Package Classes (2.24.0)

Summary of entries of Classes for cloudkms.

Classes

AutokeyAsyncClient

Provides interfaces for using Cloud KMS Autokey to provision new CryptoKeys, ready for Customer Managed Encryption Key (CMEK) use, on-demand. To support certain client tooling, this feature is modeled around a KeyHandle resource: creating a KeyHandle in a resource project and given location triggers Cloud KMS Autokey to provision a CryptoKey in the configured key project and the same location.

Prior to use in a given resource project, UpdateAutokeyConfig should have been called on an ancestor folder, setting the key project where Cloud KMS Autokey should create new CryptoKeys. See documentation for additional prerequisites. To check what key project, if any, is currently configured on a resource project's ancestor folder, see ShowEffectiveAutokeyConfig.

AutokeyClient

AutokeyAdminAsyncClient

Provides interfaces for managing Cloud KMS Autokey folder-level configurations. A configuration is inherited by all descendent projects. A configuration at one folder overrides any other configurations in its ancestry. Setting a configuration on a folder is a prerequisite for Cloud KMS Autokey, so that users working in a descendant project can request provisioned CryptoKeys, ready for Customer Managed Encryption Key (CMEK) use, on-demand.

AutokeyAdminClient

EkmServiceAsyncClient

Google Cloud Key Management EKM Service

Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

EkmConnection

EkmServiceClient

Google Cloud Key Management EKM Service

Manages external cryptographic keys and operations using those keys. Implements a REST model with the following objects:

EkmConnection

ListEkmConnectionsAsyncPager

A pager for iterating through list_ekm_connections requests.

This class thinly wraps an initial ListEkmConnectionsResponse object, and provides an __aiter__ method to iterate through its ekm_connections field.

If there are more pages, the __aiter__ method will make additional ListEkmConnections requests and continue to iterate through the ekm_connections field on the corresponding responses.

All the usual ListEkmConnectionsResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

ListEkmConnectionsPager

A pager for iterating through list_ekm_connections requests.

This class thinly wraps an initial ListEkmConnectionsResponse object, and provides an __iter__ method to iterate through its ekm_connections field.

If there are more pages, the __iter__ method will make additional ListEkmConnections requests and continue to iterate through the ekm_connections field on the corresponding responses.

All the usual ListEkmConnectionsResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

KeyManagementServiceAsyncClient

Google Cloud Key Management Service

Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

KeyRing
CryptoKey
CryptoKeyVersion
ImportJob

If you are using manual gRPC libraries, see Using gRPC with Cloud KMS <https://cloud.google.com/kms/docs/grpc>__.

KeyManagementServiceClient

Google Cloud Key Management Service

Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

KeyRing
CryptoKey
CryptoKeyVersion
ImportJob

If you are using manual gRPC libraries, see Using gRPC with Cloud KMS <https://cloud.google.com/kms/docs/grpc>__.

ListCryptoKeyVersionsAsyncPager

A pager for iterating through list_crypto_key_versions requests.

This class thinly wraps an initial ListCryptoKeyVersionsResponse object, and provides an __aiter__ method to iterate through its crypto_key_versions field.

If there are more pages, the __aiter__ method will make additional ListCryptoKeyVersions requests and continue to iterate through the crypto_key_versions field on the corresponding responses.

All the usual ListCryptoKeyVersionsResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

ListCryptoKeyVersionsPager

A pager for iterating through list_crypto_key_versions requests.

This class thinly wraps an initial ListCryptoKeyVersionsResponse object, and provides an __iter__ method to iterate through its crypto_key_versions field.

If there are more pages, the __iter__ method will make additional ListCryptoKeyVersions requests and continue to iterate through the crypto_key_versions field on the corresponding responses.

All the usual ListCryptoKeyVersionsResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

ListCryptoKeysAsyncPager

A pager for iterating through list_crypto_keys requests.

This class thinly wraps an initial ListCryptoKeysResponse object, and provides an __aiter__ method to iterate through its crypto_keys field.

If there are more pages, the __aiter__ method will make additional ListCryptoKeys requests and continue to iterate through the crypto_keys field on the corresponding responses.

All the usual ListCryptoKeysResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

ListCryptoKeysPager

A pager for iterating through list_crypto_keys requests.

This class thinly wraps an initial ListCryptoKeysResponse object, and provides an __iter__ method to iterate through its crypto_keys field.

If there are more pages, the __iter__ method will make additional ListCryptoKeys requests and continue to iterate through the crypto_keys field on the corresponding responses.

All the usual ListCryptoKeysResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

ListImportJobsAsyncPager

A pager for iterating through list_import_jobs requests.

This class thinly wraps an initial ListImportJobsResponse object, and provides an __aiter__ method to iterate through its import_jobs field.

If there are more pages, the __aiter__ method will make additional ListImportJobs requests and continue to iterate through the import_jobs field on the corresponding responses.

All the usual ListImportJobsResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

ListImportJobsPager

A pager for iterating through list_import_jobs requests.

This class thinly wraps an initial ListImportJobsResponse object, and provides an __iter__ method to iterate through its import_jobs field.

If there are more pages, the __iter__ method will make additional ListImportJobs requests and continue to iterate through the import_jobs field on the corresponding responses.

All the usual ListImportJobsResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

ListKeyRingsAsyncPager

A pager for iterating through list_key_rings requests.

This class thinly wraps an initial ListKeyRingsResponse object, and provides an __aiter__ method to iterate through its key_rings field.

If there are more pages, the __aiter__ method will make additional ListKeyRings requests and continue to iterate through the key_rings field on the corresponding responses.

All the usual ListKeyRingsResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

ListKeyRingsPager

A pager for iterating through list_key_rings requests.

This class thinly wraps an initial ListKeyRingsResponse object, and provides an __iter__ method to iterate through its key_rings field.

If there are more pages, the __iter__ method will make additional ListKeyRings requests and continue to iterate through the key_rings field on the corresponding responses.

All the usual ListKeyRingsResponse attributes are available on the pager. If multiple requests are made, only the most recent response is retained, and thus used for attribute lookup.

AccessReason

Describes the reason for a data access. Please refer to https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes for the detailed semantic meaning of justification reason codes.

    -  A Google administrator has reset the root-access account
       associated with the user's organization within the past 7
       days.
    -  A Google-initiated emergency access operation has
       interacted with a resource in the same project or folder
       as the currently accessed resource within the past 7
       days.
MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION (9):
    Google systems access customer data to help optimize the
    structure of the data or quality for future uses by the
    customer, and one of the following is true:

    -  A Google administrator has reset the root-access account
       associated with the user's organization within the past 7
       days.
    -  A Google-initiated emergency access operation has
       interacted with a resource in the same project or folder
       as the currently accessed resource within the past 7
       days.
GOOGLE_RESPONSE_TO_PRODUCTION_ALERT (10):
    Google-initiated access to maintain system
    reliability.
CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING (11):
    One of the following operations is being executed while
    simultaneously encountering an internal technical issue
    which prevented a more precise justification code from being
    generated:

    -  Your account has been used to perform any access to your
       own data which your IAM policy authorizes.
    -  An automated Google system operates on encrypted customer
       data which your IAM policy authorizes.
    -  Customer-initiated Google support access.
    -  Google-initiated support access to protect system
       reliability.

AsymmetricDecryptRequest

Request message for KeyManagementService.AsymmetricDecrypt.

AsymmetricDecryptResponse

Response message for KeyManagementService.AsymmetricDecrypt.

AsymmetricSignRequest

Request message for KeyManagementService.AsymmetricSign.

AsymmetricSignResponse

Response message for KeyManagementService.AsymmetricSign.

AutokeyConfig

Cloud KMS Autokey configuration for a folder.

Certificate

A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.

CreateCryptoKeyRequest

Request message for KeyManagementService.CreateCryptoKey.

CreateCryptoKeyVersionRequest

Request message for KeyManagementService.CreateCryptoKeyVersion.

CreateEkmConnectionRequest

Request message for EkmService.CreateEkmConnection.

CreateImportJobRequest

Request message for KeyManagementService.CreateImportJob.

CreateKeyHandleMetadata

Metadata message for CreateKeyHandle long-running operation response.

CreateKeyHandleRequest

Request message for Autokey.CreateKeyHandle.

CreateKeyRingRequest

Request message for KeyManagementService.CreateKeyRing.

CryptoKey

A CryptoKey represents a logical key that can be used for cryptographic operations.

A CryptoKey is made up of zero or more versions, which represent the actual key material used in cryptographic operations.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

CryptoKeyPurpose

CryptoKeyPurpose describes the cryptographic capabilities of a CryptoKey. A given key can only be used for the operations allowed by its purpose. For more information, see Key purposes <https://cloud.google.com/kms/docs/algorithms#key_purposes>__.

LabelsEntry

The abstract base class for a message.

CryptoKeyVersion

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material.

An ENABLED version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

CryptoKeyVersionAlgorithm

The algorithm of the CryptoKeyVersion, indicating what parameters must be used for each cryptographic operation.

The GOOGLE_SYMMETRIC_ENCRYPTION algorithm is usable with CryptoKey.purpose ENCRYPT_DECRYPT.

Algorithms beginning with RSA_SIGN_ are usable with CryptoKey.purpose ASYMMETRIC_SIGN.

The fields in the name after RSA_SIGN_ correspond to the following parameters: padding algorithm, modulus bit length, and digest algorithm.

For PSS, the salt length used is equal to the length of digest algorithm. For example, RSA_SIGN_PSS_2048_SHA256 will use PSS with a salt length of 256 bits or 32 bytes.

Algorithms beginning with RSA_DECRYPT_ are usable with CryptoKey.purpose ASYMMETRIC_DECRYPT.

The fields in the name after RSA_DECRYPT_ correspond to the following parameters: padding algorithm, modulus bit length, and digest algorithm.

Algorithms beginning with EC_SIGN_ are usable with CryptoKey.purpose ASYMMETRIC_SIGN.

The fields in the name after EC_SIGN_ correspond to the following parameters: elliptic curve, digest algorithm.

Algorithms beginning with HMAC_ are usable with CryptoKey.purpose MAC.

The suffix following HMAC_ corresponds to the hash algorithm being used (eg. SHA256).

For more information, see Key purposes and algorithms.

CryptoKeyVersionState

The state of a CryptoKeyVersion, indicating if it can be used.

CryptoKeyVersionView

A view for CryptoKeyVersions. Controls the level of detail returned for CryptoKeyVersions in KeyManagementService.ListCryptoKeyVersions and KeyManagementService.ListCryptoKeys.

CryptoKeyVersionTemplate

A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.

DecryptRequest

Request message for KeyManagementService.Decrypt.

DecryptResponse

Response message for KeyManagementService.Decrypt.

DestroyCryptoKeyVersionRequest

Request message for KeyManagementService.DestroyCryptoKeyVersion.

Digest

A Digest holds a cryptographic message digest.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

EkmConfig

An EkmConfig is a singleton resource that represents configuration parameters that apply to all CryptoKeys and CryptoKeyVersions with a ProtectionLevel of EXTERNAL_VPC][CryptoKeyVersion.ProtectionLevel.EXTERNAL_VPC] in a given project and location.

EkmConnection

An EkmConnection represents an individual EKM connection. It can be used for creating CryptoKeys and CryptoKeyVersions with a ProtectionLevel of EXTERNAL_VPC][CryptoKeyVersion.ProtectionLevel.EXTERNAL_VPC], as well as performing cryptographic operations using keys created within the EkmConnection.

KeyManagementMode

KeyManagementMode describes who can perform control plane cryptographic operations using this EkmConnection.

    -  When creating a
       <xref uid="google.cloud.kms.v1.CryptoKeyVersion">CryptoKeyVersion</xref>
       associated with this
       <xref uid="google.cloud.kms.v1.EkmConnection">EkmConnection</xref>, the
       caller must supply the key path of pre-existing external
       key material that will be linked to the
       <xref uid="google.cloud.kms.v1.CryptoKeyVersion">CryptoKeyVersion</xref>.
    -  Destruction of external key material cannot be requested
       via the Cloud KMS API and must be performed directly in
       the EKM.
    -  Automatic rotation of key material is not supported.
CLOUD_KMS (2):
    All <xref uid="google.cloud.kms.v1.CryptoKey">CryptoKeys</xref> created with
    this <xref uid="google.cloud.kms.v1.EkmConnection">EkmConnection</xref> use
    EKM-side key management operations initiated from Cloud KMS.
    This means that:

    -  When a
       <xref uid="google.cloud.kms.v1.CryptoKeyVersion">CryptoKeyVersion</xref>
       associated with this
       <xref uid="google.cloud.kms.v1.EkmConnection">EkmConnection</xref> is
       created, the EKM automatically generates new key material
       and a new key path. The caller cannot supply the key path
       of pre-existing external key material.
    -  Destruction of external key material associated with this
       <xref uid="google.cloud.kms.v1.EkmConnection">EkmConnection</xref> can be
       requested by calling
       `DestroyCryptoKeyVersion][EkmService.DestroyCryptoKeyVersion]`.
    -  Automatic rotation of key material is supported.

ServiceResolver

A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.

EncryptRequest

Request message for KeyManagementService.Encrypt.

EncryptResponse

Response message for KeyManagementService.Encrypt.

ExternalProtectionLevelOptions

ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.

GenerateRandomBytesRequest

Request message for KeyManagementService.GenerateRandomBytes.

GenerateRandomBytesResponse

Response message for KeyManagementService.GenerateRandomBytes.

GetAutokeyConfigRequest

Request message for GetAutokeyConfig.

GetCryptoKeyRequest

Request message for KeyManagementService.GetCryptoKey.

GetCryptoKeyVersionRequest

Request message for KeyManagementService.GetCryptoKeyVersion.

GetEkmConfigRequest

Request message for EkmService.GetEkmConfig.

GetEkmConnectionRequest

Request message for EkmService.GetEkmConnection.

GetImportJobRequest

Request message for KeyManagementService.GetImportJob.

GetKeyHandleRequest

Request message for GetKeyHandle.

GetKeyRingRequest

Request message for KeyManagementService.GetKeyRing.

GetPublicKeyRequest

Request message for KeyManagementService.GetPublicKey.

ImportCryptoKeyVersionRequest

Request message for KeyManagementService.ImportCryptoKeyVersion.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

ImportJob

An ImportJob can be used to create CryptoKeys and CryptoKeyVersions using pre-existing key material, generated outside of Cloud KMS.

When an ImportJob is created, Cloud KMS will generate a "wrapping key", which is a public/private key pair. You use the wrapping key to encrypt (also known as wrap) the pre-existing key material to protect it during the import process. The nature of the wrapping key depends on the choice of import_method. When the wrapping key generation is complete, the state will be set to ACTIVE and the public_key can be fetched. The fetched public key can then be used to wrap your pre-existing key material.

Once the key material is wrapped, it can be imported into a new CryptoKeyVersion in an existing CryptoKey by calling ImportCryptoKeyVersion. Multiple CryptoKeyVersions can be imported with a single ImportJob. Cloud KMS uses the private key portion of the wrapping key to unwrap the key material. Only Cloud KMS has access to the private key.

An ImportJob expires 3 days after it is created. Once expired, Cloud KMS will no longer be able to import or unwrap any key material that was wrapped with the ImportJob's public key.

For more information, see Importing a key <https://cloud.google.com/kms/docs/importing-a-key>__.

    See
    https://www.marvell.com/products/security-solutions/nitrox-hs-adapters/software-key-attestation.html.
CAVIUM_V2_COMPRESSED (4):
    Cavium HSM attestation V2 compressed with
    gzip. This is a new format introduced in
    Cavium's version 3.2-08.

Modules

pagers

API documentation for kms_v1.services.ekm_service.pagers module.

pagers

API documentation for kms_v1.services.key_management_service.pagers module.