kms

class pulumi_gcp.kms.CryptoKey(resource_name, opts=None, key_ring=None, name=None, rotation_period=None, __name__=None, __opts__=None)

Allows creation of a Google Cloud Platform KMS CryptoKey. For more information see the official documentation and API.

A CryptoKey is an interface to key material which can be used to encrypt and decrypt data. A CryptoKey belongs to a Google Cloud KMS KeyRing.

Note: CryptoKeys cannot be deleted from Google Cloud Platform. Destroying a Terraform-managed CryptoKey will remove it from state and delete all CryptoKeyVersions, rendering the key unusable, but will not delete the resource on the server. When Terraform destroys these keys, any data previously encrypted with these keys will be irrecoverable. For this reason, it is strongly recommended that you add lifecycle hooks to the resource to prevent accidental destruction.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • key*ring (pulumi.Input[str]) –

    The id of the Google Cloud Platform KeyRing to which the key shall belong.

  • name (pulumi.Input[str]) – The CryptoKey’s name. A CryptoKey’s name must be unique within a location and match the regular expression [a-zA-Z0-9*-]{1,63}
  • rotation_period (pulumi.Input[str]) – Every time this period passes, generate a new CryptoKeyVersion and set it as the primary. The first rotation will take place after the specified period. The rotation period has the format of a decimal number with up to 9 fractional digits, followed by the letter s (seconds). It must be greater than a day (ie, 86400).
key_ring = None

The id of the Google Cloud Platform KeyRing to which the key shall belong.

name = None

The CryptoKey’s name. A CryptoKey’s name must be unique within a location and match the regular expression [a-zA-Z0-9_-]{1,63}

rotation_period = None

Every time this period passes, generate a new CryptoKeyVersion and set it as the primary. The first rotation will take place after the specified period. The rotation period has the format of a decimal number with up to 9 fractional digits, followed by the letter s (seconds). It must be greater than a day (ie, 86400).

The self link of the created CryptoKey. Its format is projects/{projectId}/locations/{location}/keyRings/{keyRingName}/cryptoKeys/{cryptoKeyName}.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_gcp.kms.CryptoKeyIAMBinding(resource_name, opts=None, crypto_key_id=None, members=None, role=None, __name__=None, __opts__=None)

Allows creation and management of a single binding within IAM policy for an existing Google Cloud KMS crypto key.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • crypto_key_id (pulumi.Input[str]) – The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.
  • members (pulumi.Input[list]) – A list of users that the role should apply to.
  • role (pulumi.Input[str]) – The role that should be applied. Only one google_kms_crypto_key_iam_binding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.
crypto_key_id = None

The crypto key ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.

etag = None

(Computed) The etag of the crypto key’s IAM policy.

members = None

A list of users that the role should apply to.

role = None

The role that should be applied. Only one google_kms_crypto_key_iam_binding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_gcp.kms.CryptoKeyIAMMember(resource_name, opts=None, crypto_key_id=None, member=None, role=None, __name__=None, __opts__=None)

Allows creation and management of a single member for a single binding within the IAM policy for an existing Google Cloud KMS crypto key.

Note: This resource must not be used in conjunction with
google_kms_crypto_key_iam_policy or they will fight over what your policy should be. Similarly, roles controlled by google_kms_crypto_key_iam_binding should not be assigned to using google_kms_crypto_key_iam_member.
Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • crypto_key_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.
  • member (pulumi.Input[str]) – The user that the role should apply to.
  • role (pulumi.Input[str]) – The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.
crypto_key_id = None

The key ring ID, in the form {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or {location_name}/{key_ring_name}/{crypto_key_name}. In the second form, the provider’s project setting will be used as a fallback.

etag = None

(Computed) The etag of the project’s IAM policy.

member = None

The user that the role should apply to.

role = None

The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_gcp.kms.GetKMSSecretResult(plaintext=None, id=None)

A collection of values returned by getKMSSecret.

plaintext = None

Contains the result of decrypting the provided ciphertext.

id = None

id is the provider-assigned unique ID for this managed resource.

class pulumi_gcp.kms.KeyRing(resource_name, opts=None, location=None, name=None, project=None, __name__=None, __opts__=None)

Allows creation of a Google Cloud Platform KMS KeyRing. For more information see the official documentation and API.

A KeyRing is a grouping of CryptoKeys for organizational purposes. A KeyRing belongs to a Google Cloud Platform Project and resides in a specific location.

Note: KeyRings cannot be deleted from Google Cloud Platform. Destroying a Terraform-managed KeyRing will remove it from state but will not delete the resource on the server.
Parameters:
  • resource*name (str) –

    The name of the resource.

  • opts (pulumi.ResourceOptions) – Options for the resource.
  • location (pulumi.Input[str]) – The Google Cloud Platform location for the KeyRing. A full list of valid locations can be found by running gcloud kms locations list.
  • name (pulumi.Input[str]) – The KeyRing’s name. A KeyRing’s name must be unique within a location and match the regular expression [a-zA-Z0-9*-]{1,63}
  • project (pulumi.Input[str]) – The project in which the resource belongs. If it is not provided, the provider project is used.
location = None

The Google Cloud Platform location for the KeyRing. A full list of valid locations can be found by running gcloud kms locations list.

name = None

The KeyRing’s name. A KeyRing’s name must be unique within a location and match the regular expression [a-zA-Z0-9_-]{1,63}

project = None

The project in which the resource belongs. If it is not provided, the provider project is used.

The self link of the created KeyRing. Its format is projects/{projectId}/locations/{location}/keyRings/{keyRingName}.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_gcp.kms.KeyRingIAMBinding(resource_name, opts=None, key_ring_id=None, members=None, role=None, __name__=None, __opts__=None)

Three different resources help you manage your IAM policy for KMS key ring. Each of these resources serves a different use case:

  • google_kms_key_ring_iam_policy: Authoritative. Sets the IAM policy for the key ring and replaces any existing policy already attached.
  • google_kms_key_ring_iam_binding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the key ring are preserved.
  • google_kms_key_ring_iam_member: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the key ring are preserved.

Note: google_kms_key_ring_iam_policy cannot be used in conjunction with google_kms_key_ring_iam_binding and google_kms_key_ring_iam_member or they will fight over what your policy should be.

Note: google_kms_key_ring_iam_binding resources can be used in conjunction with google_kms_key_ring_iam_member resources only if they do not grant privilege to the same role.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • key_ring_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.

:param pulumi.Input[list] members :param pulumi.Input[str] role: The role that should be applied. Only one

google_kms_key_ring_iam_binding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.
etag = None

(Computed) The etag of the key ring’s IAM policy.

key_ring_id = None

The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.

role = None

The role that should be applied. Only one google_kms_key_ring_iam_binding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_gcp.kms.KeyRingIAMMember(resource_name, opts=None, key_ring_id=None, member=None, role=None, __name__=None, __opts__=None)

Three different resources help you manage your IAM policy for KMS key ring. Each of these resources serves a different use case:

  • google_kms_key_ring_iam_policy: Authoritative. Sets the IAM policy for the key ring and replaces any existing policy already attached.
  • google_kms_key_ring_iam_binding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the key ring are preserved.
  • google_kms_key_ring_iam_member: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the key ring are preserved.

Note: google_kms_key_ring_iam_policy cannot be used in conjunction with google_kms_key_ring_iam_binding and google_kms_key_ring_iam_member or they will fight over what your policy should be.

Note: google_kms_key_ring_iam_binding resources can be used in conjunction with google_kms_key_ring_iam_member resources only if they do not grant privilege to the same role.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • key_ring_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.

:param pulumi.Input[str] member :param pulumi.Input[str] role: The role that should be applied. Only one

google_kms_key_ring_iam_binding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.
etag = None

(Computed) The etag of the key ring’s IAM policy.

key_ring_id = None

The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.

role = None

The role that should be applied. Only one google_kms_key_ring_iam_binding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_gcp.kms.KeyRingIAMPolicy(resource_name, opts=None, key_ring_id=None, policy_data=None, __name__=None, __opts__=None)

Three different resources help you manage your IAM policy for KMS key ring. Each of these resources serves a different use case:

  • google_kms_key_ring_iam_policy: Authoritative. Sets the IAM policy for the key ring and replaces any existing policy already attached.
  • google_kms_key_ring_iam_binding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the key ring are preserved.
  • google_kms_key_ring_iam_member: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the key ring are preserved.

Note: google_kms_key_ring_iam_policy cannot be used in conjunction with google_kms_key_ring_iam_binding and google_kms_key_ring_iam_member or they will fight over what your policy should be.

Note: google_kms_key_ring_iam_binding resources can be used in conjunction with google_kms_key_ring_iam_member resources only if they do not grant privilege to the same role.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • key_ring_id (pulumi.Input[str]) – The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.
  • policy_data (pulumi.Input[str]) – The policy data generated by a google_iam_policy data source.
etag = None

(Computed) The etag of the key ring’s IAM policy.

key_ring_id = None

The key ring ID, in the form {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. In the second form, the provider’s project setting will be used as a fallback.

policy_data = None

The policy data generated by a google_iam_policy data source.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
class pulumi_gcp.kms.Registry(resource_name, opts=None, credentials=None, event_notification_config=None, http_config=None, mqtt_config=None, name=None, project=None, region=None, state_notification_config=None, __name__=None, __opts__=None)
Creates a device registry in Google’s Cloud IoT Core platform. For more information see

the official documentation and API.

Parameters:
  • resource_name (str) – The name of the resource.
  • opts (pulumi.ResourceOptions) – Options for the resource.
  • credentials (pulumi.Input[list]) – List of public key certificates to authenticate devices. Structure is documented below.
  • event_notification_config (pulumi.Input[dict]) – A PubSub topics to publish device events. Structure is documented below.
  • http_config (pulumi.Input[dict]) – Activate or deactivate HTTP. Structure is documented below.
  • mqtt_config (pulumi.Input[dict]) – Activate or deactivate MQTT. Structure is documented below.
  • name (pulumi.Input[str]) – A unique name for the resource, required by device registry. Changing this forces a new resource to be created.
  • project (pulumi.Input[str]) – The project in which the resource belongs. If it is not provided, the provider project is used.
  • region (pulumi.Input[str]) – The Region in which the created address should reside. If it is not provided, the provider region is used.
  • state_notification_config (pulumi.Input[dict]) – A PubSub topic to publish device state updates. Structure is documented below.
credentials = None

List of public key certificates to authenticate devices. Structure is documented below.

event_notification_config = None

A PubSub topics to publish device events. Structure is documented below.

http_config = None

Activate or deactivate HTTP. Structure is documented below.

mqtt_config = None

Activate or deactivate MQTT. Structure is documented below.

name = None

A unique name for the resource, required by device registry. Changing this forces a new resource to be created.

project = None

The project in which the resource belongs. If it is not provided, the provider project is used.

region = None

The Region in which the created address should reside. If it is not provided, the provider region is used.

state_notification_config = None

A PubSub topic to publish device state updates. Structure is documented below.

translate_output_property(prop)

Provides subclasses of Resource an opportunity to translate names of output properties into a format of their choosing before writing those properties to the resource object.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
translate_input_property(prop)

Provides subclasses of Resource an opportunity to translate names of input properties into a format of their choosing before sending those properties to the Pulumi engine.

Parameters:prop (str) – A property name.
Returns:A potentially transformed property name.
Return type:str
pulumi_gcp.kms.get_kms_secret(ciphertext=None, crypto_key=None)

This data source allows you to use data encrypted with Google Cloud KMS within your resource definitions.

For more information see the official documentation.

NOTE: Using this data provider will allow you to conceal secret data within your resource definitions, but it does not take care of protecting that data in the logging output, plan output, or state output. Please take care to secure your secret data outside of resource definitions.