Package com.google.cloud.kms.v1 (2.4.4)

A client to Cloud Key Management Service (KMS) API

The interfaces provided are listed below, along with usage samples.

EkmServiceClient

Service Description: Google Cloud Key Management EKM Service

Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

EkmConnection

Sample for EkmServiceClient:


 try (EkmServiceClient ekmServiceClient = EkmServiceClient.create()) {
   EkmConnectionName name = EkmConnectionName.of("[PROJECT]", "[LOCATION]", "[EKM_CONNECTION]");
   EkmConnection response = ekmServiceClient.getEkmConnection(name);
 }

KeyManagementServiceClient

Service Description: Google Cloud Key Management Service

Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

KeyRing
CryptoKey
CryptoKeyVersion
ImportJob

If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

Sample for KeyManagementServiceClient:


 try (KeyManagementServiceClient keyManagementServiceClient =
     KeyManagementServiceClient.create()) {
   KeyRingName name = KeyRingName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]");
   KeyRing response = keyManagementServiceClient.getKeyRing(name);
 }

Classes

AsymmetricDecryptRequest

Request message for KeyManagementService.AsymmetricDecrypt.

Protobuf type google.cloud.kms.v1.AsymmetricDecryptRequest

AsymmetricDecryptRequest.Builder

Request message for KeyManagementService.AsymmetricDecrypt.

Protobuf type google.cloud.kms.v1.AsymmetricDecryptRequest

AsymmetricDecryptResponse

Response message for KeyManagementService.AsymmetricDecrypt.

Protobuf type google.cloud.kms.v1.AsymmetricDecryptResponse

AsymmetricDecryptResponse.Builder

Response message for KeyManagementService.AsymmetricDecrypt.

Protobuf type google.cloud.kms.v1.AsymmetricDecryptResponse

AsymmetricSignRequest

Request message for KeyManagementService.AsymmetricSign.

Protobuf type google.cloud.kms.v1.AsymmetricSignRequest

AsymmetricSignRequest.Builder

Request message for KeyManagementService.AsymmetricSign.

Protobuf type google.cloud.kms.v1.AsymmetricSignRequest

AsymmetricSignResponse

Response message for KeyManagementService.AsymmetricSign.

Protobuf type google.cloud.kms.v1.AsymmetricSignResponse

AsymmetricSignResponse.Builder

Response message for KeyManagementService.AsymmetricSign.

Protobuf type google.cloud.kms.v1.AsymmetricSignResponse

Certificate

A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.

Protobuf type google.cloud.kms.v1.Certificate

Certificate.Builder

A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.

Protobuf type google.cloud.kms.v1.Certificate

CreateCryptoKeyRequest

Request message for KeyManagementService.CreateCryptoKey.

Protobuf type google.cloud.kms.v1.CreateCryptoKeyRequest

CreateCryptoKeyRequest.Builder

Request message for KeyManagementService.CreateCryptoKey.

Protobuf type google.cloud.kms.v1.CreateCryptoKeyRequest

CreateCryptoKeyVersionRequest

Request message for KeyManagementService.CreateCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.CreateCryptoKeyVersionRequest

CreateCryptoKeyVersionRequest.Builder

Request message for KeyManagementService.CreateCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.CreateCryptoKeyVersionRequest

CreateEkmConnectionRequest

Request message for [KeyManagementService.CreateEkmConnection][].

Protobuf type google.cloud.kms.v1.CreateEkmConnectionRequest

CreateEkmConnectionRequest.Builder

Request message for [KeyManagementService.CreateEkmConnection][].

Protobuf type google.cloud.kms.v1.CreateEkmConnectionRequest

CreateImportJobRequest

Request message for KeyManagementService.CreateImportJob.

Protobuf type google.cloud.kms.v1.CreateImportJobRequest

CreateImportJobRequest.Builder

Request message for KeyManagementService.CreateImportJob.

Protobuf type google.cloud.kms.v1.CreateImportJobRequest

CreateKeyRingRequest

Request message for KeyManagementService.CreateKeyRing.

Protobuf type google.cloud.kms.v1.CreateKeyRingRequest

CreateKeyRingRequest.Builder

Request message for KeyManagementService.CreateKeyRing.

Protobuf type google.cloud.kms.v1.CreateKeyRingRequest

A CryptoKey represents a logical key that can be used for cryptographic operations. A CryptoKey is made up of zero or more versions, which represent the actual key material used in cryptographic operations.

Protobuf type google.cloud.kms.v1.CryptoKey

CryptoKey.Builder

Protobuf type google.cloud.kms.v1.CryptoKey

CryptoKeyName

CryptoKeyName.Builder

Builder for projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}.

CryptoKeyPathName

AUTO-GENERATED DOCUMENTATION AND CLASS

CryptoKeyPathName.Builder

Builder for CryptoKeyPathName.

CryptoKeyVersion

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material. An ENABLED version can be used for cryptographic operations. For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Protobuf type google.cloud.kms.v1.CryptoKeyVersion

CryptoKeyVersion.Builder

Protobuf type google.cloud.kms.v1.CryptoKeyVersion

CryptoKeyVersionName

CryptoKeyVersionName.Builder

Builder for projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}.

CryptoKeyVersionTemplate

A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.

Protobuf type google.cloud.kms.v1.CryptoKeyVersionTemplate

CryptoKeyVersionTemplate.Builder

A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.

Protobuf type google.cloud.kms.v1.CryptoKeyVersionTemplate

DecryptRequest

Request message for KeyManagementService.Decrypt.

Protobuf type google.cloud.kms.v1.DecryptRequest

DecryptRequest.Builder

Request message for KeyManagementService.Decrypt.

Protobuf type google.cloud.kms.v1.DecryptRequest

DecryptResponse

Response message for KeyManagementService.Decrypt.

Protobuf type google.cloud.kms.v1.DecryptResponse

DecryptResponse.Builder

Response message for KeyManagementService.Decrypt.

Protobuf type google.cloud.kms.v1.DecryptResponse

DestroyCryptoKeyVersionRequest

Request message for KeyManagementService.DestroyCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.DestroyCryptoKeyVersionRequest

DestroyCryptoKeyVersionRequest.Builder

Request message for KeyManagementService.DestroyCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.DestroyCryptoKeyVersionRequest

Digest

A Digest holds a cryptographic message digest.

Protobuf type google.cloud.kms.v1.Digest

Digest.Builder

A Digest holds a cryptographic message digest.

Protobuf type google.cloud.kms.v1.Digest

EkmConnection

An EkmConnection represents an individual EKM connection. It can be used for creating CryptoKeys and CryptoKeyVersions with a ProtectionLevel of EXTERNAL_VPC, as well as performing cryptographic operations using keys created within the EkmConnection.

Protobuf type google.cloud.kms.v1.EkmConnection

EkmConnection.Builder

Protobuf type google.cloud.kms.v1.EkmConnection

EkmConnection.ServiceResolver

A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.

Protobuf type google.cloud.kms.v1.EkmConnection.ServiceResolver

EkmConnection.ServiceResolver.Builder

A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.

Protobuf type google.cloud.kms.v1.EkmConnection.ServiceResolver

EkmConnectionName

EkmConnectionName.Builder

Builder for projects/{project}/locations/{location}/ekmConnections/{ekm_connection}.

EkmServiceClient

Service Description: Google Cloud Key Management EKM Service

Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

EkmConnection

This class provides the ability to make remote calls to the backing service through method calls that map to API methods. Sample code to get started:


 try (EkmServiceClient ekmServiceClient = EkmServiceClient.create()) {
   EkmConnectionName name = EkmConnectionName.of("[PROJECT]", "[LOCATION]", "[EKM_CONNECTION]");
   EkmConnection response = ekmServiceClient.getEkmConnection(name);
 }

Note: close() needs to be called on the EkmServiceClient object to clean up resources such as threads. In the example above, try-with-resources is used, which automatically calls close().

The surface of this class includes several types of Java methods for each of the API's methods:

A "flattened" method. With this type of method, the fields of the request type have been converted into function parameters. It may be the case that not all fields are available as parameters, and not every API method will have a flattened method entry point.
A "request object" method. This type of method only takes one parameter, a request object, which must be constructed before the call. Not every API method will have a request object method.
A "callable" method. This type of method takes no parameters and returns an immutable API callable object, which can be used to initiate calls to the service.

See the individual methods for example code.

Many parameters require resource names to be formatted in a particular way. To assist with these names, this class includes a format method for each type of name, and additionally a parse method to extract the individual identifiers contained within names that are returned.

This class can be customized by passing in a custom instance of EkmServiceSettings to create(). For example:

To customize credentials:


 EkmServiceSettings ekmServiceSettings =
     EkmServiceSettings.newBuilder()
         .setCredentialsProvider(FixedCredentialsProvider.create(myCredentials))
         .build();
 EkmServiceClient ekmServiceClient = EkmServiceClient.create(ekmServiceSettings);

To customize the endpoint:


 EkmServiceSettings ekmServiceSettings =
     EkmServiceSettings.newBuilder().setEndpoint(myEndpoint).build();
 EkmServiceClient ekmServiceClient = EkmServiceClient.create(ekmServiceSettings);

Please refer to the GitHub repository's samples for more quickstart code snippets.

EkmServiceClient.ListEkmConnectionsFixedSizeCollection

EkmServiceClient.ListEkmConnectionsPage

EkmServiceClient.ListEkmConnectionsPagedResponse

EkmServiceGrpc

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

EkmConnection

EkmServiceGrpc.EkmServiceBlockingStub

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

EkmConnection

EkmServiceGrpc.EkmServiceFutureStub

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

EkmConnection

EkmServiceGrpc.EkmServiceImplBase

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

EkmConnection

EkmServiceGrpc.EkmServiceStub

Google Cloud Key Management EKM Service Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

EkmConnection

EkmServiceProto

EkmServiceSettings

Settings class to configure an instance of EkmServiceClient.

The default instance has everything set to sensible defaults:

The default service address (cloudkms.googleapis.com) and default port (443) are used.
Credentials are acquired automatically through Application Default Credentials.
Retries are configured for idempotent methods but not for non-idempotent methods.

The builder of this class is recursive, so contained classes are themselves builders. When build() is called, the tree of builders is called to create the complete settings object.

For example, to set the total timeout of getEkmConnection to 30 seconds:


 EkmServiceSettings.Builder ekmServiceSettingsBuilder = EkmServiceSettings.newBuilder();
 ekmServiceSettingsBuilder
     .getEkmConnectionSettings()
     .setRetrySettings(
         ekmServiceSettingsBuilder
             .getEkmConnectionSettings()
             .getRetrySettings()
             .toBuilder()
             .setTotalTimeout(Duration.ofSeconds(30))
             .build());
 EkmServiceSettings ekmServiceSettings = ekmServiceSettingsBuilder.build();

EkmServiceSettings.Builder

Builder for EkmServiceSettings.

EncryptRequest

Request message for KeyManagementService.Encrypt.

Protobuf type google.cloud.kms.v1.EncryptRequest

EncryptRequest.Builder

Request message for KeyManagementService.Encrypt.

Protobuf type google.cloud.kms.v1.EncryptRequest

EncryptResponse

Response message for KeyManagementService.Encrypt.

Protobuf type google.cloud.kms.v1.EncryptResponse

EncryptResponse.Builder

Response message for KeyManagementService.Encrypt.

Protobuf type google.cloud.kms.v1.EncryptResponse

ExternalProtectionLevelOptions

ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.

Protobuf type google.cloud.kms.v1.ExternalProtectionLevelOptions

ExternalProtectionLevelOptions.Builder

ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.

Protobuf type google.cloud.kms.v1.ExternalProtectionLevelOptions

GenerateRandomBytesRequest

Request message for KeyManagementService.GenerateRandomBytes.

Protobuf type google.cloud.kms.v1.GenerateRandomBytesRequest

GenerateRandomBytesRequest.Builder

Request message for KeyManagementService.GenerateRandomBytes.

Protobuf type google.cloud.kms.v1.GenerateRandomBytesRequest

GenerateRandomBytesResponse

Response message for KeyManagementService.GenerateRandomBytes.

Protobuf type google.cloud.kms.v1.GenerateRandomBytesResponse

GenerateRandomBytesResponse.Builder

Response message for KeyManagementService.GenerateRandomBytes.

Protobuf type google.cloud.kms.v1.GenerateRandomBytesResponse

GetCryptoKeyRequest

Request message for KeyManagementService.GetCryptoKey.

Protobuf type google.cloud.kms.v1.GetCryptoKeyRequest

GetCryptoKeyRequest.Builder

Request message for KeyManagementService.GetCryptoKey.

Protobuf type google.cloud.kms.v1.GetCryptoKeyRequest

GetCryptoKeyVersionRequest

Request message for KeyManagementService.GetCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.GetCryptoKeyVersionRequest

GetCryptoKeyVersionRequest.Builder

Request message for KeyManagementService.GetCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.GetCryptoKeyVersionRequest

GetEkmConnectionRequest

Request message for [KeyManagementService.GetEkmConnection][].

Protobuf type google.cloud.kms.v1.GetEkmConnectionRequest

GetEkmConnectionRequest.Builder

Request message for [KeyManagementService.GetEkmConnection][].

Protobuf type google.cloud.kms.v1.GetEkmConnectionRequest

GetImportJobRequest

Request message for KeyManagementService.GetImportJob.

Protobuf type google.cloud.kms.v1.GetImportJobRequest

GetImportJobRequest.Builder

Request message for KeyManagementService.GetImportJob.

Protobuf type google.cloud.kms.v1.GetImportJobRequest

GetKeyRingRequest

Request message for KeyManagementService.GetKeyRing.

Protobuf type google.cloud.kms.v1.GetKeyRingRequest

GetKeyRingRequest.Builder

Request message for KeyManagementService.GetKeyRing.

Protobuf type google.cloud.kms.v1.GetKeyRingRequest

GetPublicKeyRequest

Request message for KeyManagementService.GetPublicKey.

Protobuf type google.cloud.kms.v1.GetPublicKeyRequest

GetPublicKeyRequest.Builder

Request message for KeyManagementService.GetPublicKey.

Protobuf type google.cloud.kms.v1.GetPublicKeyRequest

ImportCryptoKeyVersionRequest

Request message for KeyManagementService.ImportCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.ImportCryptoKeyVersionRequest

ImportCryptoKeyVersionRequest.Builder

Request message for KeyManagementService.ImportCryptoKeyVersion.

Protobuf type google.cloud.kms.v1.ImportCryptoKeyVersionRequest

ImportJob

An ImportJob can be used to create CryptoKeys and CryptoKeyVersions using pre-existing key material, generated outside of Cloud KMS. When an ImportJob is created, Cloud KMS will generate a "wrapping key", which is a public/private key pair. You use the wrapping key to encrypt (also known as wrap) the pre-existing key material to protect it during the import process. The nature of the wrapping key depends on the choice of import_method. When the wrapping key generation is complete, the state will be set to ACTIVE and the public_key can be fetched. The fetched public key can then be used to wrap your pre-existing key material. Once the key material is wrapped, it can be imported into a new CryptoKeyVersion in an existing CryptoKey by calling ImportCryptoKeyVersion. Multiple CryptoKeyVersions can be imported with a single ImportJob. Cloud KMS uses the private key portion of the wrapping key to unwrap the key material. Only Cloud KMS has access to the private key. An ImportJob expires 3 days after it is created. Once expired, Cloud KMS will no longer be able to import or unwrap any key material that was wrapped with the ImportJob's public key. For more information, see Importing a key.

Protobuf type google.cloud.kms.v1.ImportJob

ImportJob.Builder

Protobuf type google.cloud.kms.v1.ImportJob

ImportJob.WrappingPublicKey

The public key component of the wrapping key. For details of the type of key this public key corresponds to, see the ImportMethod.

Protobuf type google.cloud.kms.v1.ImportJob.WrappingPublicKey

ImportJob.WrappingPublicKey.Builder

The public key component of the wrapping key. For details of the type of key this public key corresponds to, see the ImportMethod.

Protobuf type google.cloud.kms.v1.ImportJob.WrappingPublicKey

ImportJobName

ImportJobName.Builder

Builder for projects/{project}/locations/{location}/keyRings/{key_ring}/importJobs/{import_job}.

KeyManagementServiceClient

Service Description: Google Cloud Key Management Service

Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

KeyRing
CryptoKey
CryptoKeyVersion
ImportJob

If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

This class provides the ability to make remote calls to the backing service through method calls that map to API methods. Sample code to get started:


 try (KeyManagementServiceClient keyManagementServiceClient =
     KeyManagementServiceClient.create()) {
   KeyRingName name = KeyRingName.of("[PROJECT]", "[LOCATION]", "[KEY_RING]");
   KeyRing response = keyManagementServiceClient.getKeyRing(name);
 }

Note: close() needs to be called on the KeyManagementServiceClient object to clean up resources such as threads. In the example above, try-with-resources is used, which automatically calls close().

The surface of this class includes several types of Java methods for each of the API's methods:

A "flattened" method. With this type of method, the fields of the request type have been converted into function parameters. It may be the case that not all fields are available as parameters, and not every API method will have a flattened method entry point.
A "request object" method. This type of method only takes one parameter, a request object, which must be constructed before the call. Not every API method will have a request object method.
A "callable" method. This type of method takes no parameters and returns an immutable API callable object, which can be used to initiate calls to the service.

See the individual methods for example code.

This class can be customized by passing in a custom instance of KeyManagementServiceSettings to create(). For example:

To customize credentials:


 KeyManagementServiceSettings keyManagementServiceSettings =
     KeyManagementServiceSettings.newBuilder()
         .setCredentialsProvider(FixedCredentialsProvider.create(myCredentials))
         .build();
 KeyManagementServiceClient keyManagementServiceClient =
     KeyManagementServiceClient.create(keyManagementServiceSettings);

To customize the endpoint:


 KeyManagementServiceSettings keyManagementServiceSettings =
     KeyManagementServiceSettings.newBuilder().setEndpoint(myEndpoint).build();
 KeyManagementServiceClient keyManagementServiceClient =
     KeyManagementServiceClient.create(keyManagementServiceSettings);

Please refer to the GitHub repository's samples for more quickstart code snippets.

KeyManagementServiceClient.ListCryptoKeyVersionsFixedSizeCollection

KeyManagementServiceClient.ListCryptoKeyVersionsPage

KeyManagementServiceClient.ListCryptoKeyVersionsPagedResponse

KeyManagementServiceClient.ListCryptoKeysFixedSizeCollection

KeyManagementServiceClient.ListCryptoKeysPage

KeyManagementServiceClient.ListCryptoKeysPagedResponse

KeyManagementServiceClient.ListImportJobsFixedSizeCollection

KeyManagementServiceClient.ListImportJobsPage

KeyManagementServiceClient.ListImportJobsPagedResponse