pulumi-gcp 7.17.0a1712163201__py3-none-any.whl → 7.17.0a1712602552__py3-none-any.whl

pulumi_gcp/kms/_inputs.py

@@ -16,6 +16,7 @@ __all__ = [
     'CryptoKeyVersionAttestationArgs',
     'CryptoKeyVersionAttestationCertChainsArgs',
     'CryptoKeyVersionAttestationExternalProtectionLevelOptionsArgs',
+    'CryptoKeyVersionExternalProtectionLevelOptionsArgs',
     'CryptoKeyVersionTemplateArgs',
     'EkmConnectionServiceResolverArgs',
     'EkmConnectionServiceResolverServerCertificateArgs',
@@ -209,6 +210,9 @@ class CryptoKeyVersionAttestationArgs:
             pulumi.set(__self__, "cert_chains", cert_chains)
         if content is not None:
             pulumi.set(__self__, "content", content)
+        if external_protection_level_options is not None:
+            warnings.warn("""`externalProtectionLevelOptions` is being un-nested from the `attestation` field. Please use the top level `externalProtectionLevelOptions` field instead.""", DeprecationWarning)
+            pulumi.log.warn("""external_protection_level_options is deprecated: `externalProtectionLevelOptions` is being un-nested from the `attestation` field. Please use the top level `externalProtectionLevelOptions` field instead.""")
         if external_protection_level_options is not None:
             pulumi.set(__self__, "external_protection_level_options", external_protection_level_options)
         if format is not None:
@@ -247,6 +251,9 @@ class CryptoKeyVersionAttestationArgs:
         ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
         Structure is documented below.
         """
+        warnings.warn("""`externalProtectionLevelOptions` is being un-nested from the `attestation` field. Please use the top level `externalProtectionLevelOptions` field instead.""", DeprecationWarning)
+        pulumi.log.warn("""external_protection_level_options is deprecated: `externalProtectionLevelOptions` is being un-nested from the `attestation` field. Please use the top level `externalProtectionLevelOptions` field instead.""")
+
         return pulumi.get(self, "external_protection_level_options")
 
     @external_protection_level_options.setter
@@ -361,6 +368,45 @@ class CryptoKeyVersionAttestationExternalProtectionLevelOptionsArgs:
         pulumi.set(self, "external_key_uri", value)
 
 
+@pulumi.input_type
+class CryptoKeyVersionExternalProtectionLevelOptionsArgs:
+    def __init__(__self__, *,
+                 ekm_connection_key_path: Optional[pulumi.Input[str]] = None,
+                 external_key_uri: Optional[pulumi.Input[str]] = None):
+        """
+        :param pulumi.Input[str] ekm_connection_key_path: The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of externalKeyUri when using an EkmConnection.
+        :param pulumi.Input[str] external_key_uri: The URI for an external resource that this CryptoKeyVersion represents.
+        """
+        if ekm_connection_key_path is not None:
+            pulumi.set(__self__, "ekm_connection_key_path", ekm_connection_key_path)
+        if external_key_uri is not None:
+            pulumi.set(__self__, "external_key_uri", external_key_uri)
+
+    @property
+    @pulumi.getter(name="ekmConnectionKeyPath")
+    def ekm_connection_key_path(self) -> Optional[pulumi.Input[str]]:
+        """
+        The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of externalKeyUri when using an EkmConnection.
+        """
+        return pulumi.get(self, "ekm_connection_key_path")
+
+    @ekm_connection_key_path.setter
+    def ekm_connection_key_path(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "ekm_connection_key_path", value)
+
+    @property
+    @pulumi.getter(name="externalKeyUri")
+    def external_key_uri(self) -> Optional[pulumi.Input[str]]:
+        """
+        The URI for an external resource that this CryptoKeyVersion represents.
+        """
+        return pulumi.get(self, "external_key_uri")
+
+    @external_key_uri.setter
+    def external_key_uri(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "external_key_uri", value)
+
+
 @pulumi.input_type
 class CryptoKeyVersionTemplateArgs:
     def __init__(__self__, *,

pulumi_gcp/kms/crypto_key.py

@@ -17,6 +17,7 @@ __all__ = ['CryptoKeyArgs', 'CryptoKey']
 class CryptoKeyArgs:
     def __init__(__self__, *,
                  key_ring: pulumi.Input[str],
+                 crypto_key_backend: Optional[pulumi.Input[str]] = None,
                  destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
                  import_only: Optional[pulumi.Input[bool]] = None,
                  labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
@@ -32,6 +33,8 @@ class CryptoKeyArgs:
                
                
                - - -
+        :param pulumi.Input[str] crypto_key_backend: The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey.
+               The resource name is in the format "projects/*/locations/*/ekmConnections/*" and only applies to "EXTERNAL_VPC" keys.
         :param pulumi.Input[str] destroy_scheduled_duration: The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
                If not specified at creation time, the default duration is 24 hours.
         :param pulumi.Input[bool] import_only: Whether this key may contain imported versions only.
@@ -54,6 +57,8 @@ class CryptoKeyArgs:
                Structure is documented below.
         """
         pulumi.set(__self__, "key_ring", key_ring)
+        if crypto_key_backend is not None:
+            pulumi.set(__self__, "crypto_key_backend", crypto_key_backend)
         if destroy_scheduled_duration is not None:
             pulumi.set(__self__, "destroy_scheduled_duration", destroy_scheduled_duration)
         if import_only is not None:
@@ -87,6 +92,19 @@ class CryptoKeyArgs:
     def key_ring(self, value: pulumi.Input[str]):
         pulumi.set(self, "key_ring", value)
 
+    @property
+    @pulumi.getter(name="cryptoKeyBackend")
+    def crypto_key_backend(self) -> Optional[pulumi.Input[str]]:
+        """
+        The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey.
+        The resource name is in the format "projects/*/locations/*/ekmConnections/*" and only applies to "EXTERNAL_VPC" keys.
+        """
+        return pulumi.get(self, "crypto_key_backend")
+
+    @crypto_key_backend.setter
+    def crypto_key_backend(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "crypto_key_backend", value)
+
     @property
     @pulumi.getter(name="destroyScheduledDuration")
     def destroy_scheduled_duration(self) -> Optional[pulumi.Input[str]]:
@@ -199,6 +217,7 @@ class CryptoKeyArgs:
 @pulumi.input_type
 class _CryptoKeyState:
     def __init__(__self__, *,
+                 crypto_key_backend: Optional[pulumi.Input[str]] = None,
                  destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
                  effective_labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  import_only: Optional[pulumi.Input[bool]] = None,
@@ -213,6 +232,8 @@ class _CryptoKeyState:
                  version_template: Optional[pulumi.Input['CryptoKeyVersionTemplateArgs']] = None):
         """
         Input properties used for looking up and filtering CryptoKey resources.
+        :param pulumi.Input[str] crypto_key_backend: The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey.
+               The resource name is in the format "projects/*/locations/*/ekmConnections/*" and only applies to "EXTERNAL_VPC" keys.
         :param pulumi.Input[str] destroy_scheduled_duration: The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
                If not specified at creation time, the default duration is 24 hours.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] effective_labels: All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
@@ -245,6 +266,8 @@ class _CryptoKeyState:
         :param pulumi.Input['CryptoKeyVersionTemplateArgs'] version_template: A template describing settings for new crypto key versions.
                Structure is documented below.
         """
+        if crypto_key_backend is not None:
+            pulumi.set(__self__, "crypto_key_backend", crypto_key_backend)
         if destroy_scheduled_duration is not None:
             pulumi.set(__self__, "destroy_scheduled_duration", destroy_scheduled_duration)
         if effective_labels is not None:
@@ -270,6 +293,19 @@ class _CryptoKeyState:
         if version_template is not None:
             pulumi.set(__self__, "version_template", version_template)
 
+    @property
+    @pulumi.getter(name="cryptoKeyBackend")
+    def crypto_key_backend(self) -> Optional[pulumi.Input[str]]:
+        """
+        The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey.
+        The resource name is in the format "projects/*/locations/*/ekmConnections/*" and only applies to "EXTERNAL_VPC" keys.
+        """
+        return pulumi.get(self, "crypto_key_backend")
+
+    @crypto_key_backend.setter
+    def crypto_key_backend(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "crypto_key_backend", value)
+
     @property
     @pulumi.getter(name="destroyScheduledDuration")
     def destroy_scheduled_duration(self) -> Optional[pulumi.Input[str]]:
@@ -439,6 +475,7 @@ class CryptoKey(pulumi.CustomResource):
     def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
+                 crypto_key_backend: Optional[pulumi.Input[str]] = None,
                  destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
                  import_only: Optional[pulumi.Input[bool]] = None,
                  key_ring: Optional[pulumi.Input[str]] = None,
@@ -525,6 +562,8 @@ class CryptoKey(pulumi.CustomResource):
 
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] crypto_key_backend: The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey.
+               The resource name is in the format "projects/*/locations/*/ekmConnections/*" and only applies to "EXTERNAL_VPC" keys.
         :param pulumi.Input[str] destroy_scheduled_duration: The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
                If not specified at creation time, the default duration is 24 hours.
         :param pulumi.Input[bool] import_only: Whether this key may contain imported versions only.
@@ -646,6 +685,7 @@ class CryptoKey(pulumi.CustomResource):
     def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
+                 crypto_key_backend: Optional[pulumi.Input[str]] = None,
                  destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
                  import_only: Optional[pulumi.Input[bool]] = None,
                  key_ring: Optional[pulumi.Input[str]] = None,
@@ -664,6 +704,7 @@ class CryptoKey(pulumi.CustomResource):
                 raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
             __props__ = CryptoKeyArgs.__new__(CryptoKeyArgs)
 
+            __props__.__dict__["crypto_key_backend"] = crypto_key_backend
             __props__.__dict__["destroy_scheduled_duration"] = destroy_scheduled_duration
             __props__.__dict__["import_only"] = import_only
             if key_ring is None and not opts.urn:
@@ -690,6 +731,7 @@ class CryptoKey(pulumi.CustomResource):
     def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
+            crypto_key_backend: Optional[pulumi.Input[str]] = None,
             destroy_scheduled_duration: Optional[pulumi.Input[str]] = None,
             effective_labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             import_only: Optional[pulumi.Input[bool]] = None,
@@ -709,6 +751,8 @@ class CryptoKey(pulumi.CustomResource):
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
+        :param pulumi.Input[str] crypto_key_backend: The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey.
+               The resource name is in the format "projects/*/locations/*/ekmConnections/*" and only applies to "EXTERNAL_VPC" keys.
         :param pulumi.Input[str] destroy_scheduled_duration: The period of time that versions of this key spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
                If not specified at creation time, the default duration is 24 hours.
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] effective_labels: All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
@@ -745,6 +789,7 @@ class CryptoKey(pulumi.CustomResource):
 
         __props__ = _CryptoKeyState.__new__(_CryptoKeyState)
 
+        __props__.__dict__["crypto_key_backend"] = crypto_key_backend
         __props__.__dict__["destroy_scheduled_duration"] = destroy_scheduled_duration
         __props__.__dict__["effective_labels"] = effective_labels
         __props__.__dict__["import_only"] = import_only
@@ -759,6 +804,15 @@ class CryptoKey(pulumi.CustomResource):
         __props__.__dict__["version_template"] = version_template
         return CryptoKey(resource_name, opts=opts, __props__=__props__)
 
+    @property
+    @pulumi.getter(name="cryptoKeyBackend")
+    def crypto_key_backend(self) -> pulumi.Output[str]:
+        """
+        The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey.
+        The resource name is in the format "projects/*/locations/*/ekmConnections/*" and only applies to "EXTERNAL_VPC" keys.
+        """
+        return pulumi.get(self, "crypto_key_backend")
+
     @property
     @pulumi.getter(name="destroyScheduledDuration")
     def destroy_scheduled_duration(self) -> pulumi.Output[str]:

pulumi_gcp/kms/crypto_key_version.py

@@ -17,6 +17,7 @@ __all__ = ['CryptoKeyVersionArgs', 'CryptoKeyVersion']
 class CryptoKeyVersionArgs:
     def __init__(__self__, *,
                  crypto_key: pulumi.Input[str],
+                 external_protection_level_options: Optional[pulumi.Input['CryptoKeyVersionExternalProtectionLevelOptionsArgs']] = None,
                  state: Optional[pulumi.Input[str]] = None):
         """
         The set of arguments for constructing a CryptoKeyVersion resource.
@@ -25,10 +26,14 @@ class CryptoKeyVersionArgs:
                
                
                - - -
+        :param pulumi.Input['CryptoKeyVersionExternalProtectionLevelOptionsArgs'] external_protection_level_options: ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
+               Structure is documented below.
         :param pulumi.Input[str] state: The current state of the CryptoKeyVersion.
                Possible values are: `PENDING_GENERATION`, `ENABLED`, `DISABLED`, `DESTROYED`, `DESTROY_SCHEDULED`, `PENDING_IMPORT`, `IMPORT_FAILED`.
         """
         pulumi.set(__self__, "crypto_key", crypto_key)
+        if external_protection_level_options is not None:
+            pulumi.set(__self__, "external_protection_level_options", external_protection_level_options)
         if state is not None:
             pulumi.set(__self__, "state", state)
 
@@ -48,6 +53,19 @@ class CryptoKeyVersionArgs:
     def crypto_key(self, value: pulumi.Input[str]):
         pulumi.set(self, "crypto_key", value)
 
+    @property
+    @pulumi.getter(name="externalProtectionLevelOptions")
+    def external_protection_level_options(self) -> Optional[pulumi.Input['CryptoKeyVersionExternalProtectionLevelOptionsArgs']]:
+        """
+        ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "external_protection_level_options")
+
+    @external_protection_level_options.setter
+    def external_protection_level_options(self, value: Optional[pulumi.Input['CryptoKeyVersionExternalProtectionLevelOptionsArgs']]):
+        pulumi.set(self, "external_protection_level_options", value)
+
     @property
     @pulumi.getter
     def state(self) -> Optional[pulumi.Input[str]]:
@@ -68,6 +86,7 @@ class _CryptoKeyVersionState:
                  algorithm: Optional[pulumi.Input[str]] = None,
                  attestations: Optional[pulumi.Input[Sequence[pulumi.Input['CryptoKeyVersionAttestationArgs']]]] = None,
                  crypto_key: Optional[pulumi.Input[str]] = None,
+                 external_protection_level_options: Optional[pulumi.Input['CryptoKeyVersionExternalProtectionLevelOptionsArgs']] = None,
                  generate_time: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  protection_level: Optional[pulumi.Input[str]] = None,
@@ -83,6 +102,8 @@ class _CryptoKeyVersionState:
                
                
                - - -
+        :param pulumi.Input['CryptoKeyVersionExternalProtectionLevelOptionsArgs'] external_protection_level_options: ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
+               Structure is documented below.
         :param pulumi.Input[str] generate_time: The time this CryptoKeyVersion key material was generated
         :param pulumi.Input[str] name: The resource name for this CryptoKeyVersion.
         :param pulumi.Input[str] protection_level: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.
@@ -95,6 +116,8 @@ class _CryptoKeyVersionState:
             pulumi.set(__self__, "attestations", attestations)
         if crypto_key is not None:
             pulumi.set(__self__, "crypto_key", crypto_key)
+        if external_protection_level_options is not None:
+            pulumi.set(__self__, "external_protection_level_options", external_protection_level_options)
         if generate_time is not None:
             pulumi.set(__self__, "generate_time", generate_time)
         if name is not None:
@@ -146,6 +169,19 @@ class _CryptoKeyVersionState:
     def crypto_key(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "crypto_key", value)
 
+    @property
+    @pulumi.getter(name="externalProtectionLevelOptions")
+    def external_protection_level_options(self) -> Optional[pulumi.Input['CryptoKeyVersionExternalProtectionLevelOptionsArgs']]:
+        """
+        ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "external_protection_level_options")
+
+    @external_protection_level_options.setter
+    def external_protection_level_options(self, value: Optional[pulumi.Input['CryptoKeyVersionExternalProtectionLevelOptionsArgs']]):
+        pulumi.set(self, "external_protection_level_options", value)
+
     @property
     @pulumi.getter(name="generateTime")
     def generate_time(self) -> Optional[pulumi.Input[str]]:
@@ -202,6 +238,7 @@ class CryptoKeyVersion(pulumi.CustomResource):
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  crypto_key: Optional[pulumi.Input[str]] = None,
+                 external_protection_level_options: Optional[pulumi.Input[pulumi.InputType['CryptoKeyVersionExternalProtectionLevelOptionsArgs']]] = None,
                  state: Optional[pulumi.Input[str]] = None,
                  __props__=None):
         """
@@ -254,6 +291,8 @@ class CryptoKeyVersion(pulumi.CustomResource):
                
                
                - - -
+        :param pulumi.Input[pulumi.InputType['CryptoKeyVersionExternalProtectionLevelOptionsArgs']] external_protection_level_options: ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
+               Structure is documented below.
         :param pulumi.Input[str] state: The current state of the CryptoKeyVersion.
                Possible values are: `PENDING_GENERATION`, `ENABLED`, `DISABLED`, `DESTROYED`, `DESTROY_SCHEDULED`, `PENDING_IMPORT`, `IMPORT_FAILED`.
         """
@@ -322,6 +361,7 @@ class CryptoKeyVersion(pulumi.CustomResource):
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  crypto_key: Optional[pulumi.Input[str]] = None,
+                 external_protection_level_options: Optional[pulumi.Input[pulumi.InputType['CryptoKeyVersionExternalProtectionLevelOptionsArgs']]] = None,
                  state: Optional[pulumi.Input[str]] = None,
                  __props__=None):
         opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
@@ -335,6 +375,7 @@ class CryptoKeyVersion(pulumi.CustomResource):
             if crypto_key is None and not opts.urn:
                 raise TypeError("Missing required property 'crypto_key'")
             __props__.__dict__["crypto_key"] = crypto_key
+            __props__.__dict__["external_protection_level_options"] = external_protection_level_options
             __props__.__dict__["state"] = state
             __props__.__dict__["algorithm"] = None
             __props__.__dict__["attestations"] = None
@@ -354,6 +395,7 @@ class CryptoKeyVersion(pulumi.CustomResource):
             algorithm: Optional[pulumi.Input[str]] = None,
             attestations: Optional[pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['CryptoKeyVersionAttestationArgs']]]]] = None,
             crypto_key: Optional[pulumi.Input[str]] = None,
+            external_protection_level_options: Optional[pulumi.Input[pulumi.InputType['CryptoKeyVersionExternalProtectionLevelOptionsArgs']]] = None,
             generate_time: Optional[pulumi.Input[str]] = None,
             name: Optional[pulumi.Input[str]] = None,
             protection_level: Optional[pulumi.Input[str]] = None,
@@ -374,6 +416,8 @@ class CryptoKeyVersion(pulumi.CustomResource):
                
                
                - - -
+        :param pulumi.Input[pulumi.InputType['CryptoKeyVersionExternalProtectionLevelOptionsArgs']] external_protection_level_options: ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
+               Structure is documented below.
         :param pulumi.Input[str] generate_time: The time this CryptoKeyVersion key material was generated
         :param pulumi.Input[str] name: The resource name for this CryptoKeyVersion.
         :param pulumi.Input[str] protection_level: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion.
@@ -387,6 +431,7 @@ class CryptoKeyVersion(pulumi.CustomResource):
         __props__.__dict__["algorithm"] = algorithm
         __props__.__dict__["attestations"] = attestations
         __props__.__dict__["crypto_key"] = crypto_key
+        __props__.__dict__["external_protection_level_options"] = external_protection_level_options
         __props__.__dict__["generate_time"] = generate_time
         __props__.__dict__["name"] = name
         __props__.__dict__["protection_level"] = protection_level
@@ -423,6 +468,15 @@ class CryptoKeyVersion(pulumi.CustomResource):
         """
         return pulumi.get(self, "crypto_key")
 
+    @property
+    @pulumi.getter(name="externalProtectionLevelOptions")
+    def external_protection_level_options(self) -> pulumi.Output[Optional['outputs.CryptoKeyVersionExternalProtectionLevelOptions']]:
+        """
+        ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "external_protection_level_options")
+
     @property
     @pulumi.getter(name="generateTime")
     def generate_time(self) -> pulumi.Output[str]:

pulumi_gcp/kms/get_kms_crypto_key.py

@@ -22,7 +22,10 @@ class GetKMSCryptoKeyResult:
     """
     A collection of values returned by getKMSCryptoKey.
     """
-    def __init__(__self__, destroy_scheduled_duration=None, effective_labels=None, id=None, import_only=None, key_ring=None, labels=None, name=None, primaries=None, pulumi_labels=None, purpose=None, rotation_period=None, skip_initial_version_creation=None, version_templates=None):
+    def __init__(__self__, crypto_key_backend=None, destroy_scheduled_duration=None, effective_labels=None, id=None, import_only=None, key_ring=None, labels=None, name=None, primaries=None, pulumi_labels=None, purpose=None, rotation_period=None, skip_initial_version_creation=None, version_templates=None):
+        if crypto_key_backend and not isinstance(crypto_key_backend, str):
+            raise TypeError("Expected argument 'crypto_key_backend' to be a str")
+        pulumi.set(__self__, "crypto_key_backend", crypto_key_backend)
         if destroy_scheduled_duration and not isinstance(destroy_scheduled_duration, str):
             raise TypeError("Expected argument 'destroy_scheduled_duration' to be a str")
         pulumi.set(__self__, "destroy_scheduled_duration", destroy_scheduled_duration)
@@ -63,6 +66,11 @@ class GetKMSCryptoKeyResult:
             raise TypeError("Expected argument 'version_templates' to be a list")
         pulumi.set(__self__, "version_templates", version_templates)
 
+    @property
+    @pulumi.getter(name="cryptoKeyBackend")
+    def crypto_key_backend(self) -> str:
+        return pulumi.get(self, "crypto_key_backend")
+
     @property
     @pulumi.getter(name="destroyScheduledDuration")
     def destroy_scheduled_duration(self) -> str:
@@ -146,6 +154,7 @@ class AwaitableGetKMSCryptoKeyResult(GetKMSCryptoKeyResult):
         if False:
             yield self
         return GetKMSCryptoKeyResult(
+            crypto_key_backend=self.crypto_key_backend,
             destroy_scheduled_duration=self.destroy_scheduled_duration,
             effective_labels=self.effective_labels,
             id=self.id,
@@ -199,6 +208,7 @@ def get_kms_crypto_key(key_ring: Optional[str] = None,
     __ret__ = pulumi.runtime.invoke('gcp:kms/getKMSCryptoKey:getKMSCryptoKey', __args__, opts=opts, typ=GetKMSCryptoKeyResult).value
 
     return AwaitableGetKMSCryptoKeyResult(
+        crypto_key_backend=pulumi.get(__ret__, 'crypto_key_backend'),
         destroy_scheduled_duration=pulumi.get(__ret__, 'destroy_scheduled_duration'),
         effective_labels=pulumi.get(__ret__, 'effective_labels'),
         id=pulumi.get(__ret__, 'id'),

pulumi_gcp/kms/outputs.py

@@ -17,6 +17,7 @@ __all__ = [
     'CryptoKeyVersionAttestation',
     'CryptoKeyVersionAttestationCertChains',
     'CryptoKeyVersionAttestationExternalProtectionLevelOptions',
+    'CryptoKeyVersionExternalProtectionLevelOptions',
     'CryptoKeyVersionTemplate',
     'EkmConnectionServiceResolver',
     'EkmConnectionServiceResolverServerCertificate',
@@ -230,6 +231,9 @@ class CryptoKeyVersionAttestation(dict):
         ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.
         Structure is documented below.
         """
+        warnings.warn("""`externalProtectionLevelOptions` is being un-nested from the `attestation` field. Please use the top level `externalProtectionLevelOptions` field instead.""", DeprecationWarning)
+        pulumi.log.warn("""external_protection_level_options is deprecated: `externalProtectionLevelOptions` is being un-nested from the `attestation` field. Please use the top level `externalProtectionLevelOptions` field instead.""")
+
         return pulumi.get(self, "external_protection_level_options")
 
     @property
@@ -356,6 +360,56 @@ class CryptoKeyVersionAttestationExternalProtectionLevelOptions(dict):
         return pulumi.get(self, "external_key_uri")
 
 
+@pulumi.output_type
+class CryptoKeyVersionExternalProtectionLevelOptions(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "ekmConnectionKeyPath":
+            suggest = "ekm_connection_key_path"
+        elif key == "externalKeyUri":
+            suggest = "external_key_uri"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in CryptoKeyVersionExternalProtectionLevelOptions. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        CryptoKeyVersionExternalProtectionLevelOptions.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        CryptoKeyVersionExternalProtectionLevelOptions.__key_warning(key)
+        return super().get(key, default)
+
+    def __init__(__self__, *,
+                 ekm_connection_key_path: Optional[str] = None,
+                 external_key_uri: Optional[str] = None):
+        """
+        :param str ekm_connection_key_path: The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of externalKeyUri when using an EkmConnection.
+        :param str external_key_uri: The URI for an external resource that this CryptoKeyVersion represents.
+        """
+        if ekm_connection_key_path is not None:
+            pulumi.set(__self__, "ekm_connection_key_path", ekm_connection_key_path)
+        if external_key_uri is not None:
+            pulumi.set(__self__, "external_key_uri", external_key_uri)
+
+    @property
+    @pulumi.getter(name="ekmConnectionKeyPath")
+    def ekm_connection_key_path(self) -> Optional[str]:
+        """
+        The path to the external key material on the EKM when using EkmConnection e.g., "v0/my/key". Set this field instead of externalKeyUri when using an EkmConnection.
+        """
+        return pulumi.get(self, "ekm_connection_key_path")
+
+    @property
+    @pulumi.getter(name="externalKeyUri")
+    def external_key_uri(self) -> Optional[str]:
+        """
+        The URI for an external resource that this CryptoKeyVersion represents.
+        """
+        return pulumi.get(self, "external_key_uri")
+
+
 @pulumi.output_type
 class CryptoKeyVersionTemplate(dict):
     @staticmethod

pulumi_gcp/logging/_inputs.py

@@ -204,7 +204,7 @@ class BillingAccountSinkExclusionArgs:
                  description: Optional[pulumi.Input[str]] = None,
                  disabled: Optional[pulumi.Input[bool]] = None):
         """
-        :param pulumi.Input[str] filter: An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100%!o(MISSING)f the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
+        :param pulumi.Input[str] filter: An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100% of the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
                write a filter.
         :param pulumi.Input[str] name: A client-assigned identifier, such as `load-balancer-exclusion`. Identifiers are limited to 100 characters and can include only letters, digits, underscores, hyphens, and periods. First character has to be alphanumeric.
         :param pulumi.Input[str] description: A description of this exclusion.
@@ -221,7 +221,7 @@ class BillingAccountSinkExclusionArgs:
     @pulumi.getter
     def filter(self) -> pulumi.Input[str]:
         """
-        An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100%!o(MISSING)f the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
+        An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100% of the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
         write a filter.
         """
         return pulumi.get(self, "filter")
@@ -436,7 +436,7 @@ class FolderSinkExclusionArgs:
                  description: Optional[pulumi.Input[str]] = None,
                  disabled: Optional[pulumi.Input[bool]] = None):
         """
-        :param pulumi.Input[str] filter: An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100%!o(MISSING)f the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
+        :param pulumi.Input[str] filter: An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100% of the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
                write a filter.
         :param pulumi.Input[str] name: A client-assigned identifier, such as `load-balancer-exclusion`. Identifiers are limited to 100 characters and can include only letters, digits, underscores, hyphens, and periods. First character has to be alphanumeric.
         :param pulumi.Input[str] description: A description of this exclusion.
@@ -453,7 +453,7 @@ class FolderSinkExclusionArgs:
     @pulumi.getter
     def filter(self) -> pulumi.Input[str]:
         """
-        An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100%!o(MISSING)f the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
+        An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100% of the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
         write a filter.
         """
         return pulumi.get(self, "filter")
@@ -1061,7 +1061,7 @@ class OrganizationSinkExclusionArgs:
                  description: Optional[pulumi.Input[str]] = None,
                  disabled: Optional[pulumi.Input[bool]] = None):
         """
-        :param pulumi.Input[str] filter: An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100%!o(MISSING)f the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
+        :param pulumi.Input[str] filter: An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100% of the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
                write a filter.
         :param pulumi.Input[str] name: A client-assigned identifier, such as `load-balancer-exclusion`. Identifiers are limited to 100 characters and can include only letters, digits, underscores, hyphens, and periods. First character has to be alphanumeric.
         :param pulumi.Input[str] description: A description of this exclusion.
@@ -1078,7 +1078,7 @@ class OrganizationSinkExclusionArgs:
     @pulumi.getter
     def filter(self) -> pulumi.Input[str]:
         """
-        An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100%!o(MISSING)f the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
+        An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100% of the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
         write a filter.
         """
         return pulumi.get(self, "filter")
@@ -1293,7 +1293,7 @@ class ProjectSinkExclusionArgs:
                  description: Optional[pulumi.Input[str]] = None,
                  disabled: Optional[pulumi.Input[bool]] = None):
         """
-        :param pulumi.Input[str] filter: An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100%!o(MISSING)f the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
+        :param pulumi.Input[str] filter: An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100% of the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
                write a filter.
         :param pulumi.Input[str] name: A client-assigned identifier, such as `load-balancer-exclusion`. Identifiers are limited to 100 characters and can include only letters, digits, underscores, hyphens, and periods. First character has to be alphanumeric.
         :param pulumi.Input[str] description: A description of this exclusion.
@@ -1310,7 +1310,7 @@ class ProjectSinkExclusionArgs:
     @pulumi.getter
     def filter(self) -> pulumi.Input[str]:
         """
-        An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100%!o(MISSING)f the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
+        An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100% of the matching log entries. See [Advanced Log Filters](https://cloud.google.com/logging/docs/view/advanced_filters) for information on how to
         write a filter.
         """
         return pulumi.get(self, "filter")