitted.
59
51
  # @!attribute [rw] purpose
60
52
  # @return [Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose]
61
53
  # The immutable purpose of this {Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
62
54
  # @!attribute [rw] create_time
63
55
  # @return [Google::Protobuf::Timestamp]
64
- # Output only. The time at which this
65
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKey} was created.
56
+ # Output only. The time at which this {Google::Cloud::Kms::V1::CryptoKey CryptoKey} was created.
66
57
  # @!attribute [rw] next_rotation_time
67
58
  # @return [Google::Protobuf::Timestamp]
68
- # At {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time},
69
- # the Key Management Service will automatically:
59
+ # At {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time}, the Key Management Service will automatically:
70
60
  #
71
61
  # 1. Create a new version of this {Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
72
62
  # 2. Mark the new version as primary.
73
63
  #
74
64
  # Key rotations performed manually via
75
- # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion}
76
- # and
65
+ # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion} and
77
66
  # {Google::Cloud::Kms::V1::KeyManagementService::UpdateCryptoKeyPrimaryVersion UpdateCryptoKeyPrimaryVersion}
78
- # do not affect
79
- # {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time}.
67
+ # do not affect {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time}.
80
68
  #
81
69
  # Keys with {Google::Cloud::Kms::V1::CryptoKey#purpose purpose}
82
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}
83
- # support automatic rotation. For other keys, this field must be omitted.
70
+ # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT} support
71
+ # automatic rotation. For other keys, this field must be omitted.
84
72
  # @!attribute [rw] rotation_period
85
73
  # @return [Google::Protobuf::Duration]
86
- # {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time}
87
- # will be advanced by this period when the service automatically rotates a
88
- # key. Must be at least one day.
74
+ # {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time} will be advanced by this period when the service
75
+ # automatically rotates a key. Must be at least one day.
89
76
  #
90
- # If {Google::Cloud::Kms::V1::CryptoKey#rotation_period rotation_period} is
91
- # set,
92
- # {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time}
93
- # must also be set.
77
+ # If {Google::Cloud::Kms::V1::CryptoKey#rotation_period rotation_period} is set, {Google::Cloud::Kms::V1::CryptoKey#next_rotation_time next_rotation_time} must also be set.
94
78
  #
95
79
  # Keys with {Google::Cloud::Kms::V1::CryptoKey#purpose purpose}
96
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}
97
- # support automatic rotation. For other keys, this field must be omitted.
80
+ # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT} support
81
+ # automatic rotation. For other keys, this field must be omitted.
98
82
  # @!attribute [rw] version_template
99
83
  # @return [Google::Cloud::Kms::V1::CryptoKeyVersionTemplate]
100
- # A template describing settings for new
101
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} instances. The
102
- # properties of new {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}
103
- # instances created by either
104
- # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion}
105
- # or auto-rotation are controlled by this template.
84
+ # A template describing settings for new {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} instances.
85
+ # The properties of new {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} instances created by either
86
+ # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion} or
87
+ # auto-rotation are controlled by this template.
106
88
  # @!attribute [rw] labels
107
89
  # @return [Hash{String => String}]
108
90
  # Labels with user-defined metadata. For more information, see
109
91
  # [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
110
92
  class CryptoKey
111
- # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose CryptoKeyPurpose}
112
- # describes the cryptographic capabilities of a
113
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKey}. A given key can only be used
114
- # for the operations allowed by its purpose.
93
+ # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose CryptoKeyPurpose} describes the cryptographic capabilities of a
94
+ # {Google::Cloud::Kms::V1::CryptoKey CryptoKey}. A given key can only be used for the operations allowed by
95
+ # its purpose. For more information, see
96
+ # [Key purposes](https://cloud.google.com/kms/docs/algorithms#key_purposes).
115
97
  module CryptoKeyPurpose
116
98
  # Not specified.
117
99
  CRYPTO_KEY_PURPOSE_UNSPECIFIED = 0
118
100
 
119
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} with this purpose may be used
120
- # with {Google::Cloud::Kms::V1::KeyManagementService::Encrypt Encrypt} and
101
+ # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} with this purpose may be used with
102
+ # {Google::Cloud::Kms::V1::KeyManagementService::Encrypt Encrypt} and
121
103
  # {Google::Cloud::Kms::V1::KeyManagementService::Decrypt Decrypt}.
122
104
  ENCRYPT_DECRYPT = 1
123
105
 
124
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} with this purpose may be used
125
- # with
126
- # {Google::Cloud::Kms::V1::KeyManagementService::AsymmetricSign AsymmetricSign}
127
- # and
106
+ # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} with this purpose may be used with
107
+ # {Google::Cloud::Kms::V1::KeyManagementService::AsymmetricSign AsymmetricSign} and
128
108
  # {Google::Cloud::Kms::V1::KeyManagementService::GetPublicKey GetPublicKey}.
129
109
  ASYMMETRIC_SIGN = 5
130
110
 
131
- # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} with this purpose may be used
132
- # with
133
- # {Google::Cloud::Kms::V1::KeyManagementService::AsymmetricDecrypt AsymmetricDecrypt}
134
- # and
111
+ # {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} with this purpose may be used with
112
+ # {Google::Cloud::Kms::V1::KeyManagementService::AsymmetricDecrypt AsymmetricDecrypt} and
135
113
  # {Google::Cloud::Kms::V1::KeyManagementService::GetPublicKey GetPublicKey}.
136
114
  ASYMMETRIC_DECRYPT = 6
137
115
  end
138
116
  end
139
117
 
140
- # A {Google::Cloud::Kms::V1::CryptoKeyVersionTemplate CryptoKeyVersionTemplate}
141
- # specifies the properties to use when creating a new
142
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, either manually
143
- # with
144
- # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion}
145
- # or automatically as a result of auto-rotation.
118
+ # A {Google::Cloud::Kms::V1::CryptoKeyVersionTemplate CryptoKeyVersionTemplate} specifies the properties to use when creating
119
+ # a new {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, either manually with
120
+ # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion} or
121
+ # automatically as a result of auto-rotation.
146
122
  # @!attribute [rw] protection_level
147
123
  # @return [Google::Cloud::Kms::V1::ProtectionLevel]
148
- # {Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} to use when creating
149
- # a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} based on this
150
- # template. Immutable. Defaults to
151
- # {Google::Cloud::Kms::V1::ProtectionLevel::SOFTWARE SOFTWARE}.
124
+ # {Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} to use when creating a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} based on
125
+ # this template. Immutable. Defaults to {Google::Cloud::Kms::V1::ProtectionLevel::SOFTWARE SOFTWARE}.
152
126
  # @!attribute [rw] algorithm
153
127
  # @return [Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm]
154
- # Required.
155
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm Algorithm}
156
- # to use when creating a
157
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} based on this
158
- # template.
128
+ # Required. {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm Algorithm} to use
129
+ # when creating a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} based on this template.
159
130
  #
160
131
  # For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both
161
- # this field is omitted and
162
- # {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose} is
132
+ # this field is omitted and {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose} is
163
133
  # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}.
164
134
  class CryptoKeyVersionTemplate; end
165
135
 
166
- # Contains an HSM-generated attestation about a key operation.
136
+ # Contains an HSM-generated attestation about a key operation. For more
137
+ # information, see [Verifying attestations]
138
+ # (https://cloud.google.com/kms/docs/attest-key).
167
139
  # @!attribute [rw] format
168
140
  # @return [Google::Cloud::Kms::V1::KeyOperationAttestation::AttestationFormat]
169
141
  # Output only. The format of the attestation data.
@@ -172,8 +144,9 @@ module Google
172
144
  # Output only. The attestation data provided by the HSM when the key
173
145
  # operation was performed.
174
146
  class KeyOperationAttestation
175
- # Attestion formats provided by the HSM.
147
+ # Attestation formats provided by the HSM.
176
148
  module AttestationFormat
149
+ # Not specified.
177
150
  ATTESTATION_FORMAT_UNSPECIFIED = 0
178
151
 
179
152
  # Cavium HSM attestation compressed with gzip. Note that this format is
@@ -181,84 +154,83 @@ module Google
181
154
  CAVIUM_V1_COMPRESSED = 3
182
155
 
183
156
  # Cavium HSM attestation V2 compressed with gzip. This is a new format
184
- # Introduced in Cavium's version 3.2-08
157
+ # introduced in Cavium's version 3.2-08.
185
158
  CAVIUM_V2_COMPRESSED = 4
186
159
  end
187
160
  end
188
161
 
189
- # A {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} represents an
190
- # individual cryptographic key, and the associated key material.
162
+ # A {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} represents an individual cryptographic key, and the
163
+ # associated key material.
191
164
  #
192
- # An
193
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED}
194
- # version can be used for cryptographic operations.
165
+ # An {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED} version can be
166
+ # used for cryptographic operations.
195
167
  #
196
168
  # For security reasons, the raw cryptographic key material represented by a
197
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} can never be viewed
198
- # or exported. It can only be used to encrypt, decrypt, or sign data when an
199
- # authorized user or application invokes Cloud KMS.
169
+ # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} can never be viewed or exported. It can only be used to
170
+ # encrypt, decrypt, or sign data when an authorized user or application invokes
171
+ # Cloud KMS.
200
172
  # @!attribute [rw] name
201
173
  # @return [String]
202
- # Output only. The resource name for this
203
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} in the format
174
+ # Output only. The resource name for this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} in the format
204
175
  # `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
205
176
  # @!attribute [rw] state
206
177
  # @return [Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState]
207
- # The current state of the
208
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}.
178
+ # The current state of the {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}.
209
179
  # @!attribute [rw] protection_level
210
180
  # @return [Google::Cloud::Kms::V1::ProtectionLevel]
211
- # Output only. The {Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel}
212
- # describing how crypto operations are performed with this
213
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}.
181
+ # Output only. The {Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} describing how crypto operations are
182
+ # performed with this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}.
214
183
  # @!attribute [rw] algorithm
215
184
  # @return [Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm]
216
- # Output only. The
217
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm CryptoKeyVersionAlgorithm}
218
- # that this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}
219
- # supports.
185
+ # Output only. The {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm CryptoKeyVersionAlgorithm} that this
186
+ # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} supports.
220
187
  # @!attribute [rw] attestation
221
188
  # @return [Google::Cloud::Kms::V1::KeyOperationAttestation]
222
189
  # Output only. Statement that was generated and signed by the HSM at key
223
190
  # creation time. Use this statement to verify attributes of the key as stored
224
191
  # on the HSM, independently of Google. Only provided for key versions with
225
- # {Google::Cloud::Kms::V1::CryptoKeyVersion#protection_level protection_level}
226
- # {Google::Cloud::Kms::V1::ProtectionLevel::HSM HSM}.
192
+ # {Google::Cloud::Kms::V1::CryptoKeyVersion#protection_level protection_level} {Google::Cloud::Kms::V1::ProtectionLevel::HSM HSM}.
227
193
  # @!attribute [rw] create_time
228
194
  # @return [Google::Protobuf::Timestamp]
229
- # Output only. The time at which this
230
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} was created.
195
+ # Output only. The time at which this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} was created.
231
196
  # @!attribute [rw] generate_time
232
197
  # @return [Google::Protobuf::Timestamp]
233
- # Output only. The time this
234
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}'s key material was
198
+ # Output only. The time this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}'s key material was
235
199
  # generated.
236
200
  # @!attribute [rw] destroy_time
237
201
  # @return [Google::Protobuf::Timestamp]
238
- # Output only. The time this
239
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}'s key material is
240
- # scheduled for destruction. Only present if
241
- # {Google::Cloud::Kms::V1::CryptoKeyVersion#state state} is
202
+ # Output only. The time this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}'s key material is scheduled
203
+ # for destruction. Only present if {Google::Cloud::Kms::V1::CryptoKeyVersion#state state} is
242
204
  # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROY_SCHEDULED DESTROY_SCHEDULED}.
243
205
  # @!attribute [rw] destroy_event_time
244
206
  # @return [Google::Protobuf::Timestamp]
245
207
  # Output only. The time this CryptoKeyVersion's key material was
246
- # destroyed. Only present if
247
- # {Google::Cloud::Kms::V1::CryptoKeyVersion#state state} is
208
+ # destroyed. Only present if {Google::Cloud::Kms::V1::CryptoKeyVersion#state state} is
248
209
  # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROYED DESTROYED}.
210
+ # @!attribute [rw] import_job
211
+ # @return [String]
212
+ # Output only. The name of the {Google::Cloud::Kms::V1::ImportJob ImportJob} used to import this
213
+ # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. Only present if the underlying key material was
214
+ # imported.
215
+ # @!attribute [rw] import_time
216
+ # @return [Google::Protobuf::Timestamp]
217
+ # Output only. The time at which this {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}'s key material
218
+ # was imported.
219
+ # @!attribute [rw] import_failure_reason
220
+ # @return [String]
221
+ # Output only. The root cause of an import failure. Only present if
222
+ # {Google::Cloud::Kms::V1::CryptoKeyVersion#state state} is
223
+ # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::IMPORT_FAILED IMPORT_FAILED}.
249
224
  class CryptoKeyVersion
250
- # The algorithm of the
251
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, indicating what
225
+ # The algorithm of the {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, indicating what
252
226
  # parameters must be used for each cryptographic operation.
253
227
  #
254
228
  # The
255
229
  # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm::GOOGLE_SYMMETRIC_ENCRYPTION GOOGLE_SYMMETRIC_ENCRYPTION}
256
- # algorithm is usable with
257
- # {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
230
+ # algorithm is usable with {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
258
231
  # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}.
259
232
  #
260
- # Algorithms beginning with "RSA_SIGN_" are usable with
261
- # {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
233
+ # Algorithms beginning with "RSA_SIGN_" are usable with {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
262
234
  # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ASYMMETRIC_SIGN ASYMMETRIC_SIGN}.
263
235
  #
264
236
  # The fields in the name after "RSA_SIGN_" correspond to the following
@@ -276,12 +248,14 @@ module Google
276
248
  # The fields in the name after "RSA_DECRYPT_" correspond to the following
277
249
  # parameters: padding algorithm, modulus bit length, and digest algorithm.
278
250
  #
279
- # Algorithms beginning with "EC_SIGN_" are usable with
280
- # {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
251
+ # Algorithms beginning with "EC_SIGN_" are usable with {Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey#purpose}
281
252
  # {Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ASYMMETRIC_SIGN ASYMMETRIC_SIGN}.
282
253
  #
283
254
  # The fields in the name after "EC_SIGN_" correspond to the following
284
255
  # parameters: elliptic curve, digest algorithm.
256
+ #
257
+ # For more information, see [Key purposes and algorithms]
258
+ # (https://cloud.google.com/kms/docs/algorithms).
285
259
  module CryptoKeyVersionAlgorithm
286
260
  # Not specified.
287
261
  CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED = 0
@@ -298,6 +272,9 @@ module Google
298
272
  # RSASSA-PSS 4096 bit key with a SHA256 digest.
299
273
  RSA_SIGN_PSS_4096_SHA256 = 4
300
274
 
275
+ # RSASSA-PSS 4096 bit key with a SHA512 digest.
276
+ RSA_SIGN_PSS_4096_SHA512 = 15
277
+
301
278
  # RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
302
279
  RSA_SIGN_PKCS1_2048_SHA256 = 5
303
280
 
@@ -307,6 +284,9 @@ module Google
307
284
  # RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
308
285
  RSA_SIGN_PKCS1_4096_SHA256 = 7
309
286
 
287
+ # RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
288
+ RSA_SIGN_PKCS1_4096_SHA512 = 16
289
+
310
290
  # RSAES-OAEP 2048 bit key with a SHA256 digest.
311
291
  RSA_DECRYPT_OAEP_2048_SHA256 = 8
312
292
 
@@ -316,6 +296,9 @@ module Google
316
296
  # RSAES-OAEP 4096 bit key with a SHA256 digest.
317
297
  RSA_DECRYPT_OAEP_4096_SHA256 = 10
318
298
 
299
+ # RSAES-OAEP 4096 bit key with a SHA512 digest.
300
+ RSA_DECRYPT_OAEP_4096_SHA512 = 17
301
+
319
302
  # ECDSA on the NIST P-256 curve with a SHA256 digest.
320
303
  EC_SIGN_P256_SHA256 = 12
321
304
 
@@ -323,26 +306,21 @@ module Google
323
306
  EC_SIGN_P384_SHA384 = 13
324
307
  end
325
308
 
326
- # The state of a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion},
327
- # indicating if it can be used.
309
+ # The state of a {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, indicating if it can be used.
328
310
  module CryptoKeyVersionState
329
311
  # Not specified.
330
312
  CRYPTO_KEY_VERSION_STATE_UNSPECIFIED = 0
331
313
 
332
314
  # This version is still being generated. It may not be used, enabled,
333
315
  # disabled, or destroyed yet. Cloud KMS will automatically mark this
334
- # version
335
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED}
336
- # as soon as the version is ready.
316
+ # version {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED} as soon as the version is ready.
337
317
  PENDING_GENERATION = 5
338
318
 
339
319
  # This version may be used for cryptographic operations.
340
320
  ENABLED = 1
341
321
 
342
322
  # This version may not be used, but the key material is still available,
343
- # and the version can be placed back into the
344
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED}
345
- # state.
323
+ # and the version can be placed back into the {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED} state.
346
324
  DISABLED = 2
347
325
 
348
326
  # This version is destroyed, and the key material is no longer stored.
@@ -352,34 +330,37 @@ module Google
352
330
  # This version is scheduled for destruction, and will be destroyed soon.
353
331
  # Call
354
332
  # {Google::Cloud::Kms::V1::KeyManagementService::RestoreCryptoKeyVersion RestoreCryptoKeyVersion}
355
- # to put it back into the
356
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DISABLED DISABLED}
357
- # state.
333
+ # to put it back into the {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DISABLED DISABLED} state.
358
334
  DESTROY_SCHEDULED = 4
335
+
336
+ # This version is still being imported. It may not be used, enabled,
337
+ # disabled, or destroyed yet. Cloud KMS will automatically mark this
338
+ # version {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::ENABLED ENABLED} as soon as the version is ready.
339
+ PENDING_IMPORT = 6
340
+
341
+ # This version was not imported successfully. It may not be used, enabled,
342
+ # disabled, or destroyed. The submitted key material has been discarded.
343
+ # Additional details can be found in
344
+ # {Google::Cloud::Kms::V1::CryptoKeyVersion#import_failure_reason CryptoKeyVersion#import_failure_reason}.
345
+ IMPORT_FAILED = 7
359
346
  end
360
347
 
361
- # A view for {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}s.
362
- # Controls the level of detail returned for
363
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersions} in
364
- # {Google::Cloud::Kms::V1::KeyManagementService::ListCryptoKeyVersions KeyManagementService::ListCryptoKeyVersions}
365
- # and
348
+ # A view for {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}s. Controls the level of detail returned
349
+ # for {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersions} in
350
+ # {Google::Cloud::Kms::V1::KeyManagementService::ListCryptoKeyVersions KeyManagementService::ListCryptoKeyVersions} and
366
351
  # {Google::Cloud::Kms::V1::KeyManagementService::ListCryptoKeys KeyManagementService::ListCryptoKeys}.
367
352
  module CryptoKeyVersionView
368
- # Default view for each
369
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. Does not
370
- # include the
371
- # {Google::Cloud::Kms::V1::CryptoKeyVersion#attestation attestation} field.
353
+ # Default view for each {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. Does not include
354
+ # the {Google::Cloud::Kms::V1::CryptoKeyVersion#attestation attestation} field.
372
355
  CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED = 0
373
356
 
374
- # Provides all fields in each
375
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, including the
357
+ # Provides all fields in each {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, including the
376
358
  # {Google::Cloud::Kms::V1::CryptoKeyVersion#attestation attestation}.
377
359
  FULL = 1
378
360
  end
379
361
  end
380
362
 
381
- # The public key for a given
382
- # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. Obtained via
363
+ # The public key for a given {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. Obtained via
383
364
  # {Google::Cloud::Kms::V1::KeyManagementService::GetPublicKey GetPublicKey}.
384
365
  # @!attribute [rw] pem
385
366
  # @return [String]
@@ -390,13 +371,141 @@ module Google
390
371
  # (https://tools.ietf.org/html/rfc7468#section-13).
391
372
  # @!attribute [rw] algorithm
392
373
  # @return [Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm]
393
- # The
394
- # {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm Algorithm}
395
- # associated with this key.
374
+ # The {Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm Algorithm} associated
375
+ # with this key.
396
376
  class PublicKey; end
397
377
 
398
- # {Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} specifies how
399
- # cryptographic operations are performed.
378
+ # An {Google::Cloud::Kms::V1::ImportJob ImportJob} can be used to create {Google::Cloud::Kms::V1::CryptoKey CryptoKeys} and
379
+ # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersions} using pre-existing key material,
380
+ # generated outside of Cloud KMS.
381
+ #
382
+ # When an {Google::Cloud::Kms::V1::ImportJob ImportJob} is created, Cloud KMS will generate a "wrapping key",
383
+ # which is a public/private key pair. You use the wrapping key to encrypt (also
384
+ # known as wrap) the pre-existing key material to protect it during the import
385
+ # process. The nature of the wrapping key depends on the choice of
386
+ # {Google::Cloud::Kms::V1::ImportJob#import_method import_method}. When the wrapping key generation
387
+ # is complete, the {Google::Cloud::Kms::V1::ImportJob#state state} will be set to
388
+ # {Google::Cloud::Kms::V1::ImportJob::ImportJobState::ACTIVE ACTIVE} and the {Google::Cloud::Kms::V1::ImportJob#public_key public_key}
389
+ # can be fetched. The fetched public key can then be used to wrap your
390
+ # pre-existing key material.
391
+ #
392
+ # Once the key material is wrapped, it can be imported into a new
393
+ # {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} in an existing {Google::Cloud::Kms::V1::CryptoKey CryptoKey} by calling
394
+ # {Google::Cloud::Kms::V1::KeyManagementService::ImportCryptoKeyVersion ImportCryptoKeyVersion}.
395
+ # Multiple {Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersions} can be imported with a single
396
+ # {Google::Cloud::Kms::V1::ImportJob ImportJob}. Cloud KMS uses the private key portion of the wrapping key to
397
+ # unwrap the key material. Only Cloud KMS has access to the private key.
398
+ #
399
+ # An {Google::Cloud::Kms::V1::ImportJob ImportJob} expires 3 days after it is created. Once expired, Cloud KMS
400
+ # will no longer be able to import or unwrap any key material that was wrapped
401
+ # with the {Google::Cloud::Kms::V1::ImportJob ImportJob}'s public key.
402
+ #
403
+ # For more information, see
404
+ # [Importing a key](https://cloud.google.com/kms/docs/importing-a-key).
405
+ # @!attribute [rw] name
406
+ # @return [String]
407
+ # Output only. The resource name for this {Google::Cloud::Kms::V1::ImportJob ImportJob} in the format
408
+ # `projects/*/locations/*/keyRings/*/importJobs/*`.
409
+ # @!attribute [rw] import_method
410
+ # @return [Google::Cloud::Kms::V1::ImportJob::ImportMethod]
411
+ # Required and immutable. The wrapping method to be used for incoming
412
+ # key material.
413
+ # @!attribute [rw] protection_level
414
+ # @return [Google::Cloud::Kms::V1::ProtectionLevel]
415
+ # Required and immutable. The protection level of the {Google::Cloud::Kms::V1::ImportJob ImportJob}. This
416
+ # must match the
417
+ # {Google::Cloud::Kms::V1::CryptoKeyVersionTemplate#protection_level protection_level} of the
418
+ # {Google::Cloud::Kms::V1::CryptoKey#version_template version_template} on the {Google::Cloud::Kms::V1::CryptoKey CryptoKey} you
419
+ # attempt to import into.
420
+ # @!attribute [rw] create_time
421
+ # @return [Google::Protobuf::Timestamp]
422
+ # Output only. The time at which this {Google::Cloud::Kms::V1::ImportJob ImportJob} was created.
423
+ # @!attribute [rw] generate_time
424
+ # @return [Google::Protobuf::Timestamp]
425
+ # Output only. The time this {Google::Cloud::Kms::V1::ImportJob ImportJob}'s key material was generated.
426
+ # @!attribute [rw] expire_time
427
+ # @return [Google::Protobuf::Timestamp]
428
+ # Output only. The time at which this {Google::Cloud::Kms::V1::ImportJob ImportJob} is scheduled for
429
+ # expiration and can no longer be used to import key material.
430
+ # @!attribute [rw] expire_event_time
431
+ # @return [Google::Protobuf::Timestamp]
432
+ # Output only. The time this {Google::Cloud::Kms::V1::ImportJob ImportJob} expired. Only present if
433
+ # {Google::Cloud::Kms::V1::ImportJob#state state} is {Google::Cloud::Kms::V1::ImportJob::ImportJobState::EXPIRED EXPIRED}.
434
+ # @!attribute [rw] state
435
+ # @return [Google::Cloud::Kms::V1::ImportJob::ImportJobState]
436
+ # Output only. The current state of the {Google::Cloud::Kms::V1::ImportJob ImportJob}, indicating if it can
437
+ # be used.
438
+ # @!attribute [rw] public_key
439
+ # @return [Google::Cloud::Kms::V1::ImportJob::WrappingPublicKey]
440
+ # Output only. The public key with which to wrap key material prior to
441
+ # import. Only returned if {Google::Cloud::Kms::V1::ImportJob#state state} is
442
+ # {Google::Cloud::Kms::V1::ImportJob::ImportJobState::ACTIVE ACTIVE}.
443
+ # @!attribute [rw] attestation
444
+ # @return [Google::Cloud::Kms::V1::KeyOperationAttestation]
445
+ # Output only. Statement that was generated and signed by the key creator
446
+ # (for example, an HSM) at key creation time. Use this statement to verify
447
+ # attributes of the key as stored on the HSM, independently of Google.
448
+ # Only present if the chosen {Google::Cloud::Kms::V1::ImportJob::ImportMethod ImportMethod} is one with a protection
449
+ # level of {Google::Cloud::Kms::V1::ProtectionLevel::HSM HSM}.
450
+ class ImportJob
451
+ # The public key component of the wrapping key. For details of the type of
452
+ # key this public key corresponds to, see the {Google::Cloud::Kms::V1::ImportJob::ImportMethod ImportMethod}.
453
+ # @!attribute [rw] pem
454
+ # @return [String]
455
+ # The public key, encoded in PEM format. For more information, see the [RFC
456
+ # 7468](https://tools.ietf.org/html/rfc7468) sections for [General
457
+ # Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
458
+ # [Textual Encoding of Subject Public Key Info]
459
+ # (https://tools.ietf.org/html/rfc7468#section-13).
460
+ class WrappingPublicKey; end
461
+
462
+ # The state of the {Google::Cloud::Kms::V1::ImportJob ImportJob}, indicating if it can be used.
463
+ module ImportJobState
464
+ # Not specified.
465
+ IMPORT_JOB_STATE_UNSPECIFIED = 0
466
+
467
+ # The wrapping key for this job is still being generated. It may not be
468
+ # used. Cloud KMS will automatically mark this job as
469
+ # {Google::Cloud::Kms::V1::ImportJob::ImportJobState::ACTIVE ACTIVE} as soon as the wrapping key is generated.
470
+ PENDING_GENERATION = 1
471
+
472
+ # This job may be used in
473
+ # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKey CreateCryptoKey} and
474
+ # {Google::Cloud::Kms::V1::KeyManagementService::CreateCryptoKeyVersion CreateCryptoKeyVersion}
475
+ # requests.
476
+ ACTIVE = 2
477
+
478
+ # This job can no longer be used and may not leave this state once entered.
479
+ EXPIRED = 3
480
+ end
481
+
482
+ # {Google::Cloud::Kms::V1::ImportJob::ImportMethod ImportMethod} describes the key wrapping method chosen for this
483
+ # {Google::Cloud::Kms::V1::ImportJob ImportJob}.
484
+ module ImportMethod
485
+ # Not specified.
486
+ IMPORT_METHOD_UNSPECIFIED = 0
487
+
488
+ # This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
489
+ # scheme defined in the PKCS #11 standard. In summary, this involves
490
+ # wrapping the raw key with an ephemeral AES key, and wrapping the
491
+ # ephemeral AES key with a 3072 bit RSA key. For more details, see
492
+ # [RSA AES key wrap
493
+ # mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
494
+ RSA_OAEP_3072_SHA1_AES_256 = 1
495
+
496
+ # This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
497
+ # scheme defined in the PKCS #11 standard. In summary, this involves
498
+ # wrapping the raw key with an ephemeral AES key, and wrapping the
499
+ # ephemeral AES key with a 4096 bit RSA key. For more details, see
500
+ # [RSA AES key wrap
501
+ # mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
502
+ RSA_OAEP_4096_SHA1_AES_256 = 2
503
+ end
504
+ end
505
+
506
+ # {Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} specifies how cryptographic operations are performed.
507
+ # For more information, see [Protection levels]
508
+ # (https://cloud.google.com/kms/docs/algorithms#protection_levels).
400
509
  module ProtectionLevel
401
510
  # Not specified.
402
511
  PROTECTION_LEVEL_UNSPECIFIED = 0