This is a data encryption key (DEK) (as opposed to
a key encryption key (KEK) stored by Cloud Key Management
Service (Cloud KMS).
When using Cloud KMS to wrap or unwrap a DEK, be sure to set an
appropriate IAM policy on the KEK to ensure an attacker cannot
unwrap the DEK.
This message has oneof_ fields (mutually exclusive fields).
For each oneof, at most one member field can be set at the same time.
Setting any member of the oneof automatically clears all other