pulumi-gcp 7.13.0a1709814369__py3-none-any.whl → 7.14.0a1710186287__py3-none-any.whl

pulumi_gcp/kms/get_key_ring_iam_policy.py

@@ -84,12 +84,14 @@ def get_key_ring_iam_policy(key_ring_id: Optional[str] = None,
 
     ## example
 
+    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
     import pulumi_gcp as gcp
 
     test_key_ring_iam_policy = gcp.kms.get_key_ring_iam_policy(key_ring_id="{project_id}/{location_name}/{key_ring_name}")
     ```
+    <!--End PulumiCodeChooser -->
 
 
     :param str key_ring_id: The key ring ID, in the form
@@ -117,12 +119,14 @@ def get_key_ring_iam_policy_output(key_ring_id: Optional[pulumi.Input[str]] = No
 
     ## example
 
+    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
     import pulumi_gcp as gcp
 
     test_key_ring_iam_policy = gcp.kms.get_key_ring_iam_policy(key_ring_id="{project_id}/{location_name}/{key_ring_name}")
     ```
+    <!--End PulumiCodeChooser -->
 
 
     :param str key_ring_id: The key ring ID, in the form

pulumi_gcp/kms/get_kms_crypto_key.py

@@ -175,6 +175,7 @@ def get_kms_crypto_key(key_ring: Optional[str] = None,
 
     ## Example Usage
 
+    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
     import pulumi_gcp as gcp
@@ -184,6 +185,7 @@ def get_kms_crypto_key(key_ring: Optional[str] = None,
     my_crypto_key = gcp.kms.get_kms_crypto_key(name="my-crypto-key",
         key_ring=my_key_ring.id)
     ```
+    <!--End PulumiCodeChooser -->
 
 
     :param str key_ring: The `id` of the Google Cloud Platform KeyRing to which the key belongs.
@@ -227,6 +229,7 @@ def get_kms_crypto_key_output(key_ring: Optional[pulumi.Input[str]] = None,
 
     ## Example Usage
 
+    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
     import pulumi_gcp as gcp
@@ -236,6 +239,7 @@ def get_kms_crypto_key_output(key_ring: Optional[pulumi.Input[str]] = None,
     my_crypto_key = gcp.kms.get_kms_crypto_key(name="my-crypto-key",
         key_ring=my_key_ring.id)
     ```
+    <!--End PulumiCodeChooser -->
 
 
     :param str key_ring: The `id` of the Google Cloud Platform KeyRing to which the key belongs.

pulumi_gcp/kms/get_kms_crypto_key_version.py

@@ -136,6 +136,7 @@ def get_kms_crypto_key_version(crypto_key: Optional[str] = None,
 
     ## Example Usage
 
+    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
     import pulumi_gcp as gcp
@@ -146,6 +147,7 @@ def get_kms_crypto_key_version(crypto_key: Optional[str] = None,
         key_ring=my_key_ring.id)
     my_crypto_key_version = gcp.kms.get_kms_crypto_key_version(crypto_key=my_key["id"])
     ```
+    <!--End PulumiCodeChooser -->
 
 
     :param str crypto_key: The `id` of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the `id` field of the 
@@ -183,6 +185,7 @@ def get_kms_crypto_key_version_output(crypto_key: Optional[pulumi.Input[str]] =
 
     ## Example Usage
 
+    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
     import pulumi_gcp as gcp
@@ -193,6 +196,7 @@ def get_kms_crypto_key_version_output(crypto_key: Optional[pulumi.Input[str]] =
         key_ring=my_key_ring.id)
     my_crypto_key_version = gcp.kms.get_kms_crypto_key_version(crypto_key=my_key["id"])
     ```
+    <!--End PulumiCodeChooser -->
 
 
     :param str crypto_key: The `id` of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the `id` field of the 

pulumi_gcp/kms/get_kms_key_ring.py

@@ -86,6 +86,7 @@ def get_kms_key_ring(location: Optional[str] = None,
 
     ## Example Usage
 
+    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
     import pulumi_gcp as gcp
@@ -93,6 +94,7 @@ def get_kms_key_ring(location: Optional[str] = None,
     my_key_ring = gcp.kms.get_kms_key_ring(name="my-key-ring",
         location="us-central1")
     ```
+    <!--End PulumiCodeChooser -->
 
 
     :param str location: The Google Cloud Platform location for the KeyRing.
@@ -134,6 +136,7 @@ def get_kms_key_ring_output(location: Optional[pulumi.Input[str]] = None,
 
     ## Example Usage
 
+    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
     import pulumi_gcp as gcp
@@ -141,6 +144,7 @@ def get_kms_key_ring_output(location: Optional[pulumi.Input[str]] = None,
     my_key_ring = gcp.kms.get_kms_key_ring(name="my-key-ring",
         location="us-central1")
     ```
+    <!--End PulumiCodeChooser -->
 
 
     :param str location: The Google Cloud Platform location for the KeyRing.

pulumi_gcp/kms/get_kms_secret.py

@@ -99,6 +99,55 @@ def get_kms_secret(additional_authenticated_data: Optional[str] = None,
     logging output, plan output, or state output.  Please take care to secure your secret
     data outside of resource definitions.
 
+    ## Example Usage
+
+    First, create a KMS KeyRing and CryptoKey using the resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_key_ring = gcp.kms.KeyRing("my_key_ring",
+        project="my-project",
+        name="my-key-ring",
+        location="us-central1")
+    my_crypto_key = gcp.kms.CryptoKey("my_crypto_key",
+        name="my-crypto-key",
+        key_ring=my_key_ring.id)
+    ```
+    <!--End PulumiCodeChooser -->
+
+    Next, use the [Cloud SDK](https://cloud.google.com/sdk/gcloud/reference/kms/encrypt) to encrypt some
+    sensitive information:
+
+    Finally, reference the encrypted ciphertext in your resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+    import pulumi_random as random
+
+    sql_user_password = gcp.kms.get_kms_secret(crypto_key=my_crypto_key["id"],
+        ciphertext="CiQAqD+xX4SXOSziF4a8JYvq4spfAuWhhYSNul33H85HnVtNQW4SOgDu2UZ46dQCRFl5MF6ekabviN8xq+F+2035ZJ85B+xTYXqNf4mZs0RJitnWWuXlYQh6axnnJYu3kDU=")
+    db_name_suffix = random.RandomId("db_name_suffix", byte_length=4)
+    main = gcp.sql.DatabaseInstance("main",
+        name=db_name_suffix.hex.apply(lambda hex: f"main-instance-{hex}"),
+        database_version="MYSQL_5_7",
+        settings=gcp.sql.DatabaseInstanceSettingsArgs(
+            tier="db-f1-micro",
+        ))
+    users = gcp.sql.User("users",
+        name="me",
+        instance=main.name,
+        host="me.com",
+        password=sql_user_password.plaintext)
+    ```
+    <!--End PulumiCodeChooser -->
+
+    This will result in a Cloud SQL user being created with password `my-secret-password`.
+
 
     :param str additional_authenticated_data: The [additional authenticated data](https://cloud.google.com/kms/docs/additional-authenticated-data) used for integrity checks during encryption and decryption.
     :param str ciphertext: The ciphertext to be decrypted, encoded in base64
@@ -138,6 +187,55 @@ def get_kms_secret_output(additional_authenticated_data: Optional[pulumi.Input[O
     logging output, plan output, or state output.  Please take care to secure your secret
     data outside of resource definitions.
 
+    ## Example Usage
+
+    First, create a KMS KeyRing and CryptoKey using the resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_key_ring = gcp.kms.KeyRing("my_key_ring",
+        project="my-project",
+        name="my-key-ring",
+        location="us-central1")
+    my_crypto_key = gcp.kms.CryptoKey("my_crypto_key",
+        name="my-crypto-key",
+        key_ring=my_key_ring.id)
+    ```
+    <!--End PulumiCodeChooser -->
+
+    Next, use the [Cloud SDK](https://cloud.google.com/sdk/gcloud/reference/kms/encrypt) to encrypt some
+    sensitive information:
+
+    Finally, reference the encrypted ciphertext in your resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+    import pulumi_random as random
+
+    sql_user_password = gcp.kms.get_kms_secret(crypto_key=my_crypto_key["id"],
+        ciphertext="CiQAqD+xX4SXOSziF4a8JYvq4spfAuWhhYSNul33H85HnVtNQW4SOgDu2UZ46dQCRFl5MF6ekabviN8xq+F+2035ZJ85B+xTYXqNf4mZs0RJitnWWuXlYQh6axnnJYu3kDU=")
+    db_name_suffix = random.RandomId("db_name_suffix", byte_length=4)
+    main = gcp.sql.DatabaseInstance("main",
+        name=db_name_suffix.hex.apply(lambda hex: f"main-instance-{hex}"),
+        database_version="MYSQL_5_7",
+        settings=gcp.sql.DatabaseInstanceSettingsArgs(
+            tier="db-f1-micro",
+        ))
+    users = gcp.sql.User("users",
+        name="me",
+        instance=main.name,
+        host="me.com",
+        password=sql_user_password.plaintext)
+    ```
+    <!--End PulumiCodeChooser -->
+
+    This will result in a Cloud SQL user being created with password `my-secret-password`.
+
 
     :param str additional_authenticated_data: The [additional authenticated data](https://cloud.google.com/kms/docs/additional-authenticated-data) used for integrity checks during encryption and decryption.
     :param str ciphertext: The ciphertext to be decrypted, encoded in base64

pulumi_gcp/kms/get_kms_secret_asymmetric.py

@@ -91,41 +91,71 @@ def get_kms_secret_asymmetric(ciphertext: Optional[str] = None,
                               crypto_key_version: Optional[str] = None,
                               opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetKMSSecretAsymmetricResult:
     """
-    ## get the public key to encrypt the secret with
-
-    $ gcloud kms keys versions get-public-key 1\\
-      --project my-project\\
-      --location us-central1\\
-      --keyring my-key-ring\\
-      --key my-crypto-key\\
-      --output-file public-key.pem
-
-    ## encrypt secret with the public key
-
-    $ echo -n my-secret-password |\\
-      openssl pkeyutl -in -\\
-        -encrypt\\
-        -pubin\\
-        -inkey public-key.pem\\
-        -pkeyopt rsa_padding_mode:oaep\\
-        -pkeyopt rsa_oaep_md:sha256\\
-        -pkeyopt rsa_mgf1_md:sha256 >\\
-      my-secret-password.enc
-
-    ## base64 encode the ciphertext
-
-    $ openssl base64 -in my-secret-password.enc
-    M7nUoba9EGVTu2LjNjBKGdGVBYjyS/i/AY+4yQMQF0Qf/RfUfX31Jw6+VO9OuThq
-    ylu/7ihX9XD4bM7yYdXnMv9p1OHQUlorSBSbb/J6n1W9UJhcp6um8Tw8/Isx4f75
-    4PskYS6f8Y2ItliGt1/A9iR5BTgGtJBwOxMlgoX2Ggq+Nh4E5SbdoaE5o6CO1nBx
-    eIPsPEebQ6qC4JehQM3IGuV/lrm58+hZhaXAqNzX1cEYyAt5GYqJIVCiI585SUYs
-    wRToGyTgaN+zthF0HP9IWlR4Am4LmJ/1OcePTnYw11CkU8wNRbDzVAzogwNH+rXr
-    LTmf7hxVjBm6bBSVSNFcBKAXFlllubSfIeZ5hgzGqn54OmSf6odO12L5JxllddHc
-    yAd54vWKs2kJtnsKV2V4ZdkI0w6y1TeI67baFZDNGo6qsCpFMPnvv7d46Pg2VOp1
-    J6Ivner0NnNHE4MzNmpZRk8WXMwqq4P/gTiT7F/aCX6oFCUQ4AWPQhJYh2dkcOmL
-    IP+47Veb10aFn61F1CJwpmOOiGNXKdDT1vK8CMnnwhm825K0q/q9Zqpzc1+1ae1z
-    mSqol1zCoa88CuSN6nTLQlVnN/dzfrGbc0boJPaM0iGhHtSzHk4SWg84LhiJB1q9
-    A9XFJmOVdkvRY9nnz/iVLAdd0Q3vFtLqCdUYsNN2yh4=
+    ## Example Usage
+
+    First, create a KMS KeyRing and CryptoKey using the resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_key_ring = gcp.kms.KeyRing("my_key_ring",
+        project="my-project",
+        name="my-key-ring",
+        location="us-central1")
+    my_crypto_key_crypto_key = gcp.kms.CryptoKey("my_crypto_key",
+        name="my-crypto-key",
+        key_ring=my_key_ring.id,
+        purpose="ASYMMETRIC_DECRYPT",
+        version_template=gcp.kms.CryptoKeyVersionTemplateArgs(
+            algorithm="RSA_DECRYPT_OAEP_4096_SHA256",
+        ))
+    my_crypto_key = gcp.kms.get_kms_crypto_key_version_output(crypto_key=my_crypto_key_crypto_key.id)
+    ```
+    <!--End PulumiCodeChooser -->
+
+    Next, use the [Cloud SDK](https://cloud.google.com/kms/docs/encrypt-decrypt-rsa#kms-encrypt-asymmetric-cli) to encrypt
+    some sensitive information:
+
+    Finally, reference the encrypted ciphertext in your resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+    import pulumi_random as random
+
+    sql_user_password = gcp.kms.get_kms_secret_asymmetric(crypto_key_version=my_crypto_key["id"],
+        crc32="12c59e54",
+        ciphertext=\"\"\"    M7nUoba9EGVTu2LjNjBKGdGVBYjyS/i/AY+4yQMQF0Qf/RfUfX31Jw6+VO9OuThq
+        ylu/7ihX9XD4bM7yYdXnMv9p1OHQUlorSBSbb/J6n1W9UJhcp6um8Tw8/Isx4f75
+        4PskYS6f8Y2ItliGt1/A9iR5BTgGtJBwOxMlgoX2Ggq+Nh4E5SbdoaE5o6CO1nBx
+        eIPsPEebQ6qC4JehQM3IGuV/lrm58+hZhaXAqNzX1cEYyAt5GYqJIVCiI585SUYs
+        wRToGyTgaN+zthF0HP9IWlR4Am4LmJ/1OcePTnYw11CkU8wNRbDzVAzogwNH+rXr
+        LTmf7hxVjBm6bBSVSNFcBKAXFlllubSfIeZ5hgzGqn54OmSf6odO12L5JxllddHc
+        yAd54vWKs2kJtnsKV2V4ZdkI0w6y1TeI67baFZDNGo6qsCpFMPnvv7d46Pg2VOp1
+        J6Ivner0NnNHE4MzNmpZRk8WXMwqq4P/gTiT7F/aCX6oFCUQ4AWPQhJYh2dkcOmL
+        IP+47Veb10aFn61F1CJwpmOOiGNXKdDT1vK8CMnnwhm825K0q/q9Zqpzc1+1ae1z
+        mSqol1zCoa88CuSN6nTLQlVnN/dzfrGbc0boJPaM0iGhHtSzHk4SWg84LhiJB1q9
+        A9XFJmOVdkvRY9nnz/iVLAdd0Q3vFtLqCdUYsNN2yh4=
+    \"\"\")
+    db_name_suffix = random.RandomId("db_name_suffix", byte_length=4)
+    main = gcp.sql.DatabaseInstance("main",
+        name=db_name_suffix.hex.apply(lambda hex: f"main-instance-{hex}"),
+        database_version="MYSQL_5_7",
+        settings=gcp.sql.DatabaseInstanceSettingsArgs(
+            tier="db-f1-micro",
+        ))
+    users = gcp.sql.User("users",
+        name="me",
+        instance=main.name,
+        host="me.com",
+        password=sql_user_password_google_kms_secret["plaintext"])
+    ```
+    <!--End PulumiCodeChooser -->
+
+    This will result in a Cloud SQL user being created with password `my-secret-password`.
 
 
     :param str ciphertext: The ciphertext to be decrypted, encoded in base64
@@ -155,41 +185,71 @@ def get_kms_secret_asymmetric_output(ciphertext: Optional[pulumi.Input[str]] = N
                                      crypto_key_version: Optional[pulumi.Input[str]] = None,
                                      opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetKMSSecretAsymmetricResult]:
     """
-    ## get the public key to encrypt the secret with
-
-    $ gcloud kms keys versions get-public-key 1\\
-      --project my-project\\
-      --location us-central1\\
-      --keyring my-key-ring\\
-      --key my-crypto-key\\
-      --output-file public-key.pem
-
-    ## encrypt secret with the public key
-
-    $ echo -n my-secret-password |\\
-      openssl pkeyutl -in -\\
-        -encrypt\\
-        -pubin\\
-        -inkey public-key.pem\\
-        -pkeyopt rsa_padding_mode:oaep\\
-        -pkeyopt rsa_oaep_md:sha256\\
-        -pkeyopt rsa_mgf1_md:sha256 >\\
-      my-secret-password.enc
-
-    ## base64 encode the ciphertext
-
-    $ openssl base64 -in my-secret-password.enc
-    M7nUoba9EGVTu2LjNjBKGdGVBYjyS/i/AY+4yQMQF0Qf/RfUfX31Jw6+VO9OuThq
-    ylu/7ihX9XD4bM7yYdXnMv9p1OHQUlorSBSbb/J6n1W9UJhcp6um8Tw8/Isx4f75
-    4PskYS6f8Y2ItliGt1/A9iR5BTgGtJBwOxMlgoX2Ggq+Nh4E5SbdoaE5o6CO1nBx
-    eIPsPEebQ6qC4JehQM3IGuV/lrm58+hZhaXAqNzX1cEYyAt5GYqJIVCiI585SUYs
-    wRToGyTgaN+zthF0HP9IWlR4Am4LmJ/1OcePTnYw11CkU8wNRbDzVAzogwNH+rXr
-    LTmf7hxVjBm6bBSVSNFcBKAXFlllubSfIeZ5hgzGqn54OmSf6odO12L5JxllddHc
-    yAd54vWKs2kJtnsKV2V4ZdkI0w6y1TeI67baFZDNGo6qsCpFMPnvv7d46Pg2VOp1
-    J6Ivner0NnNHE4MzNmpZRk8WXMwqq4P/gTiT7F/aCX6oFCUQ4AWPQhJYh2dkcOmL
-    IP+47Veb10aFn61F1CJwpmOOiGNXKdDT1vK8CMnnwhm825K0q/q9Zqpzc1+1ae1z
-    mSqol1zCoa88CuSN6nTLQlVnN/dzfrGbc0boJPaM0iGhHtSzHk4SWg84LhiJB1q9
-    A9XFJmOVdkvRY9nnz/iVLAdd0Q3vFtLqCdUYsNN2yh4=
+    ## Example Usage
+
+    First, create a KMS KeyRing and CryptoKey using the resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_key_ring = gcp.kms.KeyRing("my_key_ring",
+        project="my-project",
+        name="my-key-ring",
+        location="us-central1")
+    my_crypto_key_crypto_key = gcp.kms.CryptoKey("my_crypto_key",
+        name="my-crypto-key",
+        key_ring=my_key_ring.id,
+        purpose="ASYMMETRIC_DECRYPT",
+        version_template=gcp.kms.CryptoKeyVersionTemplateArgs(
+            algorithm="RSA_DECRYPT_OAEP_4096_SHA256",
+        ))
+    my_crypto_key = gcp.kms.get_kms_crypto_key_version_output(crypto_key=my_crypto_key_crypto_key.id)
+    ```
+    <!--End PulumiCodeChooser -->
+
+    Next, use the [Cloud SDK](https://cloud.google.com/kms/docs/encrypt-decrypt-rsa#kms-encrypt-asymmetric-cli) to encrypt
+    some sensitive information:
+
+    Finally, reference the encrypted ciphertext in your resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+    import pulumi_random as random
+
+    sql_user_password = gcp.kms.get_kms_secret_asymmetric(crypto_key_version=my_crypto_key["id"],
+        crc32="12c59e54",
+        ciphertext=\"\"\"    M7nUoba9EGVTu2LjNjBKGdGVBYjyS/i/AY+4yQMQF0Qf/RfUfX31Jw6+VO9OuThq
+        ylu/7ihX9XD4bM7yYdXnMv9p1OHQUlorSBSbb/J6n1W9UJhcp6um8Tw8/Isx4f75
+        4PskYS6f8Y2ItliGt1/A9iR5BTgGtJBwOxMlgoX2Ggq+Nh4E5SbdoaE5o6CO1nBx
+        eIPsPEebQ6qC4JehQM3IGuV/lrm58+hZhaXAqNzX1cEYyAt5GYqJIVCiI585SUYs
+        wRToGyTgaN+zthF0HP9IWlR4Am4LmJ/1OcePTnYw11CkU8wNRbDzVAzogwNH+rXr
+        LTmf7hxVjBm6bBSVSNFcBKAXFlllubSfIeZ5hgzGqn54OmSf6odO12L5JxllddHc
+        yAd54vWKs2kJtnsKV2V4ZdkI0w6y1TeI67baFZDNGo6qsCpFMPnvv7d46Pg2VOp1
+        J6Ivner0NnNHE4MzNmpZRk8WXMwqq4P/gTiT7F/aCX6oFCUQ4AWPQhJYh2dkcOmL
+        IP+47Veb10aFn61F1CJwpmOOiGNXKdDT1vK8CMnnwhm825K0q/q9Zqpzc1+1ae1z
+        mSqol1zCoa88CuSN6nTLQlVnN/dzfrGbc0boJPaM0iGhHtSzHk4SWg84LhiJB1q9
+        A9XFJmOVdkvRY9nnz/iVLAdd0Q3vFtLqCdUYsNN2yh4=
+    \"\"\")
+    db_name_suffix = random.RandomId("db_name_suffix", byte_length=4)
+    main = gcp.sql.DatabaseInstance("main",
+        name=db_name_suffix.hex.apply(lambda hex: f"main-instance-{hex}"),
+        database_version="MYSQL_5_7",
+        settings=gcp.sql.DatabaseInstanceSettingsArgs(
+            tier="db-f1-micro",
+        ))
+    users = gcp.sql.User("users",
+        name="me",
+        instance=main.name,
+        host="me.com",
+        password=sql_user_password_google_kms_secret["plaintext"])
+    ```
+    <!--End PulumiCodeChooser -->
+
+    This will result in a Cloud SQL user being created with password `my-secret-password`.
 
 
     :param str ciphertext: The ciphertext to be decrypted, encoded in base64

pulumi_gcp/kms/get_kms_secret_ciphertext.py

@@ -91,6 +91,56 @@ def get_kms_secret_ciphertext(crypto_key: Optional[str] = None,
     logging output, plan output, or state output.  Please take care to secure your secret
     data outside of resource definitions.
 
+    ## Example Usage
+
+    First, create a KMS KeyRing and CryptoKey using the resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_key_ring = gcp.kms.KeyRing("my_key_ring",
+        project="my-project",
+        name="my-key-ring",
+        location="us-central1")
+    my_crypto_key = gcp.kms.CryptoKey("my_crypto_key",
+        name="my-crypto-key",
+        key_ring=my_key_ring.id)
+    ```
+    <!--End PulumiCodeChooser -->
+
+    Next, encrypt some sensitive information and use the encrypted data in your resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_password = gcp.kms.get_kms_secret_ciphertext(crypto_key=my_crypto_key["id"],
+        plaintext="my-secret-password")
+    instance = gcp.compute.Instance("instance",
+        network_interfaces=[gcp.compute.InstanceNetworkInterfaceArgs(
+            access_configs=[gcp.compute.InstanceNetworkInterfaceAccessConfigArgs()],
+            network="default",
+        )],
+        name="test",
+        machine_type="e2-medium",
+        zone="us-central1-a",
+        boot_disk=gcp.compute.InstanceBootDiskArgs(
+            initialize_params=gcp.compute.InstanceBootDiskInitializeParamsArgs(
+                image="debian-cloud/debian-11",
+            ),
+        ),
+        metadata={
+            "password": my_password.ciphertext,
+        })
+    ```
+    <!--End PulumiCodeChooser -->
+
+    The resulting instance can then access the encrypted password from its metadata
+    and decrypt it, e.g. using the [Cloud SDK](https://cloud.google.com/sdk/gcloud/reference/kms/decrypt)):
+
 
     :param str crypto_key: The id of the CryptoKey that will be used to
            encrypt the provided plaintext. This is represented by the format
@@ -128,6 +178,56 @@ def get_kms_secret_ciphertext_output(crypto_key: Optional[pulumi.Input[str]] = N
     logging output, plan output, or state output.  Please take care to secure your secret
     data outside of resource definitions.
 
+    ## Example Usage
+
+    First, create a KMS KeyRing and CryptoKey using the resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_key_ring = gcp.kms.KeyRing("my_key_ring",
+        project="my-project",
+        name="my-key-ring",
+        location="us-central1")
+    my_crypto_key = gcp.kms.CryptoKey("my_crypto_key",
+        name="my-crypto-key",
+        key_ring=my_key_ring.id)
+    ```
+    <!--End PulumiCodeChooser -->
+
+    Next, encrypt some sensitive information and use the encrypted data in your resource definitions:
+
+    <!--Start PulumiCodeChooser -->
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_password = gcp.kms.get_kms_secret_ciphertext(crypto_key=my_crypto_key["id"],
+        plaintext="my-secret-password")
+    instance = gcp.compute.Instance("instance",
+        network_interfaces=[gcp.compute.InstanceNetworkInterfaceArgs(
+            access_configs=[gcp.compute.InstanceNetworkInterfaceAccessConfigArgs()],
+            network="default",
+        )],
+        name="test",
+        machine_type="e2-medium",
+        zone="us-central1-a",
+        boot_disk=gcp.compute.InstanceBootDiskArgs(
+            initialize_params=gcp.compute.InstanceBootDiskInitializeParamsArgs(
+                image="debian-cloud/debian-11",
+            ),
+        ),
+        metadata={
+            "password": my_password.ciphertext,
+        })
+    ```
+    <!--End PulumiCodeChooser -->
+
+    The resulting instance can then access the encrypted password from its metadata
+    and decrypt it, e.g. using the [Cloud SDK](https://cloud.google.com/sdk/gcloud/reference/kms/decrypt)):
+
 
     :param str crypto_key: The id of the CryptoKey that will be used to
            encrypt the provided plaintext. This is represented by the format

pulumi_gcp/kms/key_ring.py

@@ -165,8 +165,10 @@ class KeyRing(pulumi.CustomResource):
             * [Creating a key ring](https://cloud.google.com/kms/docs/creating-keys#create_a_key_ring)
 
         ## Example Usage
+
         ### Kms Key Ring Basic
 
+        <!--Start PulumiCodeChooser -->
         ```python
         import pulumi
         import pulumi_gcp as gcp
@@ -175,18 +177,19 @@ class KeyRing(pulumi.CustomResource):
             name="keyring-example",
             location="global")
         ```
+        <!--End PulumiCodeChooser -->
 
         ## Import
 
         KeyRing can be imported using any of these accepted formats:
 
-         * `projects/{{project}}/locations/{{location}}/keyRings/{{name}}`
+        * `projects/{{project}}/locations/{{location}}/keyRings/{{name}}`
 
-         * `{{project}}/{{location}}/{{name}}`
+        * `{{project}}/{{location}}/{{name}}`
 
-         * `{{location}}/{{name}}`
+        * `{{location}}/{{name}}`
 
-         When using the `pulumi import` command, KeyRing can be imported using one of the formats above. For example:
+        When using the `pulumi import` command, KeyRing can be imported using one of the formats above. For example:
 
         ```sh
         $ pulumi import gcp:kms/keyRing:KeyRing default projects/{{project}}/locations/{{location}}/keyRings/{{name}}
@@ -231,8 +234,10 @@ class KeyRing(pulumi.CustomResource):
             * [Creating a key ring](https://cloud.google.com/kms/docs/creating-keys#create_a_key_ring)
 
         ## Example Usage
+
         ### Kms Key Ring Basic
 
+        <!--Start PulumiCodeChooser -->
         ```python
         import pulumi
         import pulumi_gcp as gcp
@@ -241,18 +246,19 @@ class KeyRing(pulumi.CustomResource):
             name="keyring-example",
             location="global")
         ```
+        <!--End PulumiCodeChooser -->
 
         ## Import
 
         KeyRing can be imported using any of these accepted formats:
 
-         * `projects/{{project}}/locations/{{location}}/keyRings/{{name}}`
+        * `projects/{{project}}/locations/{{location}}/keyRings/{{name}}`
 
-         * `{{project}}/{{location}}/{{name}}`
+        * `{{project}}/{{location}}/{{name}}`
 
-         * `{{location}}/{{name}}`
+        * `{{location}}/{{name}}`
 
-         When using the `pulumi import` command, KeyRing can be imported using one of the formats above. For example:
+        When using the `pulumi import` command, KeyRing can be imported using one of the formats above. For example:
 
         ```sh
         $ pulumi import gcp:kms/keyRing:KeyRing default projects/{{project}}/locations/{{location}}/keyRings/{{name}}