pulumi-gcp 8.0.0a1726253601__py3-none-any.whl → 8.1.0__py3-none-any.whl

pulumi_gcp/iam/workload_identity_pool_provider.py

@@ -31,7 +31,8 @@ class WorkloadIdentityPoolProviderArgs:
                  display_name: Optional[pulumi.Input[str]] = None,
                  oidc: Optional[pulumi.Input['WorkloadIdentityPoolProviderOidcArgs']] = None,
                  project: Optional[pulumi.Input[str]] = None,
-                 saml: Optional[pulumi.Input['WorkloadIdentityPoolProviderSamlArgs']] = None):
+                 saml: Optional[pulumi.Input['WorkloadIdentityPoolProviderSamlArgs']] = None,
+                 x509: Optional[pulumi.Input['WorkloadIdentityPoolProviderX509Args']] = None):
         """
         The set of arguments for constructing a WorkloadIdentityPoolProvider resource.
         :param pulumi.Input[str] workload_identity_pool_id: The ID used for the pool, which is the final component of the pool resource name. This
@@ -111,6 +112,9 @@ class WorkloadIdentityPoolProviderArgs:
                If it is not provided, the provider project is used.
         :param pulumi.Input['WorkloadIdentityPoolProviderSamlArgs'] saml: An SAML 2.0 identity provider. Not compatible with the property oidc or aws.
                Structure is documented below.
+        :param pulumi.Input['WorkloadIdentityPoolProviderX509Args'] x509: An X.509-type identity provider represents a CA. It is trusted to assert a
+               client identity if the client has a certificate that chains up to this CA.
+               Structure is documented below.
         """
         pulumi.set(__self__, "workload_identity_pool_id", workload_identity_pool_id)
         pulumi.set(__self__, "workload_identity_pool_provider_id", workload_identity_pool_provider_id)
@@ -132,6 +136,8 @@ class WorkloadIdentityPoolProviderArgs:
             pulumi.set(__self__, "project", project)
         if saml is not None:
             pulumi.set(__self__, "saml", saml)
+        if x509 is not None:
+            pulumi.set(__self__, "x509", x509)
 
     @property
     @pulumi.getter(name="workloadIdentityPoolId")
@@ -331,6 +337,20 @@ class WorkloadIdentityPoolProviderArgs:
     def saml(self, value: Optional[pulumi.Input['WorkloadIdentityPoolProviderSamlArgs']]):
         pulumi.set(self, "saml", value)
 
+    @property
+    @pulumi.getter
+    def x509(self) -> Optional[pulumi.Input['WorkloadIdentityPoolProviderX509Args']]:
+        """
+        An X.509-type identity provider represents a CA. It is trusted to assert a
+        client identity if the client has a certificate that chains up to this CA.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "x509")
+
+    @x509.setter
+    def x509(self, value: Optional[pulumi.Input['WorkloadIdentityPoolProviderX509Args']]):
+        pulumi.set(self, "x509", value)
+
 
 @pulumi.input_type
 class _WorkloadIdentityPoolProviderState:
@@ -347,7 +367,8 @@ class _WorkloadIdentityPoolProviderState:
                  saml: Optional[pulumi.Input['WorkloadIdentityPoolProviderSamlArgs']] = None,
                  state: Optional[pulumi.Input[str]] = None,
                  workload_identity_pool_id: Optional[pulumi.Input[str]] = None,
-                 workload_identity_pool_provider_id: Optional[pulumi.Input[str]] = None):
+                 workload_identity_pool_provider_id: Optional[pulumi.Input[str]] = None,
+                 x509: Optional[pulumi.Input['WorkloadIdentityPoolProviderX509Args']] = None):
         """
         Input properties used for looking up and filtering WorkloadIdentityPoolProvider resources.
         :param pulumi.Input[str] attribute_condition: [A Common Expression Language](https://opensource.google/projects/cel) expression, in
@@ -436,6 +457,9 @@ class _WorkloadIdentityPoolProviderState:
                
                
                - - -
+        :param pulumi.Input['WorkloadIdentityPoolProviderX509Args'] x509: An X.509-type identity provider represents a CA. It is trusted to assert a
+               client identity if the client has a certificate that chains up to this CA.
+               Structure is documented below.
         """
         if attribute_condition is not None:
             pulumi.set(__self__, "attribute_condition", attribute_condition)
@@ -463,6 +487,8 @@ class _WorkloadIdentityPoolProviderState:
             pulumi.set(__self__, "workload_identity_pool_id", workload_identity_pool_id)
         if workload_identity_pool_provider_id is not None:
             pulumi.set(__self__, "workload_identity_pool_provider_id", workload_identity_pool_provider_id)
+        if x509 is not None:
+            pulumi.set(__self__, "x509", x509)
 
     @property
     @pulumi.getter(name="attributeCondition")
@@ -693,6 +719,20 @@ class _WorkloadIdentityPoolProviderState:
     def workload_identity_pool_provider_id(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "workload_identity_pool_provider_id", value)
 
+    @property
+    @pulumi.getter
+    def x509(self) -> Optional[pulumi.Input['WorkloadIdentityPoolProviderX509Args']]:
+        """
+        An X.509-type identity provider represents a CA. It is trusted to assert a
+        client identity if the client has a certificate that chains up to this CA.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "x509")
+
+    @x509.setter
+    def x509(self, value: Optional[pulumi.Input['WorkloadIdentityPoolProviderX509Args']]):
+        pulumi.set(self, "x509", value)
+
 
 class WorkloadIdentityPoolProvider(pulumi.CustomResource):
     @overload
@@ -710,6 +750,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                  saml: Optional[pulumi.Input[Union['WorkloadIdentityPoolProviderSamlArgs', 'WorkloadIdentityPoolProviderSamlArgsDict']]] = None,
                  workload_identity_pool_id: Optional[pulumi.Input[str]] = None,
                  workload_identity_pool_provider_id: Optional[pulumi.Input[str]] = None,
+                 x509: Optional[pulumi.Input[Union['WorkloadIdentityPoolProviderX509Args', 'WorkloadIdentityPoolProviderX509ArgsDict']]] = None,
                  __props__=None):
         """
         A configuration for an external identity provider.
@@ -882,6 +923,56 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                 "jwks_json": "{\\"keys\\":[{\\"kty\\":\\"RSA\\",\\"alg\\":\\"RS256\\",\\"kid\\":\\"sif0AR-F6MuvksAyAOv-Pds08Bcf2eUMlxE30NofddA\\",\\"use\\":\\"sig\\",\\"e\\":\\"AQAB\\",\\"n\\":\\"ylH1Chl1tpfti3lh51E1g5dPogzXDaQseqjsefGLknaNl5W6Wd4frBhHyE2t41Q5zgz_Ll0-NvWm0FlaG6brhrN9QZu6sJP1bM8WPfJVPgXOanxi7d7TXCkeNubGeiLTf5R3UXtS9Lm_guemU7MxDjDTelxnlgGCihOVTcL526suNJUdfXtpwUsvdU6_ZnAp9IpsuYjCtwPm9hPumlcZGMbxstdh07O4y4O90cVQClJOKSGQjAUCKJWXIQ0cqffGS_HuS_725CPzQ85SzYZzaNpgfhAER7kx_9P16ARM3BJz0PI5fe2hECE61J4GYU_BY43sxDfs7HyJpEXKLU9eWw\\"}]}",
             })
         ```
+        ### Iam Workload Identity Pool Provider X509 Basic
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+        import pulumi_std as std
+
+        pool = gcp.iam.WorkloadIdentityPool("pool", workload_identity_pool_id="example-pool")
+        example = gcp.iam.WorkloadIdentityPoolProvider("example",
+            workload_identity_pool_id=pool.workload_identity_pool_id,
+            workload_identity_pool_provider_id="example-prvdr",
+            attribute_mapping={
+                "google.subject": "assertion.subject.dn.cn",
+            },
+            x509={
+                "trust_store": {
+                    "trust_anchors": [{
+                        "pem_certificate": std.file(input="test-fixtures/trust_anchor.pem").result,
+                    }],
+                },
+            })
+        ```
+        ### Iam Workload Identity Pool Provider X509 Full
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+        import pulumi_std as std
+
+        pool = gcp.iam.WorkloadIdentityPool("pool", workload_identity_pool_id="example-pool")
+        example = gcp.iam.WorkloadIdentityPoolProvider("example",
+            workload_identity_pool_id=pool.workload_identity_pool_id,
+            workload_identity_pool_provider_id="example-prvdr",
+            display_name="Name of provider",
+            description="X.509 identity pool provider for automated test",
+            disabled=True,
+            attribute_mapping={
+                "google.subject": "assertion.subject.dn.cn",
+            },
+            x509={
+                "trust_store": {
+                    "trust_anchors": [{
+                        "pem_certificate": std.file(input="test-fixtures/trust_anchor.pem").result,
+                    }],
+                    "intermediate_cas": [{
+                        "pem_certificate": std.file(input="test-fixtures/intermediate_ca.pem").result,
+                    }],
+                },
+            })
+        ```
 
         ## Import
 
@@ -986,6 +1077,9 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                
                
                - - -
+        :param pulumi.Input[Union['WorkloadIdentityPoolProviderX509Args', 'WorkloadIdentityPoolProviderX509ArgsDict']] x509: An X.509-type identity provider represents a CA. It is trusted to assert a
+               client identity if the client has a certificate that chains up to this CA.
+               Structure is documented below.
         """
         ...
     @overload
@@ -1164,6 +1258,56 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                 "jwks_json": "{\\"keys\\":[{\\"kty\\":\\"RSA\\",\\"alg\\":\\"RS256\\",\\"kid\\":\\"sif0AR-F6MuvksAyAOv-Pds08Bcf2eUMlxE30NofddA\\",\\"use\\":\\"sig\\",\\"e\\":\\"AQAB\\",\\"n\\":\\"ylH1Chl1tpfti3lh51E1g5dPogzXDaQseqjsefGLknaNl5W6Wd4frBhHyE2t41Q5zgz_Ll0-NvWm0FlaG6brhrN9QZu6sJP1bM8WPfJVPgXOanxi7d7TXCkeNubGeiLTf5R3UXtS9Lm_guemU7MxDjDTelxnlgGCihOVTcL526suNJUdfXtpwUsvdU6_ZnAp9IpsuYjCtwPm9hPumlcZGMbxstdh07O4y4O90cVQClJOKSGQjAUCKJWXIQ0cqffGS_HuS_725CPzQ85SzYZzaNpgfhAER7kx_9P16ARM3BJz0PI5fe2hECE61J4GYU_BY43sxDfs7HyJpEXKLU9eWw\\"}]}",
             })
         ```
+        ### Iam Workload Identity Pool Provider X509 Basic
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+        import pulumi_std as std
+
+        pool = gcp.iam.WorkloadIdentityPool("pool", workload_identity_pool_id="example-pool")
+        example = gcp.iam.WorkloadIdentityPoolProvider("example",
+            workload_identity_pool_id=pool.workload_identity_pool_id,
+            workload_identity_pool_provider_id="example-prvdr",
+            attribute_mapping={
+                "google.subject": "assertion.subject.dn.cn",
+            },
+            x509={
+                "trust_store": {
+                    "trust_anchors": [{
+                        "pem_certificate": std.file(input="test-fixtures/trust_anchor.pem").result,
+                    }],
+                },
+            })
+        ```
+        ### Iam Workload Identity Pool Provider X509 Full
+
+        ```python
+        import pulumi
+        import pulumi_gcp as gcp
+        import pulumi_std as std
+
+        pool = gcp.iam.WorkloadIdentityPool("pool", workload_identity_pool_id="example-pool")
+        example = gcp.iam.WorkloadIdentityPoolProvider("example",
+            workload_identity_pool_id=pool.workload_identity_pool_id,
+            workload_identity_pool_provider_id="example-prvdr",
+            display_name="Name of provider",
+            description="X.509 identity pool provider for automated test",
+            disabled=True,
+            attribute_mapping={
+                "google.subject": "assertion.subject.dn.cn",
+            },
+            x509={
+                "trust_store": {
+                    "trust_anchors": [{
+                        "pem_certificate": std.file(input="test-fixtures/trust_anchor.pem").result,
+                    }],
+                    "intermediate_cas": [{
+                        "pem_certificate": std.file(input="test-fixtures/intermediate_ca.pem").result,
+                    }],
+                },
+            })
+        ```
 
         ## Import
 
@@ -1215,6 +1359,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                  saml: Optional[pulumi.Input[Union['WorkloadIdentityPoolProviderSamlArgs', 'WorkloadIdentityPoolProviderSamlArgsDict']]] = None,
                  workload_identity_pool_id: Optional[pulumi.Input[str]] = None,
                  workload_identity_pool_provider_id: Optional[pulumi.Input[str]] = None,
+                 x509: Optional[pulumi.Input[Union['WorkloadIdentityPoolProviderX509Args', 'WorkloadIdentityPoolProviderX509ArgsDict']]] = None,
                  __props__=None):
         opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
         if not isinstance(opts, pulumi.ResourceOptions):
@@ -1239,6 +1384,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
             if workload_identity_pool_provider_id is None and not opts.urn:
                 raise TypeError("Missing required property 'workload_identity_pool_provider_id'")
             __props__.__dict__["workload_identity_pool_provider_id"] = workload_identity_pool_provider_id
+            __props__.__dict__["x509"] = x509
             __props__.__dict__["name"] = None
             __props__.__dict__["state"] = None
         super(WorkloadIdentityPoolProvider, __self__).__init__(
@@ -1263,7 +1409,8 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
             saml: Optional[pulumi.Input[Union['WorkloadIdentityPoolProviderSamlArgs', 'WorkloadIdentityPoolProviderSamlArgsDict']]] = None,
             state: Optional[pulumi.Input[str]] = None,
             workload_identity_pool_id: Optional[pulumi.Input[str]] = None,
-            workload_identity_pool_provider_id: Optional[pulumi.Input[str]] = None) -> 'WorkloadIdentityPoolProvider':
+            workload_identity_pool_provider_id: Optional[pulumi.Input[str]] = None,
+            x509: Optional[pulumi.Input[Union['WorkloadIdentityPoolProviderX509Args', 'WorkloadIdentityPoolProviderX509ArgsDict']]] = None) -> 'WorkloadIdentityPoolProvider':
         """
         Get an existing WorkloadIdentityPoolProvider resource's state with the given name, id, and optional extra
         properties used to qualify the lookup.
@@ -1357,6 +1504,9 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
                
                
                - - -
+        :param pulumi.Input[Union['WorkloadIdentityPoolProviderX509Args', 'WorkloadIdentityPoolProviderX509ArgsDict']] x509: An X.509-type identity provider represents a CA. It is trusted to assert a
+               client identity if the client has a certificate that chains up to this CA.
+               Structure is documented below.
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
 
@@ -1375,6 +1525,7 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
         __props__.__dict__["state"] = state
         __props__.__dict__["workload_identity_pool_id"] = workload_identity_pool_id
         __props__.__dict__["workload_identity_pool_provider_id"] = workload_identity_pool_provider_id
+        __props__.__dict__["x509"] = x509
         return WorkloadIdentityPoolProvider(resource_name, opts=opts, __props__=__props__)
 
     @property
@@ -1554,3 +1705,13 @@ class WorkloadIdentityPoolProvider(pulumi.CustomResource):
         """
         return pulumi.get(self, "workload_identity_pool_provider_id")
 
+    @property
+    @pulumi.getter
+    def x509(self) -> pulumi.Output[Optional['outputs.WorkloadIdentityPoolProviderX509']]:
+        """
+        An X.509-type identity provider represents a CA. It is trusted to assert a
+        client identity if the client has a certificate that chains up to this CA.
+        Structure is documented below.
+        """
+        return pulumi.get(self, "x509")
+

pulumi_gcp/kms/__init__.py

@@ -16,6 +16,8 @@ from .ekm_connection_iam_binding import *
 from .ekm_connection_iam_member import *
 from .ekm_connection_iam_policy import *
 from .get_crypto_key_iam_policy import *
+from .get_crypto_key_latest_version import *
+from .get_crypto_key_versions import *
 from .get_crypto_keys import *
 from .get_ekm_connection_iam_policy import *
 from .get_key_ring_iam_policy import *

pulumi_gcp/kms/autokey_config.py

@@ -174,9 +174,13 @@ class AutokeyConfig(pulumi.CustomResource):
         wait_srv_acc_permissions = time.index.Sleep("wait_srv_acc_permissions", create_duration=10s,
         opts = pulumi.ResourceOptions(depends_on=[autokey_project_admin]))
         example_autokeyconfig = gcp.kms.AutokeyConfig("example-autokeyconfig",
-            folder=autokms_folder.folder_id,
+            folder=autokms_folder.id,
             key_project=key_project.project_id.apply(lambda project_id: f"projects/{project_id}"),
             opts = pulumi.ResourceOptions(depends_on=[wait_srv_acc_permissions]))
+        # Wait delay after setting AutokeyConfig, to prevent diffs on reapply,
+        # because setting the config takes a little to fully propagate.
+        wait_autokey_propagation = time.index.Sleep("wait_autokey_propagation", create_duration=30s,
+        opts = pulumi.ResourceOptions(depends_on=[example_autokeyconfig]))
         ```
 
         ## Import
@@ -264,9 +268,13 @@ class AutokeyConfig(pulumi.CustomResource):
         wait_srv_acc_permissions = time.index.Sleep("wait_srv_acc_permissions", create_duration=10s,
         opts = pulumi.ResourceOptions(depends_on=[autokey_project_admin]))
         example_autokeyconfig = gcp.kms.AutokeyConfig("example-autokeyconfig",
-            folder=autokms_folder.folder_id,
+            folder=autokms_folder.id,
             key_project=key_project.project_id.apply(lambda project_id: f"projects/{project_id}"),
             opts = pulumi.ResourceOptions(depends_on=[wait_srv_acc_permissions]))
+        # Wait delay after setting AutokeyConfig, to prevent diffs on reapply,
+        # because setting the config takes a little to fully propagate.
+        wait_autokey_propagation = time.index.Sleep("wait_autokey_propagation", create_duration=30s,
+        opts = pulumi.ResourceOptions(depends_on=[example_autokeyconfig]))
         ```
 
         ## Import

pulumi_gcp/kms/get_crypto_key_latest_version.py

@@ -0,0 +1,222 @@
+# coding=utf-8
+# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+# *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import copy
+import warnings
+import sys
+import pulumi
+import pulumi.runtime
+from typing import Any, Mapping, Optional, Sequence, Union, overload
+if sys.version_info >= (3, 11):
+    from typing import NotRequired, TypedDict, TypeAlias
+else:
+    from typing_extensions import NotRequired, TypedDict, TypeAlias
+from .. import _utilities
+from . import outputs
+
+__all__ = [
+    'GetCryptoKeyLatestVersionResult',
+    'AwaitableGetCryptoKeyLatestVersionResult',
+    'get_crypto_key_latest_version',
+    'get_crypto_key_latest_version_output',
+]
+
+@pulumi.output_type
+class GetCryptoKeyLatestVersionResult:
+    """
+    A collection of values returned by getCryptoKeyLatestVersion.
+    """
+    def __init__(__self__, algorithm=None, crypto_key=None, filter=None, id=None, name=None, protection_level=None, public_keys=None, state=None, version=None):
+        if algorithm and not isinstance(algorithm, str):
+            raise TypeError("Expected argument 'algorithm' to be a str")
+        pulumi.set(__self__, "algorithm", algorithm)
+        if crypto_key and not isinstance(crypto_key, str):
+            raise TypeError("Expected argument 'crypto_key' to be a str")
+        pulumi.set(__self__, "crypto_key", crypto_key)
+        if filter and not isinstance(filter, str):
+            raise TypeError("Expected argument 'filter' to be a str")
+        pulumi.set(__self__, "filter", filter)
+        if id and not isinstance(id, str):
+            raise TypeError("Expected argument 'id' to be a str")
+        pulumi.set(__self__, "id", id)
+        if name and not isinstance(name, str):
+            raise TypeError("Expected argument 'name' to be a str")
+        pulumi.set(__self__, "name", name)
+        if protection_level and not isinstance(protection_level, str):
+            raise TypeError("Expected argument 'protection_level' to be a str")
+        pulumi.set(__self__, "protection_level", protection_level)
+        if public_keys and not isinstance(public_keys, list):
+            raise TypeError("Expected argument 'public_keys' to be a list")
+        pulumi.set(__self__, "public_keys", public_keys)
+        if state and not isinstance(state, str):
+            raise TypeError("Expected argument 'state' to be a str")
+        pulumi.set(__self__, "state", state)
+        if version and not isinstance(version, int):
+            raise TypeError("Expected argument 'version' to be a int")
+        pulumi.set(__self__, "version", version)
+
+    @property
+    @pulumi.getter
+    def algorithm(self) -> str:
+        """
+        The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
+        """
+        return pulumi.get(self, "algorithm")
+
+    @property
+    @pulumi.getter(name="cryptoKey")
+    def crypto_key(self) -> str:
+        return pulumi.get(self, "crypto_key")
+
+    @property
+    @pulumi.getter
+    def filter(self) -> Optional[str]:
+        return pulumi.get(self, "filter")
+
+    @property
+    @pulumi.getter
+    def id(self) -> str:
+        """
+        The provider-assigned unique ID for this managed resource.
+        """
+        return pulumi.get(self, "id")
+
+    @property
+    @pulumi.getter
+    def name(self) -> str:
+        return pulumi.get(self, "name")
+
+    @property
+    @pulumi.getter(name="protectionLevel")
+    def protection_level(self) -> str:
+        """
+        The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. See the [protection_level reference](https://cloud.google.com/kms/docs/reference/rest/v1/ProtectionLevel) for possible outputs.
+        """
+        return pulumi.get(self, "protection_level")
+
+    @property
+    @pulumi.getter(name="publicKeys")
+    def public_keys(self) -> Sequence['outputs.GetCryptoKeyLatestVersionPublicKeyResult']:
+        """
+        If the enclosing CryptoKey has purpose `ASYMMETRIC_SIGN` or `ASYMMETRIC_DECRYPT`, this block contains details about the public key associated to this CryptoKeyVersion. Structure is documented below.
+        """
+        return pulumi.get(self, "public_keys")
+
+    @property
+    @pulumi.getter
+    def state(self) -> str:
+        """
+        The current state of the latest CryptoKeyVersion. See the [state reference](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys.cryptoKeyVersions#CryptoKeyVersion.CryptoKeyVersionState) for possible outputs.
+        """
+        return pulumi.get(self, "state")
+
+    @property
+    @pulumi.getter
+    def version(self) -> int:
+        return pulumi.get(self, "version")
+
+
+class AwaitableGetCryptoKeyLatestVersionResult(GetCryptoKeyLatestVersionResult):
+    # pylint: disable=using-constant-test
+    def __await__(self):
+        if False:
+            yield self
+        return GetCryptoKeyLatestVersionResult(
+            algorithm=self.algorithm,
+            crypto_key=self.crypto_key,
+            filter=self.filter,
+            id=self.id,
+            name=self.name,
+            protection_level=self.protection_level,
+            public_keys=self.public_keys,
+            state=self.state,
+            version=self.version)
+
+
+def get_crypto_key_latest_version(crypto_key: Optional[str] = None,
+                                  filter: Optional[str] = None,
+                                  opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetCryptoKeyLatestVersionResult:
+    """
+    Provides access to the latest Google Cloud Platform KMS CryptoKeyVersion in a CryptoKey. For more information see
+    [the official documentation](https://cloud.google.com/kms/docs/object-hierarchy#key_version)
+    and
+    [API](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys.cryptoKeyVersions).
+
+    ## Example Usage
+
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_key_ring = gcp.kms.get_kms_key_ring(name="my-key-ring",
+        location="us-central1")
+    my_crypto_key = gcp.kms.get_kms_crypto_key(name="my-crypto-key",
+        key_ring=my_key_ring.id)
+    my_crypto_key_latest_version = gcp.kms.get_crypto_key_latest_version(crypto_key=my_key["id"])
+    ```
+
+
+    :param str crypto_key: The `id` of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the `id` field of the 
+           `kms.CryptoKey` resource/datasource.
+    :param str filter: The filter argument is used to add a filter query parameter that limits which type of cryptoKeyVersion is retrieved as the latest by the data source: ?filter={{filter}}. When no value is provided there is no filtering.
+           
+           Example filter values if filtering on state.
+           
+           * `"state:ENABLED"` will retrieve the latest cryptoKeyVersion that has the state "ENABLED".
+           
+           [See the documentation about using filters](https://cloud.google.com/kms/docs/sorting-and-filtering)
+    """
+    __args__ = dict()
+    __args__['cryptoKey'] = crypto_key
+    __args__['filter'] = filter
+    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
+    __ret__ = pulumi.runtime.invoke('gcp:kms/getCryptoKeyLatestVersion:getCryptoKeyLatestVersion', __args__, opts=opts, typ=GetCryptoKeyLatestVersionResult).value
+
+    return AwaitableGetCryptoKeyLatestVersionResult(
+        algorithm=pulumi.get(__ret__, 'algorithm'),
+        crypto_key=pulumi.get(__ret__, 'crypto_key'),
+        filter=pulumi.get(__ret__, 'filter'),
+        id=pulumi.get(__ret__, 'id'),
+        name=pulumi.get(__ret__, 'name'),
+        protection_level=pulumi.get(__ret__, 'protection_level'),
+        public_keys=pulumi.get(__ret__, 'public_keys'),
+        state=pulumi.get(__ret__, 'state'),
+        version=pulumi.get(__ret__, 'version'))
+
+
+@_utilities.lift_output_func(get_crypto_key_latest_version)
+def get_crypto_key_latest_version_output(crypto_key: Optional[pulumi.Input[str]] = None,
+                                         filter: Optional[pulumi.Input[Optional[str]]] = None,
+                                         opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetCryptoKeyLatestVersionResult]:
+    """
+    Provides access to the latest Google Cloud Platform KMS CryptoKeyVersion in a CryptoKey. For more information see
+    [the official documentation](https://cloud.google.com/kms/docs/object-hierarchy#key_version)
+    and
+    [API](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys.cryptoKeyVersions).
+
+    ## Example Usage
+
+    ```python
+    import pulumi
+    import pulumi_gcp as gcp
+
+    my_key_ring = gcp.kms.get_kms_key_ring(name="my-key-ring",
+        location="us-central1")
+    my_crypto_key = gcp.kms.get_kms_crypto_key(name="my-crypto-key",
+        key_ring=my_key_ring.id)
+    my_crypto_key_latest_version = gcp.kms.get_crypto_key_latest_version(crypto_key=my_key["id"])
+    ```
+
+
+    :param str crypto_key: The `id` of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the `id` field of the 
+           `kms.CryptoKey` resource/datasource.
+    :param str filter: The filter argument is used to add a filter query parameter that limits which type of cryptoKeyVersion is retrieved as the latest by the data source: ?filter={{filter}}. When no value is provided there is no filtering.
+           
+           Example filter values if filtering on state.
+           
+           * `"state:ENABLED"` will retrieve the latest cryptoKeyVersion that has the state "ENABLED".
+           
+           [See the documentation about using filters](https://cloud.google.com/kms/docs/sorting-and-filtering)
+    """
+    ...