This topic shows you how to import a cryptographic key into Cloud HSM or Cloud Key Management Service.
For more details about importing keys, including limitations and restrictions, refer to Key import.
You can complete the steps in this topic in 5 to 10 minutes, not including the Before you begin steps. Wrapping the key manually adds complexity to the task.
Before you begin
It is recommended that you create a new project to test this feature, to ease clean-up after testing and to ensure that you have adequate IAM permissions to import a key.
Before you can import a key, you need to prepare the project, the local system, and the key itself.
Preparing the project
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
-
In the Google Cloud Console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Cloud project. Learn how to confirm that billing is enabled for your project.
- Enable the required API.
- Install and initialize the Cloud SDK.
-
The user performing the import needs the following IAM permissions to create key rings, keys, and import jobs. If the user is not the project owner, you can assign both of the following two pre-defined roles to the user:
roles/editor
roles/cloudkms.importer
For more information about available IAM roles and permissions for Cloud KMS, refer to Permissions and roles.
Preparing the local system
Prepare the local system by choosing one of the following options. Automatic key wrapping is recommended for most users.
- If you want to allow the
gcloud
command-line tool to wrap your keys automatically before transmitting them to Google Cloud, you must install the Pyca cryptography library on your local system. The Pyca library is used by the import job that wraps and protects the key locally before sending it to Google Cloud. - If you want to wrap your keys manually, you must configure OpenSSL for manual key wrapping.
Preparing the key
Verify that your key's algorithm and length are supported. Allowable algorithms for a key depend upon whether the key is used for symmetric encryption, asymmetric encryption or asymmetric signing, as well as whether the key is stored in software or an HSM. You specify the key's algorithm as part of the import request.
Separately, you must also verify how the key is encoded, and make adjustments if necessary.
The following cannot be changed for a key version after it is created or imported:
The key's protection level indicates whether the key persists in software, in an HSM, or in an external key management system. Key material cannot be moved from one of these storage environments to another. A key's versions all have the same protection level.
The key's purpose indicates whether the key's versions are used for symmetric encryption, asymmetric encryption, or asymmetric signing. A key's purpose limits the possible algorithms that can be used to create versions of that key. A key's versions all have the same purpose.
If you don't have a key to import but want to validate the procedure for importing keys, you can create a symmetric key on the local system, using the following command:
openssl rand 32 > ${HOME}/test.bin
Use this key for testing only. A key created this way might not be appropriate for production use.
If you need to wrap the key manually, do that before continuing with the procedures in this topic.
Create the target key and key ring
A Cloud KMS key is a container object that contains zero or more key versions. Each key version contains a cryptographic key.
When you import a key into Cloud KMS or Cloud HSM, the imported key becomes a new key version on an existing Cloud KMS or Cloud HSM key. In the rest of this topic, this key is called the target key. The target key must exist before you can import key material into it.
Importing a key version has no effect on that key's existing versions. However, It is recommended to create an empty key when testing key import. An empty key has no version, isn't active, and can't be used.
A key exists on a key ring; in this topic, this key ring is called the target key ring. The location of the target key ring determines the location where the key material is available after import. Cloud HSM keys cannot be created or imported in some locations. After a key is created, it cannot be moved to a different key ring or location.
Follow these steps to create an empty key on a new key ring using the
gcloud
command-line tool or the Google Cloud Console.
Web UI
Go to the Cryptographic Keys page in the Cloud Console.
Click Create key ring.
In the Key ring name field, enter the name for your key ring.
From the Location dropdown, select a location.
Click Create. The detail page for the key ring opens.
Click Create key.
Select Imported key. This prevents an initial key version from being created.
In the Key name field, enter the name for your key.
Set the Protection level to either Software or HSM.
[Optional] For imported keys, automatic rotation is disabled by default. If you enable automatic rotation, new key versions will be generated in Cloud KMS, and the imported key version will no longer be the default key version after a rotation.
[Optional] In the Labels field, click Add label if you want to [add labels to your key][4].
Click Create.
Command-line
To use Cloud KMS on the command line, first Install or upgrade to the latest version of Cloud SDK.
Create the target key ring. If you intend to import into a Cloud HSM key, select a location with support for Cloud HSM.
gcloud kms keyrings create key-ring-name \ --location location
You can learn more about creating key rings.
Create the target key.
- Set the key's purpose:
- For a symmetric key, set the purpose to
encryption
. - For an asymmetric key, set the purpose to either
asymmetric-signing
orasymmetric-encryption
.
- For a symmetric key, set the purpose to
- Prevent an initial version from being created by using the
--skip-initial-version-creation
flag. - [Optional] Do not specify a rotation policy. If you enable automatic rotation, new key versions will be generated in Cloud KMS, and the imported key version will no longer be the default key version after a rotation.
gcloud kms keys create key-name \ --location location \ --keyring key-ring-name \ --purpose purpose \ --skip-initial-version-creation
You can learn more about creating Cloud KMS keys or Cloud HSM keys.
- Set the key's purpose:
Python
To run this code, first set up a Python development environment and install the Cloud KMS Python SDK.
API
These examples use curl as an HTTP client to demonstrate using the API. For more information about access control, see Accessing the Cloud KMS API.
curl "https://cloudkms.googleapis.com/v1/projects/project-id/locations/location-id/keyRings?keyRingId=key-ring-name" \ --request "POST" \ --header "authorization: Bearer token" \ --header "content-type: application/json" \ --header "x-goog-user-project: project-id" \ --data "{}"
See the KeyRing.create
API documentation
for more information.
curl "https://cloudkms.googleapis.com/v1/projects/project-id/locations/location-id/keyRings/key-ring-name/cryptoKeys?cryptoKeyId=key-name&skipInitialVersionCreation=true" \ --request "POST" \ --header "authorization: Bearer token" \ --header "content-type: application/json" \ --header "x-goog-user-project: project-id" \ --data "{"purpose":"purpose", "versionTemplate":{"protectionLevel":"protection-level","algorithm":"algorithm"}}"
See the CryptoKey.create
API documentation
for more information.
The key ring and key now exist, but the key contains no key material, has no version, and is not active. Next, you create an import job.
Create the import job
An import job defines the characteristics of the keys it imports, including properties that cannot be changed after the key is imported.
The protection level defines whether keys that result from this import job will reside in software, in a HSM, or in an external key management system. The protection level can't be changed after the key is eventually imported.
The import method defines the algorithm used to create the wrapping key that protects imported keys during transit from your local system to the target Google Cloud project. You can choose a 3072-bit or a 4096- bit RSA key. Unless you have specific requirements, the 3072-bit wrapping key is recommended.
You can create an import job using the gcloud
tool, the
Cloud Console, or the Cloud Key Management Service API.
Web UI
Go to the Cryptographic Keys page in the Cloud Console.
Click the name of the target key ring.
Set the Protection level to either Software or HSM. Use the same protection level as you set for the target key.
Click Create import job.
In the Name field, enter the name for your import job.
From the Import method dropdown, set the import method to either 3072 bit RSA or 4096 bit RSA.
Click Create.
Command-line
To use Cloud KMS on the command line, first Install or upgrade to the latest version of Cloud SDK.
Use a command like the following to create an import job.
gcloud kms import-jobs create import-job \ --location location \ --keyring key-ring-name \ --import-method import-method \ --protection-level protection-level
- Use the same key ring and location as the target key.
- Set the protection level to either
software
orhsm
. - Set the import method to either
rsa-oaep-3072-sha1-aes-256
orrsa-oaep-4096-sha1-aes-256
.
Python
To run this code, first set up a Python development environment and install the Cloud KMS Python SDK.
API
These examples use curl as an HTTP client to demonstrate using the API. For more information about access control, see Accessing the Cloud KMS API.
Create an instance of the
ImportJob
type, and specify values for theImportJob.protectionLevel
andImportJob.importMethod
fields.Using your instance of
ImportJob
as the request body, call theImportJob.create
method.
Checking the state of the import job
The initial state for an import job is PENDING_GENERATION
. When the state is
ACTIVE
, you can use it to import keys.
An import job expires after three days. If the import job is expired, you must create a new one.
You can check the status of an import job using the gcloud
command-line tool, the
Google Cloud Console, or the Cloud Key Management Service API.
Web UI
Go to the Cryptographic Keys page in the Cloud Console.
Click the name of the key ring that contains your import job.
Click the Import Jobs tab at the top of the page.
The state will be visible under Status next to your import job's name.
Command-line
To use Cloud KMS on the command line, first Install or upgrade to the latest version of Cloud SDK.
When an import job is active, you can use it to import keys. This may take a few minutes. Use this command to verify that the import job is active. Use the location and keyring where you created the import job.
gcloud kms import-jobs describe import-job \ --location location \ --keyring key-ring-name \ --format="value(state)"
state: ACTIVE
Python
To run this code, first set up a Python development environment and install the Cloud KMS Python SDK.
API
These examples use curl as an HTTP client to demonstrate using the API. For more information about access control, see Accessing the Cloud KMS API.
Call the ImportJob.get
method and check the state
field. If
state
is PENDING_GENERATION
, the import job is still being created.
Periodically recheck the state until it is ACTIVE
.
As soon as the import job is active, you can make a request to import a key.
Preventing modification of import jobs
The import job determines many characteristics of the imported key, including the key's algorithm and whether an imported key is an HSM key or a software key. You can configure Identity and Access Management permissions to prevent users from creating import jobs, while allowing them to use import jobs to import keys.
- Only grant key administrators the
importjobs.create
. - Grant the
importjobs.useToImport
permission for a specific import job to the operator who will use that job to import keys. - When you create the import job, specify the protection level and algorithm for keys imported using it.
Until the import job expires, users who have the importjobs.useToImport
and
do not have the importjobs.create
permission for a given import job can import
keys, but cannot modify the characteristics of the import job.
Import the key
After checking the status of the import job, you can make an import request.
You use different flags to make the import request, depending on whether you
want the gcloud
command-line tool to wrap your key automatically or if you have already
wrapped your key manually.
Regardless of whether you wrapped your key manually or automatically, you must set the algorithm to a supported algorithm that matches the length of the actual key to be imported, and specifies the key's purpose.
Keys with purpose
ENCRYPT_DECRYPT
use thegoogle-symmetric-encryption
algorithm, and have a length of 32.Keys with purpose
ASYMMETRIC_ENCRYPT
orASYMMETRIC_SIGN
support a variety of algorithms and lengths.A key's purpose cannot be changed after the key is created, but subsequent key versions can be created at different lengths than the initial key version.
Automatically wrapping and importing a key
If you want to use automatic wrapping, you must use the gcloud
command-line tool.
Use a command like the following. Set --target-key-file
to the location of the
unwrapped key to wrap and import. Do not set -rsa-aes-wrapped-key-file
.
You can optionally set the
--public-key-file
flag to the location where the public key has already been
downloaded. When importing a large number of keys, this prevents the public key
from being downloaded during each import. For example, you could write a script
that downloaded the public key once, then provided its location when importing
each key.
gcloud kms keys versions import \ --import-job import-job \ --location location \ --keyring key-ring-name \ --key key-name \ --algorithm algorithm-name \ --target-key-file path-to-unwrapped-key-to-import
The key is wrapped by the wrapping key associated with the import job, transmitted to Google Cloud, and imported as a new key version on the target key.
Importing a manually-wrapped key
Use the instructions in this section to import a key that
you have wrapped manually. Set
--rsa-aes-wrapped-key-file
to the location of key that you manually wrapped.
Do not set --target-key-file
.
You can optionally set the
--public-key-file
flag to the location where the public key has already been
downloaded. When importing a large number of keys, this prevents the public key
from being downloaded during each import. For example, you could write a script
that downloaded the public key once, then provided its location when importing
each key.
Web UI
Open the Cryptographic Keys page in the Cloud Console.
Click the name of the key ring that contains your import job. The target key is shown, along with any other keys on the key ring.
Click the name of the target key, then click Import key version.
Select your import job from the Select import job dropdown.
In the Upload the wrapped key selector, select the key that you have already wrapped.
If you are importing an asymmetric key, select the algorithm from the Algorithm dropdown. Your Import key version page should look similar to:
Click Import.
Command-line
To use Cloud KMS on the command line, first Install or upgrade to the latest version of Cloud SDK.
Use a command like the following.
gcloud kms keys versions import \ --import-job import-job \ --location location \ --keyring key-ring-name \ --key key-name \ --algorithm algorithm-name \ --rsa-aes-wrapped-key-file path-to-wrapped-key-to-import
For more information, see the output of the
gcloud kms keys versions import --help
command.
Python
To run this code, first set up a Python development environment and install the Cloud KMS Python SDK.
API
These examples use curl as an HTTP client to demonstrate using the API. For more information about access control, see Accessing the Cloud KMS API.
For the request body of the
cryptoKeyVersions.import
method, set thealgorithm
field to the algorithm of the key being imported. This value does not need to match theversionTemplate
of theCryptoKey
that is importing this version. Thealgorithm
field is of typeCryptoKeyVersionAlgorithm
.Also for the request body, set the
wrappedKeyMaterial
field to the key material that you that you have already wrapped.Call the
cryptoKeyVersions.import
method. ThecryptoKeyVersions.import
response is of typeCryptoKeyVersion
. When a key is successfully imported, its state isENABLED
and you can use it in Cloud KMS.
The key-import request is initiated. You can monitor its status.
Check the state of the imported key
The initial state for an imported key is PENDING_IMPORT
. When the state is
ENABLED
, the key has been imported successfully. If the import fails, the
status is IMPORT_FAILED
.
You can check the status of an import request using the gcloud
command-line tool, the
Google Cloud Console, or the Cloud Key Management Service API.
Web UI
Open the Cryptographic Keys page in the Cloud Console.
Click the name of the key ring that contains your import job.
Click the Import Jobs tab at the top of the page.
The state will be visible under Status next to your import job's name.
Command-line
To use Cloud KMS on the command line, first Install or upgrade to the latest version of Cloud SDK.
Use the versions list
command to check the state. Use the same
location, target key ring, and target key that you created earlier in this
topic.
gcloud kms keys versions list \ --keyring keyring \ --location location \ --key key-name
Python
To run this code, first set up a Python development environment and install the Cloud KMS Python SDK.
API
These examples use curl as an HTTP client to demonstrate using the API. For more information about access control, see Accessing the Cloud KMS API.
Call the ImportJob.get
method and check the
state
field. If
state
is PENDING_GENERATION
, the import job is still being created.
Periodically recheck the state until it is ACTIVE
.
After the key is imported, its status changes to Active. For symmetric keys, you must set the imported key version as the primary version before you can use the key.
Symmetric keys: Set the primary version
This step is required when importing symmetric keys, and is not relevant for
asymmetric keys. An asymmetric key does not have a primary version. You must
use the gcloud
command-line tool to set the primary version.
gcloud kms keys set-primary-version key-name --version=version-number
What's next
- Verify an imported key. the key material, then you can use the key for signing or to protect data.
- Troubleshoot a failed key import.