google-cloud-storage 1.11.0 → 1.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6df77120a6b6b06e34910f4150a4b4734e9f1ee6055f24dd1dcdcce6852c200a
-  data.tar.gz: d3d9ae16b4cafc4e8d033efa4686ebbeeffbcf70005a34e1804fdf67ea16fb58
+  metadata.gz: 303659292accc44f277af53a486fc796a833b5f9f209923b989d34fd732a03dd
+  data.tar.gz: 6d702f3c6ab49d78dd9fba0b836a7b5ebcd0fc00f80c59fe3a2217e441ed1ab1
 SHA512:
-  metadata.gz: db977a4ee0406302562c8d0d71f6a8a55bea904305a774dc2244898c7c08e3253b98ec77181d425f30a0953f9be693d36e27052b1e22a678bd6e3470b9aacfde
-  data.tar.gz: 827d0709cc5f86a215813a93ce308c354e61f2a9b5bbbd9d087b89776ff9a1818b5f4e34418f976689ea1bd415231b8d73ec870628e8dccd67c82bc71242e363
+  metadata.gz: c9cac290f73ce71a32b26f3a8f293ac12813f08c0494435c47736a0533e94719bcfe8697f33c7234466cc11ce1d5db4227edbb14a9cae537654ae558a6924444
+  data.tar.gz: e7accc00dc59f35e31548767c33a871a2cabfce2ae2a4c13429aaa445e1436a36457911cc032ac162582381cf8ca6769f433c710c923c8ccc9983d9cce30a158

data/lib/google/cloud/storage/bucket.rb

@@ -378,6 +378,54 @@ module Google
           patch_gapi! :billing
         end
 
+        ##
+        # The Cloud KMS encryption key that will be used to protect files.
+        # For example: `projects/a/locations/b/keyRings/c/cryptoKeys/d`
+        #
+        # @return [String, nil] A Cloud KMS encryption key, or `nil` if none
+        #   has been configured.
+        #
+        # @example
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #
+        #   bucket = storage.bucket "my-bucket"
+        #
+        #   # KMS key ring must use the same location as the bucket.
+        #   kms_key_name = "projects/a/locations/b/keyRings/c/cryptoKeys/d"
+        #   bucket.default_kms_key = kms_key_name
+        #
+        #   bucket.default_kms_key #=> kms_key_name
+        #
+        def default_kms_key
+          @gapi.encryption && @gapi.encryption.default_kms_key_name
+        end
+
+        ##
+        # Set the Cloud KMS encryption key that will be used to protect files.
+        # For example: `projects/a/locations/b/keyRings/c/cryptoKeys/d`
+        #
+        # @param [String] new_default_kms_key New Cloud KMS key name
+        #
+        # @example
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #
+        #   bucket = storage.bucket "my-bucket"
+        #
+        #   # KMS key ring must use the same location as the bucket.
+        #   kms_key_name = "projects/a/locations/b/keyRings/c/cryptoKeys/d"
+        #
+        #   bucket.default_kms_key = kms_key_name
+        #
+        def default_kms_key= new_default_kms_key
+          @gapi.encryption = Google::Apis::StorageV1::Bucket::Encryption.new \
+            default_kms_key_name: new_default_kms_key
+          patch_gapi! :encryption
+        end
+
         ##
         # Updates the bucket with changes made in the given block in a single
         # PATCH request. The following attributes may be set: {#cors},
@@ -645,7 +693,15 @@ module Google
         #   Class](https://cloud.google.com/storage/docs/per-object-storage-class).
         #   The default value is the default storage class for the bucket.
         # @param [String] encryption_key Optional. A customer-supplied, AES-256
-        #   encryption key that will be used to encrypt the file.
+        #   encryption key that will be used to encrypt the file. Do not provide
+        #   if `kms_key` is used.
+        # @param [String] kms_key Optional. Resource name of the Cloud KMS
+        #   key, of the form
+        #   `projects/my-prj/locations/kr-loc/keyRings/my-kr/cryptoKeys/my-key`,
+        #   that will be used to encrypt the file. The KMS key ring must use
+        #   the same location as the bucket.The Service Account associated with
+        #   your project requires access to this encryption key. Do not provide
+        #   if `encryption_key` is used.
         #
         # @return [Google::Cloud::Storage::File]
         #
@@ -687,6 +743,22 @@ module Google
         #   file = bucket.file "destination/path/file.ext",
         #                      encryption_key: key
         #
+        # @example Providing a customer-managed Cloud KMS encryption key:
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #
+        #   # KMS key ring must use the same location as the bucket.
+        #   kms_key_name = "projects/a/locations/b/keyRings/c/cryptoKeys/d"
+        #
+        #   bucket.create_file "path/to/local.file.ext",
+        #                      "destination/path/file.ext",
+        #                      kms_key: kms_key_name
+        #
+        #   file = bucket.file "destination/path/file.ext"
+        #   file.kms_key #=> kms_key_name
+        #
         # @example Create a file with gzip-encoded data.
         #   require "zlib"
         #   require "google/cloud/storage"
@@ -717,13 +789,14 @@ module Google
                         content_disposition: nil, content_encoding: nil,
                         content_language: nil, content_type: nil,
                         crc32c: nil, md5: nil, metadata: nil,
-                        storage_class: nil, encryption_key: nil
+                        storage_class: nil, encryption_key: nil, kms_key: nil
           ensure_service!
           options = { acl: File::Acl.predefined_rule_for(acl), md5: md5,
                       cache_control: cache_control, content_type: content_type,
                       content_disposition: content_disposition, crc32c: crc32c,
                       content_encoding: content_encoding, metadata: metadata,
                       content_language: content_language, key: encryption_key,
+                      kms_key: kms_key,
                       storage_class: storage_class_for(storage_class),
                       user_project: user_project }
           ensure_io_or_file_exists! file

data/lib/google/cloud/storage/file.rb

@@ -308,6 +308,23 @@ module Google
           Base64.decode64 @gapi.customer_encryption.key_sha256
         end
 
+        ##
+        # The Cloud KMS encryption key that was used to protect the file, or
+        #   `nil` if none has been configured.
+        #
+        # @see https://cloud.google.com/kms/docs/ Cloud Key Management Service
+        #   Documentation
+        #
+        # @return [String, nil] A Cloud KMS encryption key, or `nil` if none has
+        #   been configured.
+        #
+        # @see https://cloud.google.com/kms/docs/ Cloud Key Management Service
+        #   Documentation
+        #
+        def kms_key
+          @gapi.kms_key_name
+        end
+
         ##
         # The file's storage class. This defines how the file is stored and
         # determines the SLA and the cost of storage. For more information, see
@@ -320,11 +337,16 @@ module Google
         end
 
         ##
-        # Updates how the file is stored and determines the SLA and the cost of
-        # storage. Accepted values include `:multi_regional`, `:regional`,
-        # `:nearline`, and `:coldline`, as well as the equivalent strings
-        # returned by {File#storage_class} or {Bucket#storage_class}. For more
-        # information, see [Storage
+        # Rewrites the file with a new storage class, which determines the SLA
+        # and the cost of storage. Accepted values include:
+        #
+        # * `:multi_regional`
+        # * `:regional`
+        # * `:nearline`
+        # * `:coldline`
+        #
+        # as well as the equivalent strings returned by {File#storage_class} or
+        # {Bucket#storage_class}. For more information, see [Storage
         # Classes](https://cloud.google.com/storage/docs/storage-classes) and
         # [Per-Object Storage
         # Class](https://cloud.google.com/storage/docs/per-object-storage-class).
@@ -718,9 +740,18 @@ module Google
         # @param [String] encryption_key Optional. The customer-supplied,
         #   AES-256 encryption key used to decrypt the file, if the existing
         #   file is encrypted.
-        # @param [String] new_encryption_key Optional. The customer-supplied,
-        #   AES-256 encryption key used to encrypt the file, if the rewritten
-        #   file is intended to be encrypted.
+        # @param [String, nil] new_encryption_key Optional. The new
+        #   customer-supplied, AES-256 encryption key with which to encrypt the
+        #   file. If not provided, the rewritten file will be encrypted using
+        #   the default server-side encryption, or the `new_kms_key` if one is
+        #   provided. Do not provide if `new_kms_key` is used.
+        # @param [String] new_kms_key Optional. Resource name of the Cloud KMS
+        #   key, of the form
+        #   `projects/my-prj/locations/kr-loc/keyRings/my-kr/cryptoKeys/my-key`,
+        #   that will be used to encrypt the file. The KMS key ring must use
+        #   the same location as the bucket.The Service Account associated with
+        #   your project requires access to this encryption key. Do not provide
+        #   if `new_encryption_key` is used.
         # @yield [file] a block yielding a delegate object for updating
         #
         # @return [Google::Cloud::Storage::File]
@@ -770,7 +801,7 @@ module Google
         #     f.metadata["rewritten_from"] = "#{file.bucket}/#{file.name}"
         #   end
         #
-        # @example The file can be rewritten with a new encryption key:
+        # @example Rewriting with a customer-supplied encryption key:
         #   require "google/cloud/storage"
         #
         #   storage = Google::Cloud::Storage.new
@@ -793,9 +824,31 @@ module Google
         #     f.metadata["rewritten_from"] = "#{file.bucket}/#{file.name}"
         #   end
         #
+        # @example Rewriting with a customer-managed Cloud KMS encryption key:
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #
+        #   bucket = storage.bucket "my-bucket"
+        #
+        #   # KMS key ring must use the same location as the bucket.
+        #   kms_key_name = "projects/a/locations/b/keyRings/c/cryptoKeys/d"
+        #
+        #   # Old customer-supplied key was stored securely for later use.
+        #   old_key = "y\x03\"\x0E\xB6\xD3\x9B\x0E\xAB*\x19\xFAv\xDEY\xBEI..."
+        #
+        #   file = bucket.file "path/to/my-file.ext"
+        #   file.rewrite "new-destination-bucket",
+        #                "path/to/destination/file.ext",
+        #                encryption_key: old_key,
+        #                new_kms_key: kms_key_name do |f|
+        #     f.metadata["rewritten_from"] = "#{file.bucket}/#{file.name}"
+        #   end
+        #
         def rewrite dest_bucket_or_path, dest_path = nil,
                     acl: nil, generation: nil,
-                    encryption_key: nil, new_encryption_key: nil
+                    encryption_key: nil, new_encryption_key: nil,
+                    new_kms_key: nil
           ensure_service!
           dest_bucket, dest_path = fix_rewrite_args dest_bucket_or_path,
                                                     dest_path
@@ -815,6 +868,7 @@ module Google
                                   acl: acl, generation: generation,
                                   encryption_key: encryption_key,
                                   new_encryption_key: new_encryption_key,
+                                  new_kms_key: new_kms_key,
                                   user_project: user_project
 
           File.from_gapi new_gapi, service, user_project: user_project
@@ -841,13 +895,20 @@ module Google
         #   if one was used.
         # @param [String, nil] new_encryption_key Optional. The new
         #   customer-supplied, AES-256 encryption key with which to encrypt the
-        #   file. If `nil`, the rewritten file will be encrypted using the
-        #   default server-side encryption, not customer-supplied encryption
-        #   keys.
+        #   file. If not provided, the rewritten file will be encrypted using
+        #   the default server-side encryption, or the `new_kms_key` if one is
+        #   provided. Do not provide if `new_kms_key` is used.
+        # @param [String] new_kms_key Optional. Resource name of the Cloud KMS
+        #   key, of the form
+        #   `projects/my-prj/locations/kr-loc/keyRings/my-kr/cryptoKeys/my-key`,
+        #   that will be used to encrypt the file. The KMS key ring must use
+        #   the same location as the bucket.The Service Account associated with
+        #   your project requires access to this encryption key. Do not provide
+        #   if `new_encryption_key` is used.
         #
         # @return [Google::Cloud::Storage::File]
         #
-        # @example The file will be rewritten with a new encryption key:
+        # @example Rotating to a new customer-supplied encryption key:
         #   require "google/cloud/storage"
         #
         #   storage = Google::Cloud::Storage.new
@@ -865,9 +926,27 @@ module Google
         #
         #   file.rotate encryption_key: old_key, new_encryption_key: new_key
         #
-        def rotate encryption_key: nil, new_encryption_key: nil
+        # @example Rotating to a customer-managed Cloud KMS encryption key:
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #
+        #   # KMS key ring must use the same location as the bucket.
+        #   kms_key_name = "projects/a/locations/b/keyRings/c/cryptoKeys/d"
+        #
+        #   # Old key was stored securely for later use.
+        #   old_key = "y\x03\"\x0E\xB6\xD3\x9B\x0E\xAB*\x19\xFAv\xDEY\xBEI..."
+        #
+        #   file = bucket.file "path/to/my-file.ext", encryption_key: old_key
+        #
+        #   file.rotate encryption_key: old_key, new_kms_key: kms_key_name
+        #
+        def rotate encryption_key: nil, new_encryption_key: nil,
+                   new_kms_key: nil
           rewrite bucket, name, encryption_key: encryption_key,
-                                new_encryption_key: new_encryption_key
+                                new_encryption_key: new_encryption_key,
+                                new_kms_key: new_kms_key
         end
 
         ##
@@ -1233,7 +1312,8 @@ module Google
 
           ensure_service!
 
-          @gapi = if attributes.include? :storage_class
+          rewrite_attrs = %i[storage_class kms_key_name]
+          @gapi = if attributes.any? { |a| rewrite_attrs.include? a }
                     rewrite_gapi \
                       bucket, name, update_gapi, user_project: user_project
                   else
@@ -1254,12 +1334,14 @@ module Google
         def rewrite_gapi bucket, name, updated_gapi,
                          new_bucket: nil, new_name: nil, acl: nil,
                          generation: nil, encryption_key: nil,
-                         new_encryption_key: nil, user_project: nil
+                         new_encryption_key: nil, new_kms_key: nil,
+                         user_project: nil
           new_bucket ||= bucket
           new_name ||= name
           options = { acl: File::Acl.predefined_rule_for(acl),
                       generation: generation, source_key: encryption_key,
                       destination_key: new_encryption_key,
+                      destination_kms_key: new_kms_key,
                       user_project: user_project }.delete_if { |_k, v| v.nil? }
 
           resp = service.rewrite_file \

data/lib/google/cloud/storage/service.rb

@@ -278,7 +278,8 @@ module Google
                         cache_control: nil, content_disposition: nil,
                         content_encoding: nil, content_language: nil,
                         content_type: nil, crc32c: nil, md5: nil, metadata: nil,
-                        storage_class: nil, key: nil, user_project: nil
+                        storage_class: nil, key: nil, kms_key: nil,
+                        user_project: nil
           file_obj = Google::Apis::StorageV1::Object.new(
             { cache_control: cache_control, content_type: content_type,
               content_disposition: content_disposition, md5_hash: md5,
@@ -293,7 +294,7 @@ module Google
               bucket_name, file_obj,
               name: path, predefined_acl: acl, upload_source: source,
               content_encoding: content_encoding, content_type: content_type,
-              user_project: user_project(user_project),
+              kms_key_name: kms_key, user_project: user_project(user_project),
               options: key_options(key)
           end
         end
@@ -316,14 +317,15 @@ module Google
         def rewrite_file source_bucket_name, source_file_path,
                          destination_bucket_name, destination_file_path,
                          file_gapi = nil, source_key: nil, destination_key: nil,
-                         acl: nil, generation: nil, token: nil,
-                         user_project: nil
+                         destination_kms_key: nil, acl: nil, generation: nil,
+                         token: nil, user_project: nil
           key_options = rewrite_key_options source_key, destination_key
           execute do
             service.rewrite_object \
               source_bucket_name, source_file_path,
               destination_bucket_name, destination_file_path,
               file_gapi,
+              destination_kms_key_name: destination_kms_key,
               destination_predefined_acl: acl,
               source_generation: generation,
               rewrite_token: token,

data/lib/google/cloud/storage/version.rb

@@ -16,7 +16,7 @@
 module Google
   module Cloud
     module Storage
-      VERSION = "1.11.0".freeze
+      VERSION = "1.12.0".freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: google-cloud-storage
 version: !ruby/object:Gem::Version
-  version: 1.11.0
+  version: 1.12.0
 platform: ruby
 authors:
 - Mike Moore
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-05-02 00:00:00.000000000 Z
+date: 2018-05-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-cloud-core