This page documents the language specification for the gcp package. If you're looking for help working with the inputs, outputs, or functions of gcp resources in a Pulumi program, please see the resource documentation for examples and API reference.

kms¶

This provider is a derived work of the Terraform Provider distributed under MPL 2.0. If you encounter a bug or missing feature, first check the pulumi/pulumi-gcp repo; however, if that doesn’t turn up anything, please consult the source terraform-providers/terraform-provider-google repo.

class pulumi_gcp.kms.AwaitableGetKMSCryptoKeyResult(id=None, key_ring=None, labels=None, name=None, purpose=None, rotation_period=None, self_link=None, version_templates=None)¶

class pulumi_gcp.kms.AwaitableGetKMSCryptoKeyVersionResult(algorithm=None, crypto_key=None, id=None, protection_level=None, public_key=None, state=None, version=None)¶

class pulumi_gcp.kms.AwaitableGetKMSKeyRingResult(id=None, location=None, name=None, project=None, self_link=None)¶

class pulumi_gcp.kms.AwaitableGetKMSSecretCiphertextResult(ciphertext=None, crypto_key=None, id=None, plaintext=None)¶

class pulumi_gcp.kms.AwaitableGetKMSSecretResult(additional_authenticated_data=None, ciphertext=None, crypto_key=None, id=None, plaintext=None)¶

class pulumi_gcp.kms.CryptoKey(resource_name, opts=None, key_ring=None, labels=None, name=None, purpose=None, rotation_period=None, version_template=None, __props__=None, __name__=None, __opts__=None)¶

A CryptoKey represents a logical key that can be used for cryptographic operations.

Note: CryptoKeys cannot be deleted from Google Cloud Platform. Destroying a provider-managed CryptoKey will remove it from state and delete all CryptoKeyVersions, rendering the key unusable, but will not delete the resource on the server. When the provider destroys these keys, any data previously encrypted with these keys will be irrecoverable. For this reason, it is strongly recommended that you add lifecycle hooks to the resource to prevent accidental destruction.

To get more information about CryptoKey, see:

API documentation
How-to Guides
- Creating a key

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
example_key = gcp.kms.CryptoKey("example-key",
    key_ring=keyring.id,
    rotation_period="100000s")

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
example_asymmetric_sign_key = gcp.kms.CryptoKey("example-asymmetric-sign-key",
    key_ring=keyring.id,
    purpose="ASYMMETRIC_SIGN",
    version_template={
        "algorithm": "EC_SIGN_P384_SHA384",
    })

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
key_ring (pulumi.Input[str]) – The KeyRing that this key belongs to. Format: 'projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}'.
labels (pulumi.Input[dict]) – Labels with user-defined metadata to apply to this resource.
name (pulumi.Input[str]) – The resource name for the CryptoKey.
purpose (pulumi.Input[str]) – The immutable purpose of this CryptoKey. See the purpose reference for possible inputs.
rotation_period (pulumi.Input[str]) – Every time this period passes, generate a new CryptoKeyVersion and set it as the primary. The first rotation will take place after the specified period. The rotation period has the format of a decimal number with up to 9 fractional digits, followed by the letter s (seconds). It must be greater than a day (ie, 86400).
version_template (pulumi.Input[dict]) – A template describing settings for new crypto key versions. Structure is documented below.

The version_template object supports the following:

algorithm (pulumi.Input[str]) - The algorithm to use when creating a version based on this template. See the algorithm reference for possible inputs.
protectionLevel (pulumi.Input[str]) - The protection level to use when creating a version based on this template.

key_ring: pulumi.Output[str] = None¶: The KeyRing that this key belongs to. Format: 'projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}'.

labels: pulumi.Output[dict] = None¶: Labels with user-defined metadata to apply to this resource.

name: pulumi.Output[str] = None¶: The resource name for the CryptoKey.

purpose: pulumi.Output[str] = None¶: The immutable purpose of this CryptoKey. See the purpose reference for possible inputs.

rotation_period: pulumi.Output[str] = None¶: Every time this period passes, generate a new CryptoKeyVersion and set it as the primary. The first rotation will take place after the specified period. The rotation period has the format of a decimal number with up to 9 fractional digits, followed by the letter s (seconds). It must be greater than a day (ie, 86400).

version_template: pulumi.Output[dict] = None¶

A template describing settings for new crypto key versions. Structure is documented below.

algorithm (str) - The algorithm to use when creating a version based on this template. See the algorithm reference for possible inputs.
protectionLevel (str) - The protection level to use when creating a version based on this template.

static get(resource_name, id, opts=None, key_ring=None, labels=None, name=None, purpose=None, rotation_period=None, self_link=None, version_template=None)¶

Get an existing CryptoKey resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
key_ring (pulumi.Input[str]) – The KeyRing that this key belongs to. Format: 'projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}'.
labels (pulumi.Input[dict]) – Labels with user-defined metadata to apply to this resource.
name (pulumi.Input[str]) – The resource name for the CryptoKey.
purpose (pulumi.Input[str]) –
The immutable purpose of this CryptoKey. See the purpose reference for possible inputs.
rotation_period (pulumi.Input[str]) – Every time this period passes, generate a new CryptoKeyVersion and set it as the primary. The first rotation will take place after the specified period. The rotation period has the format of a decimal number with up to 9 fractional digits, followed by the letter s (seconds). It must be greater than a day (ie, 86400).
version_template (pulumi.Input[dict]) – A template describing settings for new crypto key versions. Structure is documented below.

The version_template object supports the following:

algorithm (pulumi.Input[str]) - The algorithm to use when creating a version based on this template. See the algorithm reference for possible inputs.
protectionLevel (pulumi.Input[str]) - The protection level to use when creating a version based on this template.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

class pulumi_gcp.kms.CryptoKeyIAMBinding(resource_name, opts=None, condition=None, crypto_key_id=None, members=None, role=None, __props__=None, __name__=None, __opts__=None)¶

Three different resources help you manage your IAM policy for KMS crypto key. Each of these resources serves a different use case:

kms.CryptoKeyIAMPolicy: Authoritative. Sets the IAM policy for the crypto key and replaces any existing policy already attached.
kms.CryptoKeyIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the crypto key are preserved.
kms.CryptoKeyIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the crypto key are preserved.

Note: kms.CryptoKeyIAMPolicy cannot be used in conjunction with kms.CryptoKeyIAMBinding and kms.CryptoKeyIAMMember or they will fight over what your policy should be.
Note: kms.CryptoKeyIAMBinding resources can be used in conjunction with kms.CryptoKeyIAMMember resources only if they do not grant privilege to the same role.

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
key = gcp.kms.CryptoKey("key",
    key_ring=keyring.id,
    rotation_period="100000s")
admin = gcp.organizations.get_iam_policy(binding=[{
    "role": "roles/cloudkms.cryptoKeyEncrypter",
    "members": ["user:jane@example.com"],
}])
crypto_key = gcp.kms.CryptoKeyIAMPolicy("cryptoKey",
    crypto_key_id=key.id,
    policy_data=admin.policy_data)

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "condition": {
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
        "title": "expires_after_2019_12_31",
    },
    "members": ["user:jane@example.com"],
    "role": "roles/cloudkms.cryptoKeyEncrypter",
}])

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMBinding("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    members=["user:jane@example.com"])

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMBinding("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
    })

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMMember("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    member="user:jane@example.com")

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMMember("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
    })

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
condition (pulumi.Input[dict]) – An IAM Condition for a given binding. Structure is documented below.
crypto_key_id (pulumi.Input[str]) – The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.
role (pulumi.Input[str]) – The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

The condition object supports the following:

description (pulumi.Input[str]) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (pulumi.Input[str]) - Textual representation of an expression in Common Expression Language syntax.
title (pulumi.Input[str]) - A title for the expression, i.e. a short string describing its purpose.

condition: pulumi.Output[dict] = None¶

An IAM Condition for a given binding. Structure is documented below.

description (str) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (str) - Textual representation of an expression in Common Expression Language syntax.
title (str) - A title for the expression, i.e. a short string describing its purpose.

crypto_key_id: pulumi.Output[str] = None¶: The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.

etag: pulumi.Output[str] = None¶: (Computed) The etag of the project’s IAM policy.

role: pulumi.Output[str] = None¶: The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

static get(resource_name, id, opts=None, condition=None, crypto_key_id=None, etag=None, members=None, role=None)¶

Get an existing CryptoKeyIAMBinding resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
condition (pulumi.Input[dict]) –
An IAM Condition for a given binding. Structure is documented below.
crypto_key_id (pulumi.Input[str]) – The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.
etag (pulumi.Input[str]) – (Computed) The etag of the project’s IAM policy.
role (pulumi.Input[str]) – The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

The condition object supports the following:

description (pulumi.Input[str]) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (pulumi.Input[str]) - Textual representation of an expression in Common Expression Language syntax.
title (pulumi.Input[str]) - A title for the expression, i.e. a short string describing its purpose.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

class pulumi_gcp.kms.CryptoKeyIAMMember(resource_name, opts=None, condition=None, crypto_key_id=None, member=None, role=None, __props__=None, __name__=None, __opts__=None)¶

Three different resources help you manage your IAM policy for KMS crypto key. Each of these resources serves a different use case:

kms.CryptoKeyIAMPolicy: Authoritative. Sets the IAM policy for the crypto key and replaces any existing policy already attached.
kms.CryptoKeyIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the crypto key are preserved.
kms.CryptoKeyIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the crypto key are preserved.

Note: kms.CryptoKeyIAMPolicy cannot be used in conjunction with kms.CryptoKeyIAMBinding and kms.CryptoKeyIAMMember or they will fight over what your policy should be.
Note: kms.CryptoKeyIAMBinding resources can be used in conjunction with kms.CryptoKeyIAMMember resources only if they do not grant privilege to the same role.

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
key = gcp.kms.CryptoKey("key",
    key_ring=keyring.id,
    rotation_period="100000s")
admin = gcp.organizations.get_iam_policy(binding=[{
    "role": "roles/cloudkms.cryptoKeyEncrypter",
    "members": ["user:jane@example.com"],
}])
crypto_key = gcp.kms.CryptoKeyIAMPolicy("cryptoKey",
    crypto_key_id=key.id,
    policy_data=admin.policy_data)

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "condition": {
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
        "title": "expires_after_2019_12_31",
    },
    "members": ["user:jane@example.com"],
    "role": "roles/cloudkms.cryptoKeyEncrypter",
}])

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMBinding("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    members=["user:jane@example.com"])

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMBinding("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
    })

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMMember("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    member="user:jane@example.com")

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMMember("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
    })

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
condition (pulumi.Input[dict]) –
An IAM Condition for a given binding. Structure is documented below.
crypto_key_id (pulumi.Input[str]) – The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.
role (pulumi.Input[str]) – The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

The condition object supports the following:

description (pulumi.Input[str]) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (pulumi.Input[str]) - Textual representation of an expression in Common Expression Language syntax.
title (pulumi.Input[str]) - A title for the expression, i.e. a short string describing its purpose.

condition: pulumi.Output[dict] = None¶

An IAM Condition for a given binding. Structure is documented below.

description (str) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (str) - Textual representation of an expression in Common Expression Language syntax.
title (str) - A title for the expression, i.e. a short string describing its purpose.

crypto_key_id: pulumi.Output[str] = None¶: The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.

etag: pulumi.Output[str] = None¶: (Computed) The etag of the project’s IAM policy.

role: pulumi.Output[str] = None¶: The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

static get(resource_name, id, opts=None, condition=None, crypto_key_id=None, etag=None, member=None, role=None)¶

Get an existing CryptoKeyIAMMember resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
condition (pulumi.Input[dict]) –
An IAM Condition for a given binding. Structure is documented below.
crypto_key_id (pulumi.Input[str]) – The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.
etag (pulumi.Input[str]) – (Computed) The etag of the project’s IAM policy.
role (pulumi.Input[str]) – The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

The condition object supports the following:

description (pulumi.Input[str]) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (pulumi.Input[str]) - Textual representation of an expression in Common Expression Language syntax.
title (pulumi.Input[str]) - A title for the expression, i.e. a short string describing its purpose.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

class pulumi_gcp.kms.CryptoKeyIAMPolicy(resource_name, opts=None, crypto_key_id=None, policy_data=None, __props__=None, __name__=None, __opts__=None)¶

Three different resources help you manage your IAM policy for KMS crypto key. Each of these resources serves a different use case:

kms.CryptoKeyIAMPolicy: Authoritative. Sets the IAM policy for the crypto key and replaces any existing policy already attached.
kms.CryptoKeyIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the crypto key are preserved.
kms.CryptoKeyIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the crypto key are preserved.

Note: kms.CryptoKeyIAMPolicy cannot be used in conjunction with kms.CryptoKeyIAMBinding and kms.CryptoKeyIAMMember or they will fight over what your policy should be.
Note: kms.CryptoKeyIAMBinding resources can be used in conjunction with kms.CryptoKeyIAMMember resources only if they do not grant privilege to the same role.

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
key = gcp.kms.CryptoKey("key",
    key_ring=keyring.id,
    rotation_period="100000s")
admin = gcp.organizations.get_iam_policy(binding=[{
    "role": "roles/cloudkms.cryptoKeyEncrypter",
    "members": ["user:jane@example.com"],
}])
crypto_key = gcp.kms.CryptoKeyIAMPolicy("cryptoKey",
    crypto_key_id=key.id,
    policy_data=admin.policy_data)

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "condition": {
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
        "title": "expires_after_2019_12_31",
    },
    "members": ["user:jane@example.com"],
    "role": "roles/cloudkms.cryptoKeyEncrypter",
}])

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMBinding("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    members=["user:jane@example.com"])

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMBinding("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
    })

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMMember("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    member="user:jane@example.com")

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMMember("cryptoKey",
    crypto_key_id=google_kms_crypto_key["key"]["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
    })

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
crypto_key_id (pulumi.Input[str]) – The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.
policy_data (pulumi.Input[str]) – The policy data generated by a organizations.getIAMPolicy data source.

crypto_key_id: pulumi.Output[str] = None¶: The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.

etag: pulumi.Output[str] = None¶: (Computed) The etag of the project’s IAM policy.

policy_data: pulumi.Output[str] = None¶: The policy data generated by a organizations.getIAMPolicy data source.

static get(resource_name, id, opts=None, crypto_key_id=None, etag=None, policy_data=None)¶

Get an existing CryptoKeyIAMPolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
crypto_key_id (pulumi.Input[str]) – The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.
etag (pulumi.Input[str]) – (Computed) The etag of the project’s IAM policy.
policy_data (pulumi.Input[str]) – The policy data generated by a organizations.getIAMPolicy data source.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

class pulumi_gcp.kms.GetKMSCryptoKeyResult(id=None, key_ring=None, labels=None, name=None, purpose=None, rotation_period=None, self_link=None, version_templates=None)¶

A collection of values returned by getKMSCryptoKey.

id = None¶: The provider-assigned unique ID for this managed resource.

purpose = None¶: Defines the cryptographic capabilities of the key.

rotation_period = None¶: Every time this period passes, generate a new CryptoKeyVersion and set it as the primary. The first rotation will take place after the specified period. The rotation period has the format of a decimal number with up to 9 fractional digits, followed by the letter s (seconds).

self_link = None¶: The self link of the created CryptoKey. Its format is projects/{projectId}/locations/{location}/keyRings/{keyRingName}/cryptoKeys/{cryptoKeyName}.

class pulumi_gcp.kms.GetKMSCryptoKeyVersionResult(algorithm=None, crypto_key=None, id=None, protection_level=None, public_key=None, state=None, version=None)¶

A collection of values returned by getKMSCryptoKeyVersion.

algorithm = None¶: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.

id = None¶: The provider-assigned unique ID for this managed resource.

protection_level = None¶: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. See the protection_level reference for possible outputs.

public_key = None¶: If the enclosing CryptoKey has purpose ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT, this block contains details about the public key associated to this CryptoKeyVersion. Structure is documented below.

state = None¶: The current state of the CryptoKeyVersion. See the state reference for possible outputs.

class pulumi_gcp.kms.GetKMSKeyRingResult(id=None, location=None, name=None, project=None, self_link=None)¶

A collection of values returned by getKMSKeyRing.

id = None¶: The provider-assigned unique ID for this managed resource.

self_link = None¶: The self link of the created KeyRing. Its format is projects/{projectId}/locations/{location}/keyRings/{keyRingName}.

class pulumi_gcp.kms.GetKMSSecretCiphertextResult(ciphertext=None, crypto_key=None, id=None, plaintext=None)¶

A collection of values returned by getKMSSecretCiphertext.

ciphertext = None¶: Contains the result of encrypting the provided plaintext, encoded in base64.

id = None¶: The provider-assigned unique ID for this managed resource.

class pulumi_gcp.kms.GetKMSSecretResult(additional_authenticated_data=None, ciphertext=None, crypto_key=None, id=None, plaintext=None)¶

A collection of values returned by getKMSSecret.

id = None¶: The provider-assigned unique ID for this managed resource.

plaintext = None¶: Contains the result of decrypting the provided ciphertext.

class pulumi_gcp.kms.KeyRing(resource_name, opts=None, location=None, name=None, project=None, __props__=None, __name__=None, __opts__=None)¶

A KeyRing is a toplevel logical grouping of CryptoKeys.

Note: KeyRings cannot be deleted from Google Cloud Platform. Destroying a provider-managed KeyRing will remove it from state but will not delete the resource on the server.

To get more information about KeyRing, see:

API documentation
How-to Guides
- Creating a key ring

import pulumi
import pulumi_gcp as gcp

example_keyring = gcp.kms.KeyRing("example-keyring", location="global")

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
location (pulumi.Input[str]) – The location for the KeyRing. A full list of valid locations can be found by running gcloud kms locations list.
name (pulumi.Input[str]) – The resource name for the KeyRing.
project (pulumi.Input[str]) – The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

location: pulumi.Output[str] = None¶: The location for the KeyRing. A full list of valid locations can be found by running gcloud kms locations list.

name: pulumi.Output[str] = None¶: The resource name for the KeyRing.

project: pulumi.Output[str] = None¶: The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

static get(resource_name, id, opts=None, location=None, name=None, project=None, self_link=None)¶

Get an existing KeyRing resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
location (pulumi.Input[str]) – The location for the KeyRing. A full list of valid locations can be found by running gcloud kms locations list.
name (pulumi.Input[str]) – The resource name for the KeyRing.
project (pulumi.Input[str]) – The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

class pulumi_gcp.kms.KeyRingIAMBinding(resource_name, opts=None, condition=None, key_ring_id=None, members=None, role=None, __props__=None, __name__=None, __opts__=None)¶

Three different resources help you manage your IAM policy for KMS key ring. Each of these resources serves a different use case:

kms.KeyRingIAMPolicy: Authoritative. Sets the IAM policy for the key ring and replaces any existing policy already attached.
kms.KeyRingIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the key ring are preserved.
kms.KeyRingIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the key ring are preserved.

Note: kms.KeyRingIAMPolicy cannot be used in conjunction with kms.KeyRingIAMBinding and kms.KeyRingIAMMember or they will fight over what your policy should be.
Note: kms.KeyRingIAMBinding resources can be used in conjunction with kms.KeyRingIAMMember resources only if they do not grant privilege to the same role.

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
admin = gcp.organizations.get_iam_policy(binding=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
}])
key_ring = gcp.kms.KeyRingIAMPolicy("keyRing",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
admin = gcp.organizations.get_iam_policy(binding=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
    "condition": {
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
    },
}])
key_ring = gcp.kms.KeyRingIAMPolicy("keyRing",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("keyRing",
    key_ring_id="your-key-ring-id",
    members=["user:jane@example.com"],
    role="roles/editor")

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("keyRing",
    condition={
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
        "title": "expires_after_2019_12_31",
    },
    key_ring_id="your-key-ring-id",
    members=["user:jane@example.com"],
    role="roles/editor")

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("keyRing",
    key_ring_id="your-key-ring-id",
    member="user:jane@example.com",
    role="roles/editor")

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("keyRing",
    condition={
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
        "title": "expires_after_2019_12_31",
    },
    key_ring_id="your-key-ring-id",
    member="user:jane@example.com",
    role="roles/editor")

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
condition (pulumi.Input[dict]) –
An IAM Condition for a given binding. Structure is documented below.
key_ring_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.
role (pulumi.Input[str]) – The role that should be applied. Only one kms.KeyRingIAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

The condition object supports the following:

description (pulumi.Input[str]) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (pulumi.Input[str]) - Textual representation of an expression in Common Expression Language syntax.
title (pulumi.Input[str]) - A title for the expression, i.e. a short string describing its purpose.

condition: pulumi.Output[dict] = None¶

An IAM Condition for a given binding. Structure is documented below.

description (str) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (str) - Textual representation of an expression in Common Expression Language syntax.
title (str) - A title for the expression, i.e. a short string describing its purpose.

etag: pulumi.Output[str] = None¶: (Computed) The etag of the key ring’s IAM policy.

key_ring_id: pulumi.Output[str] = None¶: The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.

role: pulumi.Output[str] = None¶: The role that should be applied. Only one kms.KeyRingIAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

static get(resource_name, id, opts=None, condition=None, etag=None, key_ring_id=None, members=None, role=None)¶

Get an existing KeyRingIAMBinding resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
condition (pulumi.Input[dict]) –
An IAM Condition for a given binding. Structure is documented below.
etag (pulumi.Input[str]) – (Computed) The etag of the key ring’s IAM policy.
key_ring_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.
role (pulumi.Input[str]) – The role that should be applied. Only one kms.KeyRingIAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

The condition object supports the following:

description (pulumi.Input[str]) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (pulumi.Input[str]) - Textual representation of an expression in Common Expression Language syntax.
title (pulumi.Input[str]) - A title for the expression, i.e. a short string describing its purpose.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

class pulumi_gcp.kms.KeyRingIAMMember(resource_name, opts=None, condition=None, key_ring_id=None, member=None, role=None, __props__=None, __name__=None, __opts__=None)¶

Three different resources help you manage your IAM policy for KMS key ring. Each of these resources serves a different use case:

kms.KeyRingIAMPolicy: Authoritative. Sets the IAM policy for the key ring and replaces any existing policy already attached.
kms.KeyRingIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the key ring are preserved.
kms.KeyRingIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the key ring are preserved.

Note: kms.KeyRingIAMPolicy cannot be used in conjunction with kms.KeyRingIAMBinding and kms.KeyRingIAMMember or they will fight over what your policy should be.
Note: kms.KeyRingIAMBinding resources can be used in conjunction with kms.KeyRingIAMMember resources only if they do not grant privilege to the same role.

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
admin = gcp.organizations.get_iam_policy(binding=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
}])
key_ring = gcp.kms.KeyRingIAMPolicy("keyRing",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
admin = gcp.organizations.get_iam_policy(binding=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
    "condition": {
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
    },
}])
key_ring = gcp.kms.KeyRingIAMPolicy("keyRing",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("keyRing",
    key_ring_id="your-key-ring-id",
    members=["user:jane@example.com"],
    role="roles/editor")

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("keyRing",
    condition={
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
        "title": "expires_after_2019_12_31",
    },
    key_ring_id="your-key-ring-id",
    members=["user:jane@example.com"],
    role="roles/editor")

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("keyRing",
    key_ring_id="your-key-ring-id",
    member="user:jane@example.com",
    role="roles/editor")

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("keyRing",
    condition={
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
        "title": "expires_after_2019_12_31",
    },
    key_ring_id="your-key-ring-id",
    member="user:jane@example.com",
    role="roles/editor")

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
condition (pulumi.Input[dict]) –
An IAM Condition for a given binding. Structure is documented below.
key_ring_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.
role (pulumi.Input[str]) – The role that should be applied. Only one kms.KeyRingIAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

The condition object supports the following:

description (pulumi.Input[str]) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (pulumi.Input[str]) - Textual representation of an expression in Common Expression Language syntax.
title (pulumi.Input[str]) - A title for the expression, i.e. a short string describing its purpose.

condition: pulumi.Output[dict] = None¶

An IAM Condition for a given binding. Structure is documented below.

description (str) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (str) - Textual representation of an expression in Common Expression Language syntax.
title (str) - A title for the expression, i.e. a short string describing its purpose.

etag: pulumi.Output[str] = None¶: (Computed) The etag of the key ring’s IAM policy.

key_ring_id: pulumi.Output[str] = None¶: The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.

role: pulumi.Output[str] = None¶: The role that should be applied. Only one kms.KeyRingIAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

static get(resource_name, id, opts=None, condition=None, etag=None, key_ring_id=None, member=None, role=None)¶

Get an existing KeyRingIAMMember resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
condition (pulumi.Input[dict]) –
An IAM Condition for a given binding. Structure is documented below.
etag (pulumi.Input[str]) – (Computed) The etag of the key ring’s IAM policy.
key_ring_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.
role (pulumi.Input[str]) – The role that should be applied. Only one kms.KeyRingIAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

The condition object supports the following:

description (pulumi.Input[str]) - An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression (pulumi.Input[str]) - Textual representation of an expression in Common Expression Language syntax.
title (pulumi.Input[str]) - A title for the expression, i.e. a short string describing its purpose.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

class pulumi_gcp.kms.KeyRingIAMPolicy(resource_name, opts=None, key_ring_id=None, policy_data=None, __props__=None, __name__=None, __opts__=None)¶

Three different resources help you manage your IAM policy for KMS key ring. Each of these resources serves a different use case:

kms.KeyRingIAMPolicy: Authoritative. Sets the IAM policy for the key ring and replaces any existing policy already attached.
kms.KeyRingIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the key ring are preserved.
kms.KeyRingIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the key ring are preserved.

Note: kms.KeyRingIAMPolicy cannot be used in conjunction with kms.KeyRingIAMBinding and kms.KeyRingIAMMember or they will fight over what your policy should be.
Note: kms.KeyRingIAMBinding resources can be used in conjunction with kms.KeyRingIAMMember resources only if they do not grant privilege to the same role.

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
admin = gcp.organizations.get_iam_policy(binding=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
}])
key_ring = gcp.kms.KeyRingIAMPolicy("keyRing",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
admin = gcp.organizations.get_iam_policy(binding=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
    "condition": {
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
    },
}])
key_ring = gcp.kms.KeyRingIAMPolicy("keyRing",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("keyRing",
    key_ring_id="your-key-ring-id",
    members=["user:jane@example.com"],
    role="roles/editor")

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("keyRing",
    condition={
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
        "title": "expires_after_2019_12_31",
    },
    key_ring_id="your-key-ring-id",
    members=["user:jane@example.com"],
    role="roles/editor")

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("keyRing",
    key_ring_id="your-key-ring-id",
    member="user:jane@example.com",
    role="roles/editor")

With IAM Conditions:

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("keyRing",
    condition={
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp("2020-01-01T00:00:00Z")",
        "title": "expires_after_2019_12_31",
    },
    key_ring_id="your-key-ring-id",
    member="user:jane@example.com",
    role="roles/editor")

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
key_ring_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.
policy_data (pulumi.Input[str]) – The policy data generated by a organizations.getIAMPolicy data source.

etag: pulumi.Output[str] = None¶: (Computed) The etag of the key ring’s IAM policy.

key_ring_id: pulumi.Output[str] = None¶: The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.

policy_data: pulumi.Output[str] = None¶: The policy data generated by a organizations.getIAMPolicy data source.

static get(resource_name, id, opts=None, etag=None, key_ring_id=None, policy_data=None)¶

Get an existing KeyRingIAMPolicy resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
etag (pulumi.Input[str]) – (Computed) The etag of the key ring’s IAM policy.
key_ring_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.
policy_data (pulumi.Input[str]) – The policy data generated by a organizations.getIAMPolicy data source.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

class pulumi_gcp.kms.Registry(resource_name, opts=None, credentials=None, event_notification_configs=None, http_config=None, log_level=None, mqtt_config=None, name=None, project=None, region=None, state_notification_config=None, __props__=None, __name__=None, __opts__=None)¶

A Google Cloud IoT Core device registry.

To get more information about DeviceRegistry, see:

API documentation
How-to Guides
- Official Documentation

import pulumi
import pulumi_gcp as gcp

test_registry = gcp.iot.Registry("test-registry")

import pulumi
import pulumi_gcp as gcp

default_telemetry = gcp.pubsub.Topic("default-telemetry")
test_registry = gcp.iot.Registry("test-registry", event_notification_configs=[{
    "pubsub_topic_name": default_telemetry.id,
    "subfolderMatches": "",
}])

import pulumi
import pulumi_gcp as gcp

default_devicestatus = gcp.pubsub.Topic("default-devicestatus")
default_telemetry = gcp.pubsub.Topic("default-telemetry")
additional_telemetry = gcp.pubsub.Topic("additional-telemetry")
test_registry = gcp.iot.Registry("test-registry",
    event_notification_configs=[
        {
            "pubsub_topic_name": additional_telemetry.id,
            "subfolderMatches": "test/path",
        },
        {
            "pubsub_topic_name": default_telemetry.id,
            "subfolderMatches": "",
        },
    ],
    state_notification_config={
        "pubsub_topic_name": default_devicestatus.id,
    },
    mqtt_config={
        "mqtt_enabled_state": "MQTT_ENABLED",
    },
    http_config={
        "http_enabled_state": "HTTP_ENABLED",
    },
    log_level="INFO",
    credentials=[{
        "publicKeyCertificate": {
            "format": "X509_CERTIFICATE_PEM",
            "certificate": (lambda path: open(path).read())("test-fixtures/rsa_cert.pem"),
        },
    }])

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
credentials (pulumi.Input[list]) – List of public key certificates to authenticate devices. The structure is documented below.
event_notification_configs (pulumi.Input[list]) – List of configurations for event notifications, such as PubSub topics to publish device events to. Structure is documented below.
http_config (pulumi.Input[dict]) – Activate or deactivate HTTP. The structure is documented below.
log_level (pulumi.Input[str]) – The default logging verbosity for activity from devices in this registry. Specifies which events should be written to logs. For example, if the LogLevel is ERROR, only events that terminate in errors will be logged. LogLevel is inclusive; enabling INFO logging will also enable ERROR logging.
mqtt_config (pulumi.Input[dict]) – Activate or deactivate MQTT. The structure is documented below.
name (pulumi.Input[str]) – A unique name for the resource, required by device registry.
project (pulumi.Input[str]) – The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
region (pulumi.Input[str]) – The region in which the created registry should reside. If it is not provided, the provider region is used.
state_notification_config (pulumi.Input[dict]) – A PubSub topic to publish device state updates. The structure is documented below.

The credentials object supports the following:

publicKeyCertificate (pulumi.Input[dict]) - A public key certificate format and data.
- certificate (pulumi.Input[str]) - The certificate data.
- format (pulumi.Input[str]) - The field allows only X509_CERTIFICATE_PEM.

The event_notification_configs object supports the following:

pubsub_topic_name (pulumi.Input[str]) - PubSub topic name to publish device events.
subfolderMatches (pulumi.Input[str]) - If the subfolder name matches this string exactly, this configuration will be used. The string must not include the leading ‘/’ character. If empty, all strings are matched. Empty value can only be used for the last event_notification_configs item.

The http_config object supports the following:

http_enabled_state (pulumi.Input[str]) - The field allows HTTP_ENABLED or HTTP_DISABLED.

The mqtt_config object supports the following:

mqtt_enabled_state (pulumi.Input[str]) - The field allows MQTT_ENABLED or MQTT_DISABLED.

The state_notification_config object supports the following:

pubsub_topic_name (pulumi.Input[str]) - PubSub topic name to publish device events.

credentials: pulumi.Output[list] = None¶

List of public key certificates to authenticate devices. The structure is documented below.

publicKeyCertificate (dict) - A public key certificate format and data.
- certificate (str) - The certificate data.
- format (str) - The field allows only X509_CERTIFICATE_PEM.

event_notification_configs: pulumi.Output[list] = None¶

List of configurations for event notifications, such as PubSub topics to publish device events to. Structure is documented below.

pubsub_topic_name (str) - PubSub topic name to publish device events.
subfolderMatches (str) - If the subfolder name matches this string exactly, this configuration will be used. The string must not include the leading ‘/’ character. If empty, all strings are matched. Empty value can only be used for the last event_notification_configs item.

http_config: pulumi.Output[dict] = None¶

Activate or deactivate HTTP. The structure is documented below.

http_enabled_state (str) - The field allows HTTP_ENABLED or HTTP_DISABLED.

log_level: pulumi.Output[str] = None¶: The default logging verbosity for activity from devices in this registry. Specifies which events should be written to logs. For example, if the LogLevel is ERROR, only events that terminate in errors will be logged. LogLevel is inclusive; enabling INFO logging will also enable ERROR logging.

mqtt_config: pulumi.Output[dict] = None¶

Activate or deactivate MQTT. The structure is documented below.

mqtt_enabled_state (str) - The field allows MQTT_ENABLED or MQTT_DISABLED.

name: pulumi.Output[str] = None¶: A unique name for the resource, required by device registry.

project: pulumi.Output[str] = None¶: The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

region: pulumi.Output[str] = None¶: The region in which the created registry should reside. If it is not provided, the provider region is used.

state_notification_config: pulumi.Output[dict] = None¶

A PubSub topic to publish device state updates. The structure is documented below.

pubsub_topic_name (str) - PubSub topic name to publish device events.

static get(resource_name, id, opts=None, credentials=None, event_notification_configs=None, http_config=None, log_level=None, mqtt_config=None, name=None, project=None, region=None, state_notification_config=None)¶

Get an existing Registry resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
credentials (pulumi.Input[list]) – List of public key certificates to authenticate devices. The structure is documented below.
event_notification_configs (pulumi.Input[list]) – List of configurations for event notifications, such as PubSub topics to publish device events to. Structure is documented below.
http_config (pulumi.Input[dict]) – Activate or deactivate HTTP. The structure is documented below.
log_level (pulumi.Input[str]) – The default logging verbosity for activity from devices in this registry. Specifies which events should be written to logs. For example, if the LogLevel is ERROR, only events that terminate in errors will be logged. LogLevel is inclusive; enabling INFO logging will also enable ERROR logging.
mqtt_config (pulumi.Input[dict]) – Activate or deactivate MQTT. The structure is documented below.
name (pulumi.Input[str]) – A unique name for the resource, required by device registry.
project (pulumi.Input[str]) – The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
region (pulumi.Input[str]) – The region in which the created registry should reside. If it is not provided, the provider region is used.
state_notification_config (pulumi.Input[dict]) – A PubSub topic to publish device state updates. The structure is documented below.

The credentials object supports the following:

publicKeyCertificate (pulumi.Input[dict]) - A public key certificate format and data.
- certificate (pulumi.Input[str]) - The certificate data.
- format (pulumi.Input[str]) - The field allows only X509_CERTIFICATE_PEM.

The event_notification_configs object supports the following:

pubsub_topic_name (pulumi.Input[str]) - PubSub topic name to publish device events.
subfolderMatches (pulumi.Input[str]) - If the subfolder name matches this string exactly, this configuration will be used. The string must not include the leading ‘/’ character. If empty, all strings are matched. Empty value can only be used for the last event_notification_configs item.

The http_config object supports the following:

http_enabled_state (pulumi.Input[str]) - The field allows HTTP_ENABLED or HTTP_DISABLED.

The mqtt_config object supports the following:

mqtt_enabled_state (pulumi.Input[str]) - The field allows MQTT_ENABLED or MQTT_DISABLED.

The state_notification_config object supports the following:

pubsub_topic_name (pulumi.Input[str]) - PubSub topic name to publish device events.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

class pulumi_gcp.kms.SecretCiphertext(resource_name, opts=None, additional_authenticated_data=None, crypto_key=None, plaintext=None, __props__=None, __name__=None, __opts__=None)¶

Encrypts secret data with Google Cloud KMS and provides access to the ciphertext.

NOTE: Using this resource will allow you to conceal secret data within your resource definitions, but it does not take care of protecting that data in the logging output, plan output, or state output. Please take care to secure your secret data outside of resource definitions.

To get more information about SecretCiphertext, see:

API documentation
How-to Guides
- Encrypting and decrypting data with a symmetric key

Warning: All arguments including plaintext and additional_authenticated_data will be stored in the raw state as plain-text. Read more about secrets in state.

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring", location="global")
cryptokey = gcp.kms.CryptoKey("cryptokey",
    key_ring=keyring.id,
    rotation_period="100000s")
my_password = gcp.kms.SecretCiphertext("myPassword",
    crypto_key=cryptokey.id,
    plaintext="my-secret-password")
instance = gcp.compute.Instance("instance",
    machine_type="n1-standard-1",
    zone="us-central1-a",
    boot_disk={
        "initialize_params": {
            "image": "debian-cloud/debian-9",
        },
    },
    network_interface=[{
        "network": "default",
        "access_config": [{}],
    }],
    metadata={
        "password": my_password.ciphertext,
    })

Parameters

resource_name (str) – The name of the resource.
opts (pulumi.ResourceOptions) – Options for the resource.
additional_authenticated_data (pulumi.Input[str]) – The additional authenticated data used for integrity checks during encryption and decryption. Note: This property is sensitive and will not be displayed in the plan.
crypto_key (pulumi.Input[str]) – The full name of the CryptoKey that will be used to encrypt the provided plaintext. Format: 'projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{cryptoKey}}'
plaintext (pulumi.Input[str]) – The plaintext to be encrypted. Note: This property is sensitive and will not be displayed in the plan.

additional_authenticated_data: pulumi.Output[str] = None¶: The additional authenticated data used for integrity checks during encryption and decryption. Note: This property is sensitive and will not be displayed in the plan.

ciphertext: pulumi.Output[str] = None¶: Contains the result of encrypting the provided plaintext, encoded in base64.

crypto_key: pulumi.Output[str] = None¶: The full name of the CryptoKey that will be used to encrypt the provided plaintext. Format: 'projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{cryptoKey}}'

plaintext: pulumi.Output[str] = None¶: The plaintext to be encrypted. Note: This property is sensitive and will not be displayed in the plan.

static get(resource_name, id, opts=None, additional_authenticated_data=None, ciphertext=None, crypto_key=None, plaintext=None)¶

Get an existing SecretCiphertext resource’s state with the given name, id, and optional extra properties used to qualify the lookup.

Parameters

resource_name (str) – The unique name of the resulting resource.
id (str) – The unique provider ID of the resource to lookup.
opts (pulumi.ResourceOptions) – Options for the resource.
additional_authenticated_data (pulumi.Input[str]) – The additional authenticated data used for integrity checks during encryption and decryption. Note: This property is sensitive and will not be displayed in the plan.
ciphertext (pulumi.Input[str]) – Contains the result of encrypting the provided plaintext, encoded in base64.
crypto_key (pulumi.Input[str]) – The full name of the CryptoKey that will be used to encrypt the provided plaintext. Format: 'projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{cryptoKey}}'
plaintext (pulumi.Input[str]) – The plaintext to be encrypted. Note: This property is sensitive and will not be displayed in the plan.

translate_output_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

translate_input_property(prop)¶

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters: prop (str) – A property name.
Returns: A potentially transformed property name.
Return type: str

pulumi_gcp.kms.get_kms_crypto_key(key_ring=None, name=None, opts=None)¶

Provides access to a Google Cloud Platform KMS CryptoKey. For more information see the official documentation and API.

A CryptoKey is an interface to key material which can be used to encrypt and decrypt data. A CryptoKey belongs to a Google Cloud KMS KeyRing.

import pulumi
import pulumi_gcp as gcp

my_key_ring = gcp.kms.get_kms_key_ring(name="my-key-ring",
    location="us-central1")
my_crypto_key = gcp.kms.get_kms_crypto_key(name="my-crypto-key",
    key_ring=my_key_ring.self_link)

Parameters

key_ring (str) – The self_link of the Google Cloud Platform KeyRing to which the key belongs.
name (str) – The CryptoKey’s name. A CryptoKey’s name belonging to the specified Google Cloud Platform KeyRing and match the regular expression [a-zA-Z0-9_-]{1,63}

pulumi_gcp.kms.get_kms_crypto_key_version(crypto_key=None, version=None, opts=None)¶

Provides access to a Google Cloud Platform KMS CryptoKeyVersion. For more information see the official documentation and API.

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

import pulumi
import pulumi_gcp as gcp

my_key_ring = gcp.kms.get_kms_key_ring(name="my-key-ring",
    location="us-central1")
my_crypto_key = gcp.kms.get_kms_crypto_key(name="my-crypto-key",
    key_ring=my_key_ring.self_link)
my_crypto_key_version = gcp.kms.get_kms_crypto_key_version(crypto_key=data["google_kms_key"]["my_key"]["self_link"])

Parameters

crypto_key (str) – The self_link of the Google Cloud Platform CryptoKey to which the key version belongs.
version (float) – The version number for this CryptoKeyVersion. Defaults to 1.

pulumi_gcp.kms.get_kms_key_ring(location=None, name=None, project=None, opts=None)¶

Provides access to Google Cloud Platform KMS KeyRing. For more information see the official documentation and API.

A KeyRing is a grouping of CryptoKeys for organizational purposes. A KeyRing belongs to a Google Cloud Platform Project and resides in a specific location.

import pulumi
import pulumi_gcp as gcp

my_key_ring = gcp.kms.get_kms_key_ring(location="us-central1",
    name="my-key-ring")

Parameters

location (str) – The Google Cloud Platform location for the KeyRing. A full list of valid locations can be found by running gcloud kms locations list.
name (str) – The KeyRing’s name. A KeyRing name must exist within the provided location and match the regular expression [a-zA-Z0-9_-]{1,63}
project (str) – The project in which the resource belongs. If it is not provided, the provider project is used.

pulumi_gcp.kms.get_kms_secret(additional_authenticated_data=None, ciphertext=None, crypto_key=None, opts=None)¶

This data source allows you to use data encrypted with Google Cloud KMS within your resource definitions.

For more information see the official documentation.

NOTE: Using this data provider will allow you to conceal secret data within your resource definitions, but it does not take care of protecting that data in the logging output, plan output, or state output. Please take care to secure your secret data outside of resource definitions.

Parameters

additional_authenticated_data (str) – The additional authenticated data used for integrity checks during encryption and decryption.
ciphertext (str) – The ciphertext to be decrypted, encoded in base64
crypto_key (str) – The id of the CryptoKey that will be used to decrypt the provided ciphertext. This is represented by the format {projectId}/{location}/{keyRingName}/{cryptoKeyName}.

pulumi_gcp.kms.get_kms_secret_ciphertext(crypto_key=None, plaintext=None, opts=None)¶

!> Warning: This data source is deprecated. Use the kms.SecretCiphertext resource instead.

This data source allows you to encrypt data with Google Cloud KMS and use the ciphertext within your resource definitions.

For more information see the official documentation.

NOTE: Using this data source will allow you to conceal secret data within your resource definitions, but it does not take care of protecting that data in the logging output, plan output, or state output. Please take care to secure your secret data outside of resource definitions.

Parameters

crypto_key (str) – The id of the CryptoKey that will be used to encrypt the provided plaintext. This is represented by the format {projectId}/{location}/{keyRingName}/{cryptoKeyName}.
plaintext (str) – The plaintext to be encrypted

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud

kms¶

On This Page