GetKeys

Get the DNSKEY and DS records of DNSSEC-signed managed zones. For more information see the official documentation and API.

Using GetKeys

function getKeys(args: GetKeysArgs, opts?: InvokeOptions): Promise<GetKeysResult>

function  get_keys(managed_zone=None, project=None, opts=None)

func GetKeys(ctx *Context, args *GetKeysArgs, opts ...InvokeOption) (*GetKeysResult, error)

public static class GetKeys {
    public static Task<GetKeysResult> InvokeAsync(GetKeysArgs args, InvokeOptions? opts = null)
}

The following arguments are supported:

ManagedZone string: The name or id of the Cloud DNS managed zone.
Project string: The ID of the project in which the resource belongs. If project is not provided, the provider project is used.

ManagedZone string: The name or id of the Cloud DNS managed zone.
Project string: The ID of the project in which the resource belongs. If project is not provided, the provider project is used.

managedZone string: The name or id of the Cloud DNS managed zone.
project string: The ID of the project in which the resource belongs. If project is not provided, the provider project is used.

managed_zone str: The name or id of the Cloud DNS managed zone.
project str: The ID of the project in which the resource belongs. If project is not provided, the provider project is used.

GetKeys Result

The following output properties are available:

Id string: The provider-assigned unique ID for this managed resource.
KeySigningKeys List<GetKeysKeySigningKey>: A list of Key-signing key (KSK) records. Structure is documented below. Additionally, the DS record is provided:
ManagedZone string
Project string
ZoneSigningKeys List<GetKeysZoneSigningKey>: A list of Zone-signing key (ZSK) records. Structure is documented below.

Id string: The provider-assigned unique ID for this managed resource.
KeySigningKeys []GetKeysKeySigningKey: A list of Key-signing key (KSK) records. Structure is documented below. Additionally, the DS record is provided:
ManagedZone string
Project string
ZoneSigningKeys []GetKeysZoneSigningKey: A list of Zone-signing key (ZSK) records. Structure is documented below.

id string: The provider-assigned unique ID for this managed resource.
keySigningKeys GetKeysKeySigningKey[]: A list of Key-signing key (KSK) records. Structure is documented below. Additionally, the DS record is provided:
managedZone string
project string
zoneSigningKeys GetKeysZoneSigningKey[]: A list of Zone-signing key (ZSK) records. Structure is documented below.

id str: The provider-assigned unique ID for this managed resource.
key_signing_keys List[GetKeysKeySigningKey]: A list of Key-signing key (KSK) records. Structure is documented below. Additionally, the DS record is provided:
managed_zone str
project str
zone_signing_keys List[GetKeysZoneSigningKey]: A list of Zone-signing key (ZSK) records. Structure is documented below.

Supporting Types

GetKeysKeySigningKey

See the output API doc for this type.

Algorithm string: String mnemonic specifying the DNSSEC algorithm of this key. Immutable after creation time. Possible values are ecdsap256sha256, ecdsap384sha384, rsasha1, rsasha256, and rsasha512.
CreationTime string: The time that this resource was created in the control plane. This is in RFC3339 text format.
Description string: A mutable string of at most 1024 characters associated with this resource for the user’s convenience.
Digests List<GetKeysKeySigningKeyDigestArgs>: A list of cryptographic hashes of the DNSKEY resource record associated with this DnsKey. These digests are needed to construct a DS record that points at this DNS key. Each contains: - digest - The base-16 encoded bytes of this digest. Suitable for use in a DS resource record. - type - Specifies the algorithm used to calculate this digest. Possible values are sha1, sha256 and sha384
DsRecord string: The DS record based on the KSK record. This is used when delegating DNSSEC-signed subdomains.
Id string: Unique identifier for the resource; defined by the server.
IsActive bool: Active keys will be used to sign subsequent changes to the ManagedZone. Inactive keys will still be present as DNSKEY Resource Records for the use of resolvers validating existing signatures.
KeyLength int: Length of the key in bits. Specified at creation time then immutable.
KeyTag int: The key tag is a non-cryptographic hash of the a DNSKEY resource record associated with this DnsKey. The key tag can be used to identify a DNSKEY more quickly (but it is not a unique identifier). In particular, the key tag is used in a parent zone’s DS record to point at the DNSKEY in this child ManagedZone. The key tag is a number in the range [0, 65535] and the algorithm to calculate it is specified in RFC4034 Appendix B.
PublicKey string: Base64 encoded public half of this key.

Algorithm string: String mnemonic specifying the DNSSEC algorithm of this key. Immutable after creation time. Possible values are ecdsap256sha256, ecdsap384sha384, rsasha1, rsasha256, and rsasha512.
CreationTime string: The time that this resource was created in the control plane. This is in RFC3339 text format.
Description string: A mutable string of at most 1024 characters associated with this resource for the user’s convenience.
Digests []GetKeysKeySigningKeyDigest: A list of cryptographic hashes of the DNSKEY resource record associated with this DnsKey. These digests are needed to construct a DS record that points at this DNS key. Each contains: - digest - The base-16 encoded bytes of this digest. Suitable for use in a DS resource record. - type - Specifies the algorithm used to calculate this digest. Possible values are sha1, sha256 and sha384
DsRecord string: The DS record based on the KSK record. This is used when delegating DNSSEC-signed subdomains.
Id string: Unique identifier for the resource; defined by the server.
IsActive bool: Active keys will be used to sign subsequent changes to the ManagedZone. Inactive keys will still be present as DNSKEY Resource Records for the use of resolvers validating existing signatures.
KeyLength int: Length of the key in bits. Specified at creation time then immutable.
KeyTag int: The key tag is a non-cryptographic hash of the a DNSKEY resource record associated with this DnsKey. The key tag can be used to identify a DNSKEY more quickly (but it is not a unique identifier). In particular, the key tag is used in a parent zone’s DS record to point at the DNSKEY in this child ManagedZone. The key tag is a number in the range [0, 65535] and the algorithm to calculate it is specified in RFC4034 Appendix B.
PublicKey string: Base64 encoded public half of this key.

algorithm string: String mnemonic specifying the DNSSEC algorithm of this key. Immutable after creation time. Possible values are ecdsap256sha256, ecdsap384sha384, rsasha1, rsasha256, and rsasha512.
creationTime string: The time that this resource was created in the control plane. This is in RFC3339 text format.
description string: A mutable string of at most 1024 characters associated with this resource for the user’s convenience.
digests GetKeysKeySigningKeyDigest[]: A list of cryptographic hashes of the DNSKEY resource record associated with this DnsKey. These digests are needed to construct a DS record that points at this DNS key. Each contains: - digest - The base-16 encoded bytes of this digest. Suitable for use in a DS resource record. - type - Specifies the algorithm used to calculate this digest. Possible values are sha1, sha256 and sha384
dsRecord string: The DS record based on the KSK record. This is used when delegating DNSSEC-signed subdomains.
id string: Unique identifier for the resource; defined by the server.
isActive boolean: Active keys will be used to sign subsequent changes to the ManagedZone. Inactive keys will still be present as DNSKEY Resource Records for the use of resolvers validating existing signatures.
keyLength number: Length of the key in bits. Specified at creation time then immutable.
keyTag number: The key tag is a non-cryptographic hash of the a DNSKEY resource record associated with this DnsKey. The key tag can be used to identify a DNSKEY more quickly (but it is not a unique identifier). In particular, the key tag is used in a parent zone’s DS record to point at the DNSKEY in this child ManagedZone. The key tag is a number in the range [0, 65535] and the algorithm to calculate it is specified in RFC4034 Appendix B.
publicKey string: Base64 encoded public half of this key.

algorithm str: String mnemonic specifying the DNSSEC algorithm of this key. Immutable after creation time. Possible values are ecdsap256sha256, ecdsap384sha384, rsasha1, rsasha256, and rsasha512.
creation_time str: The time that this resource was created in the control plane. This is in RFC3339 text format.
description str: A mutable string of at most 1024 characters associated with this resource for the user’s convenience.
digests List[GetKeysKeySigningKeyDigest]: A list of cryptographic hashes of the DNSKEY resource record associated with this DnsKey. These digests are needed to construct a DS record that points at this DNS key. Each contains: - digest - The base-16 encoded bytes of this digest. Suitable for use in a DS resource record. - type - Specifies the algorithm used to calculate this digest. Possible values are sha1, sha256 and sha384
dsRecord str: The DS record based on the KSK record. This is used when delegating DNSSEC-signed subdomains.
id str: Unique identifier for the resource; defined by the server.
isActive bool: Active keys will be used to sign subsequent changes to the ManagedZone. Inactive keys will still be present as DNSKEY Resource Records for the use of resolvers validating existing signatures.
keyLength float: Length of the key in bits. Specified at creation time then immutable.
keyTag float: The key tag is a non-cryptographic hash of the a DNSKEY resource record associated with this DnsKey. The key tag can be used to identify a DNSKEY more quickly (but it is not a unique identifier). In particular, the key tag is used in a parent zone’s DS record to point at the DNSKEY in this child ManagedZone. The key tag is a number in the range [0, 65535] and the algorithm to calculate it is specified in RFC4034 Appendix B.
public_key str: Base64 encoded public half of this key.

GetKeysKeySigningKeyDigest

See the output API doc for this type.

Digest string
Type string

Digest string
Type string

digest string
type string

digest str
type str

GetKeysZoneSigningKey

See the output API doc for this type.

Algorithm string: String mnemonic specifying the DNSSEC algorithm of this key. Immutable after creation time. Possible values are ecdsap256sha256, ecdsap384sha384, rsasha1, rsasha256, and rsasha512.
CreationTime string: The time that this resource was created in the control plane. This is in RFC3339 text format.
Description string: A mutable string of at most 1024 characters associated with this resource for the user’s convenience.
Digests List<GetKeysZoneSigningKeyDigestArgs>: A list of cryptographic hashes of the DNSKEY resource record associated with this DnsKey. These digests are needed to construct a DS record that points at this DNS key. Each contains: - digest - The base-16 encoded bytes of this digest. Suitable for use in a DS resource record. - type - Specifies the algorithm used to calculate this digest. Possible values are sha1, sha256 and sha384
Id string: Unique identifier for the resource; defined by the server.
IsActive bool: Active keys will be used to sign subsequent changes to the ManagedZone. Inactive keys will still be present as DNSKEY Resource Records for the use of resolvers validating existing signatures.
KeyLength int: Length of the key in bits. Specified at creation time then immutable.
KeyTag int: The key tag is a non-cryptographic hash of the a DNSKEY resource record associated with this DnsKey. The key tag can be used to identify a DNSKEY more quickly (but it is not a unique identifier). In particular, the key tag is used in a parent zone’s DS record to point at the DNSKEY in this child ManagedZone. The key tag is a number in the range [0, 65535] and the algorithm to calculate it is specified in RFC4034 Appendix B.
PublicKey string: Base64 encoded public half of this key.

Algorithm string: String mnemonic specifying the DNSSEC algorithm of this key. Immutable after creation time. Possible values are ecdsap256sha256, ecdsap384sha384, rsasha1, rsasha256, and rsasha512.
CreationTime string: The time that this resource was created in the control plane. This is in RFC3339 text format.
Description string: A mutable string of at most 1024 characters associated with this resource for the user’s convenience.
Digests []GetKeysZoneSigningKeyDigest: A list of cryptographic hashes of the DNSKEY resource record associated with this DnsKey. These digests are needed to construct a DS record that points at this DNS key. Each contains: - digest - The base-16 encoded bytes of this digest. Suitable for use in a DS resource record. - type - Specifies the algorithm used to calculate this digest. Possible values are sha1, sha256 and sha384
Id string: Unique identifier for the resource; defined by the server.
IsActive bool: Active keys will be used to sign subsequent changes to the ManagedZone. Inactive keys will still be present as DNSKEY Resource Records for the use of resolvers validating existing signatures.
KeyLength int: Length of the key in bits. Specified at creation time then immutable.
KeyTag int: The key tag is a non-cryptographic hash of the a DNSKEY resource record associated with this DnsKey. The key tag can be used to identify a DNSKEY more quickly (but it is not a unique identifier). In particular, the key tag is used in a parent zone’s DS record to point at the DNSKEY in this child ManagedZone. The key tag is a number in the range [0, 65535] and the algorithm to calculate it is specified in RFC4034 Appendix B.
PublicKey string: Base64 encoded public half of this key.

algorithm string: String mnemonic specifying the DNSSEC algorithm of this key. Immutable after creation time. Possible values are ecdsap256sha256, ecdsap384sha384, rsasha1, rsasha256, and rsasha512.
creationTime string: The time that this resource was created in the control plane. This is in RFC3339 text format.
description string: A mutable string of at most 1024 characters associated with this resource for the user’s convenience.
digests GetKeysZoneSigningKeyDigest[]: A list of cryptographic hashes of the DNSKEY resource record associated with this DnsKey. These digests are needed to construct a DS record that points at this DNS key. Each contains: - digest - The base-16 encoded bytes of this digest. Suitable for use in a DS resource record. - type - Specifies the algorithm used to calculate this digest. Possible values are sha1, sha256 and sha384
id string: Unique identifier for the resource; defined by the server.
isActive boolean: Active keys will be used to sign subsequent changes to the ManagedZone. Inactive keys will still be present as DNSKEY Resource Records for the use of resolvers validating existing signatures.
keyLength number: Length of the key in bits. Specified at creation time then immutable.
keyTag number: The key tag is a non-cryptographic hash of the a DNSKEY resource record associated with this DnsKey. The key tag can be used to identify a DNSKEY more quickly (but it is not a unique identifier). In particular, the key tag is used in a parent zone’s DS record to point at the DNSKEY in this child ManagedZone. The key tag is a number in the range [0, 65535] and the algorithm to calculate it is specified in RFC4034 Appendix B.
publicKey string: Base64 encoded public half of this key.

algorithm str: String mnemonic specifying the DNSSEC algorithm of this key. Immutable after creation time. Possible values are ecdsap256sha256, ecdsap384sha384, rsasha1, rsasha256, and rsasha512.
creation_time str: The time that this resource was created in the control plane. This is in RFC3339 text format.
description str: A mutable string of at most 1024 characters associated with this resource for the user’s convenience.
digests List[GetKeysZoneSigningKeyDigest]: A list of cryptographic hashes of the DNSKEY resource record associated with this DnsKey. These digests are needed to construct a DS record that points at this DNS key. Each contains: - digest - The base-16 encoded bytes of this digest. Suitable for use in a DS resource record. - type - Specifies the algorithm used to calculate this digest. Possible values are sha1, sha256 and sha384
id str: Unique identifier for the resource; defined by the server.
isActive bool: Active keys will be used to sign subsequent changes to the ManagedZone. Inactive keys will still be present as DNSKEY Resource Records for the use of resolvers validating existing signatures.
keyLength float: Length of the key in bits. Specified at creation time then immutable.
keyTag float: The key tag is a non-cryptographic hash of the a DNSKEY resource record associated with this DnsKey. The key tag can be used to identify a DNSKEY more quickly (but it is not a unique identifier). In particular, the key tag is used in a parent zone’s DS record to point at the DNSKEY in this child ManagedZone. The key tag is a number in the range [0, 65535] and the algorithm to calculate it is specified in RFC4034 Appendix B.
public_key str: Base64 encoded public half of this key.

GetKeysZoneSigningKeyDigest

See the output API doc for this type.

Digest string
Type string

Digest string
Type string

digest string
type string

digest str
type str

Package Details

Repository: https://github.com/pulumi/pulumi-gcp
License: Apache-2.0
Notes: This Pulumi package is based on the google-beta Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud

GetKeys

Using GetKeys

GetKeys Result

Supporting Types

GetKeysKeySigningKey

GetKeysKeySigningKeyDigest

GetKeysZoneSigningKey

GetKeysZoneSigningKeyDigest

Package Details

On This Page