Cloud Key Management Service (KMS) V1 API - Class Google::Cloud::Kms::V1::KeyManagementService::Client (v0.24.2)

Reference documentation and code samples for the Cloud Key Management Service (KMS) V1 API class Google::Cloud::Kms::V1::KeyManagementService::Client.

Client for the KeyManagementService service.

Google Cloud Key Management Service

Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

Inherits

  • Object

Includes

Methods

.configure

def self.configure() { |config| ... } -> Client::Configuration

Configure the KeyManagementService Client class.

See Configuration for a description of the configuration fields.

Yields
  • (config) — Configure the Client client.
Yield Parameter
Returns
Example 
# Modify the configuration for all KeyManagementService clients
::Google::Cloud::Kms::V1::KeyManagementService::Client.configure do |config|
  config.timeout = 10.0
end

#asymmetric_decrypt

def asymmetric_decrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::AsymmetricDecryptResponse
def asymmetric_decrypt(name: nil, ciphertext: nil, ciphertext_crc32c: nil) -> ::Google::Cloud::Kms::V1::AsymmetricDecryptResponse

Decrypts data that was encrypted with a public key retrieved from GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_DECRYPT.

Overloads 
def asymmetric_decrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::AsymmetricDecryptResponse
Pass arguments to asymmetric_decrypt via a request object, either of type AsymmetricDecryptRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::AsymmetricDecryptRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def asymmetric_decrypt(name: nil, ciphertext: nil, ciphertext_crc32c: nil) -> ::Google::Cloud::Kms::V1::AsymmetricDecryptResponse
Pass arguments to asymmetric_decrypt via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::AsymmetricDecryptRequest.new

# Call the asymmetric_decrypt method.
result = client.asymmetric_decrypt request

# The returned object is of type Google::Cloud::Kms::V1::AsymmetricDecryptResponse.
p result

#asymmetric_sign

def asymmetric_sign(request, options = nil) -> ::Google::Cloud::Kms::V1::AsymmetricSignResponse
def asymmetric_sign(name: nil, digest: nil, digest_crc32c: nil, data: nil, data_crc32c: nil) -> ::Google::Cloud::Kms::V1::AsymmetricSignResponse

Signs data using a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_SIGN, producing a signature that can be verified with the public key retrieved from GetPublicKey.

Overloads 
def asymmetric_sign(request, options = nil) -> ::Google::Cloud::Kms::V1::AsymmetricSignResponse
Pass arguments to asymmetric_sign via a request object, either of type AsymmetricSignRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::AsymmetricSignRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def asymmetric_sign(name: nil, digest: nil, digest_crc32c: nil, data: nil, data_crc32c: nil) -> ::Google::Cloud::Kms::V1::AsymmetricSignResponse
Pass arguments to asymmetric_sign via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::AsymmetricSignRequest.new

# Call the asymmetric_sign method.
result = client.asymmetric_sign request

# The returned object is of type Google::Cloud::Kms::V1::AsymmetricSignResponse.
p result

#configure

def configure() { |config| ... } -> Client::Configuration

Configure the KeyManagementService Client instance.

The configuration is set to the derived mode, meaning that values can be changed, but structural changes (adding new fields, etc.) are not allowed. Structural changes should be made on Client.configure.

See Configuration for a description of the configuration fields.

Yields
  • (config) — Configure the Client client.
Yield Parameter
Returns

#create_crypto_key

def create_crypto_key(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKey
def create_crypto_key(parent: nil, crypto_key_id: nil, crypto_key: nil, skip_initial_version_creation: nil) -> ::Google::Cloud::Kms::V1::CryptoKey

Create a new CryptoKey within a KeyRing.

CryptoKey.purpose and CryptoKey.version_template.algorithm are required.

Overloads 
def create_crypto_key(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKey
Pass arguments to create_crypto_key via a request object, either of type CreateCryptoKeyRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::CreateCryptoKeyRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def create_crypto_key(parent: nil, crypto_key_id: nil, crypto_key: nil, skip_initial_version_creation: nil) -> ::Google::Cloud::Kms::V1::CryptoKey
Pass arguments to create_crypto_key via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::CreateCryptoKeyRequest.new

# Call the create_crypto_key method.
result = client.create_crypto_key request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKey.
p result

#create_crypto_key_version

def create_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
def create_crypto_key_version(parent: nil, crypto_key_version: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion

Create a new CryptoKeyVersion in a CryptoKey.

The server will assign the next sequential id. If unset, state will be set to ENABLED.

Overloads 
def create_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to create_crypto_key_version via a request object, either of type CreateCryptoKeyVersionRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::CreateCryptoKeyVersionRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def create_crypto_key_version(parent: nil, crypto_key_version: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to create_crypto_key_version via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::CreateCryptoKeyVersionRequest.new

# Call the create_crypto_key_version method.
result = client.create_crypto_key_version request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKeyVersion.
p result

#create_import_job

def create_import_job(request, options = nil) -> ::Google::Cloud::Kms::V1::ImportJob
def create_import_job(parent: nil, import_job_id: nil, import_job: nil) -> ::Google::Cloud::Kms::V1::ImportJob

Create a new ImportJob within a KeyRing.

ImportJob.import_method is required.

Overloads 
def create_import_job(request, options = nil) -> ::Google::Cloud::Kms::V1::ImportJob
Pass arguments to create_import_job via a request object, either of type CreateImportJobRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::CreateImportJobRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def create_import_job(parent: nil, import_job_id: nil, import_job: nil) -> ::Google::Cloud::Kms::V1::ImportJob
Pass arguments to create_import_job via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • parent (::String) — Required. The name of the KeyRing associated with the ImportJobs.
  • import_job_id (::String) — Required. It must be unique within a KeyRing and match the regular expression [a-zA-Z0-9_-]{1,63}
  • import_job (::Google::Cloud::Kms::V1::ImportJob, ::Hash) — Required. An ImportJob with initial field values.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::CreateImportJobRequest.new

# Call the create_import_job method.
result = client.create_import_job request

# The returned object is of type Google::Cloud::Kms::V1::ImportJob.
p result

#create_key_ring

def create_key_ring(request, options = nil) -> ::Google::Cloud::Kms::V1::KeyRing
def create_key_ring(parent: nil, key_ring_id: nil, key_ring: nil) -> ::Google::Cloud::Kms::V1::KeyRing

Create a new KeyRing in a given Project and Location.

Overloads 
def create_key_ring(request, options = nil) -> ::Google::Cloud::Kms::V1::KeyRing
Pass arguments to create_key_ring via a request object, either of type CreateKeyRingRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::CreateKeyRingRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def create_key_ring(parent: nil, key_ring_id: nil, key_ring: nil) -> ::Google::Cloud::Kms::V1::KeyRing
Pass arguments to create_key_ring via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • parent (::String) — Required. The resource name of the location associated with the KeyRings, in the format projects/*/locations/*.
  • key_ring_id (::String) — Required. It must be unique within a location and match the regular expression [a-zA-Z0-9_-]{1,63}
  • key_ring (::Google::Cloud::Kms::V1::KeyRing, ::Hash) — Required. A KeyRing with initial field values.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::CreateKeyRingRequest.new

# Call the create_key_ring method.
result = client.create_key_ring request

# The returned object is of type Google::Cloud::Kms::V1::KeyRing.
p result

#decrypt

def decrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::DecryptResponse
def decrypt(name: nil, ciphertext: nil, additional_authenticated_data: nil, ciphertext_crc32c: nil, additional_authenticated_data_crc32c: nil) -> ::Google::Cloud::Kms::V1::DecryptResponse

Decrypts data that was protected by Encrypt. The CryptoKey.purpose must be ENCRYPT_DECRYPT.

Overloads 
def decrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::DecryptResponse
Pass arguments to decrypt via a request object, either of type DecryptRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::DecryptRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def decrypt(name: nil, ciphertext: nil, additional_authenticated_data: nil, ciphertext_crc32c: nil, additional_authenticated_data_crc32c: nil) -> ::Google::Cloud::Kms::V1::DecryptResponse
Pass arguments to decrypt via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::DecryptRequest.new

# Call the decrypt method.
result = client.decrypt request

# The returned object is of type Google::Cloud::Kms::V1::DecryptResponse.
p result

#destroy_crypto_key_version

def destroy_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
def destroy_crypto_key_version(name: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion

Schedule a CryptoKeyVersion for destruction.

Upon calling this method, CryptoKeyVersion.state will be set to DESTROY_SCHEDULED, and destroy_time will be set to the time destroy_scheduled_duration in the future. At that time, the state will automatically change to DESTROYED, and the key material will be irrevocably destroyed.

Before the destroy_time is reached, RestoreCryptoKeyVersion may be called to reverse the process.

Overloads 
def destroy_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to destroy_crypto_key_version via a request object, either of type DestroyCryptoKeyVersionRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::DestroyCryptoKeyVersionRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def destroy_crypto_key_version(name: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to destroy_crypto_key_version via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameter
  • name (::String) — Required. The resource name of the CryptoKeyVersion to destroy.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::DestroyCryptoKeyVersionRequest.new

# Call the destroy_crypto_key_version method.
result = client.destroy_crypto_key_version request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKeyVersion.
p result

#encrypt

def encrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::EncryptResponse
def encrypt(name: nil, plaintext: nil, additional_authenticated_data: nil, plaintext_crc32c: nil, additional_authenticated_data_crc32c: nil) -> ::Google::Cloud::Kms::V1::EncryptResponse

Encrypts data, so that it can only be recovered by a call to Decrypt. The CryptoKey.purpose must be ENCRYPT_DECRYPT.

Overloads 
def encrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::EncryptResponse
Pass arguments to encrypt via a request object, either of type EncryptRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::EncryptRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def encrypt(name: nil, plaintext: nil, additional_authenticated_data: nil, plaintext_crc32c: nil, additional_authenticated_data_crc32c: nil) -> ::Google::Cloud::Kms::V1::EncryptResponse
Pass arguments to encrypt via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::EncryptRequest.new

# Call the encrypt method.
result = client.encrypt request

# The returned object is of type Google::Cloud::Kms::V1::EncryptResponse.
p result

#generate_random_bytes

def generate_random_bytes(request, options = nil) -> ::Google::Cloud::Kms::V1::GenerateRandomBytesResponse
def generate_random_bytes(location: nil, length_bytes: nil, protection_level: nil) -> ::Google::Cloud::Kms::V1::GenerateRandomBytesResponse

Generate random bytes using the Cloud KMS randomness source in the provided location.

Overloads 
def generate_random_bytes(request, options = nil) -> ::Google::Cloud::Kms::V1::GenerateRandomBytesResponse
Pass arguments to generate_random_bytes via a request object, either of type GenerateRandomBytesRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::GenerateRandomBytesRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def generate_random_bytes(location: nil, length_bytes: nil, protection_level: nil) -> ::Google::Cloud::Kms::V1::GenerateRandomBytesResponse
Pass arguments to generate_random_bytes via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • location (::String) — The project-specific location in which to generate random bytes. For example, "projects/my-project/locations/us-central1".
  • length_bytes (::Integer) — The length in bytes of the amount of randomness to retrieve. Minimum 8 bytes, maximum 1024 bytes.
  • protection_level (::Google::Cloud::Kms::V1::ProtectionLevel) — The ProtectionLevel to use when generating the random data. Currently, only HSM protection level is supported.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::GenerateRandomBytesRequest.new

# Call the generate_random_bytes method.
result = client.generate_random_bytes request

# The returned object is of type Google::Cloud::Kms::V1::GenerateRandomBytesResponse.
p result

#get_crypto_key

def get_crypto_key(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKey
def get_crypto_key(name: nil) -> ::Google::Cloud::Kms::V1::CryptoKey

Returns metadata for a given CryptoKey, as well as its primary CryptoKeyVersion.

Overloads 
def get_crypto_key(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKey
Pass arguments to get_crypto_key via a request object, either of type GetCryptoKeyRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::GetCryptoKeyRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def get_crypto_key(name: nil) -> ::Google::Cloud::Kms::V1::CryptoKey
Pass arguments to get_crypto_key via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameter
  • name (::String) — Required. The name of the CryptoKey to get.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::GetCryptoKeyRequest.new

# Call the get_crypto_key method.
result = client.get_crypto_key request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKey.
p result

#get_crypto_key_version

def get_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
def get_crypto_key_version(name: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion

Returns metadata for a given CryptoKeyVersion.

Overloads 
def get_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to get_crypto_key_version via a request object, either of type GetCryptoKeyVersionRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::GetCryptoKeyVersionRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def get_crypto_key_version(name: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to get_crypto_key_version via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameter
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::GetCryptoKeyVersionRequest.new

# Call the get_crypto_key_version method.
result = client.get_crypto_key_version request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKeyVersion.
p result

#get_import_job

def get_import_job(request, options = nil) -> ::Google::Cloud::Kms::V1::ImportJob
def get_import_job(name: nil) -> ::Google::Cloud::Kms::V1::ImportJob

Returns metadata for a given ImportJob.

Overloads 
def get_import_job(request, options = nil) -> ::Google::Cloud::Kms::V1::ImportJob
Pass arguments to get_import_job via a request object, either of type GetImportJobRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::GetImportJobRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def get_import_job(name: nil) -> ::Google::Cloud::Kms::V1::ImportJob
Pass arguments to get_import_job via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameter
  • name (::String) — Required. The name of the ImportJob to get.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::GetImportJobRequest.new

# Call the get_import_job method.
result = client.get_import_job request

# The returned object is of type Google::Cloud::Kms::V1::ImportJob.
p result

#get_key_ring

def get_key_ring(request, options = nil) -> ::Google::Cloud::Kms::V1::KeyRing
def get_key_ring(name: nil) -> ::Google::Cloud::Kms::V1::KeyRing

Returns metadata for a given KeyRing.

Overloads 
def get_key_ring(request, options = nil) -> ::Google::Cloud::Kms::V1::KeyRing
Pass arguments to get_key_ring via a request object, either of type GetKeyRingRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::GetKeyRingRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def get_key_ring(name: nil) -> ::Google::Cloud::Kms::V1::KeyRing
Pass arguments to get_key_ring via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameter
  • name (::String) — Required. The name of the KeyRing to get.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::GetKeyRingRequest.new

# Call the get_key_ring method.
result = client.get_key_ring request

# The returned object is of type Google::Cloud::Kms::V1::KeyRing.
p result

#get_public_key

def get_public_key(request, options = nil) -> ::Google::Cloud::Kms::V1::PublicKey
def get_public_key(name: nil) -> ::Google::Cloud::Kms::V1::PublicKey

Returns the public key for the given CryptoKeyVersion. The CryptoKey.purpose must be ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT.

Overloads 
def get_public_key(request, options = nil) -> ::Google::Cloud::Kms::V1::PublicKey
Pass arguments to get_public_key via a request object, either of type GetPublicKeyRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::GetPublicKeyRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def get_public_key(name: nil) -> ::Google::Cloud::Kms::V1::PublicKey
Pass arguments to get_public_key via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameter
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::GetPublicKeyRequest.new

# Call the get_public_key method.
result = client.get_public_key request

# The returned object is of type Google::Cloud::Kms::V1::PublicKey.
p result

#iam_policy_client

def iam_policy_client() -> Google::Iam::V1::IAMPolicy::Client

Get the associated client for mix-in of the IAMPolicy.

Returns
  • (Google::Iam::V1::IAMPolicy::Client)

#import_crypto_key_version

def import_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
def import_crypto_key_version(parent: nil, crypto_key_version: nil, algorithm: nil, import_job: nil, wrapped_key: nil, rsa_aes_wrapped_key: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion

Import wrapped key material into a CryptoKeyVersion.

All requests must specify a CryptoKey. If a CryptoKeyVersion is additionally specified in the request, key material will be reimported into that version. Otherwise, a new version will be created, and will be assigned the next sequential id within the CryptoKey.

Overloads 
def import_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to import_crypto_key_version via a request object, either of type ImportCryptoKeyVersionRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::ImportCryptoKeyVersionRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def import_crypto_key_version(parent: nil, crypto_key_version: nil, algorithm: nil, import_job: nil, wrapped_key: nil, rsa_aes_wrapped_key: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to import_crypto_key_version via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • parent (::String) — Required. The name of the CryptoKey to be imported into.

    The create permission is only required on this key when creating a new CryptoKeyVersion.

  • crypto_key_version (::String) — Optional. The optional name of an existing CryptoKeyVersion to target for an import operation. If this field is not present, a new CryptoKeyVersion containing the supplied key material is created.

    If this field is present, the supplied key material is imported into the existing CryptoKeyVersion. To import into an existing CryptoKeyVersion, the CryptoKeyVersion must be a child of ImportCryptoKeyVersionRequest.parent, have been previously created via [ImportCryptoKeyVersion][], and be in DESTROYED or IMPORT_FAILED state. The key material and algorithm must match the previous CryptoKeyVersion exactly if the CryptoKeyVersion has ever contained key material.

  • algorithm (::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm) — Required. The algorithm of the key being imported. This does not need to match the version_template of the CryptoKey this version imports into.
  • import_job (::String) — Required. The name of the ImportJob that was used to wrap this key material.
  • wrapped_key (::String) — Optional. The wrapped key material to import.

    Before wrapping, key material must be formatted. If importing symmetric key material, the expected key material format is plain bytes. If importing asymmetric key material, the expected key material format is PKCS#8-encoded DER (the PrivateKeyInfo structure from RFC 5208).

    When wrapping with import methods (RSA_OAEP_3072_SHA1_AES_256 or RSA_OAEP_4096_SHA1_AES_256 or RSA_OAEP_3072_SHA256_AES_256 or RSA_OAEP_4096_SHA256_AES_256),

    this field must contain the concatenation of:

    1. An ephemeral AES-256 wrapping key wrapped with the public_key using RSAES-OAEP with SHA-1/SHA-256, MGF1 with SHA-1/SHA-256, and an empty label.
    2. The formatted key to be imported, wrapped with the ephemeral AES-256 key using AES-KWP (RFC 5649).

    This format is the same as the format produced by PKCS#11 mechanism CKM_RSA_AES_KEY_WRAP.

    When wrapping with import methods (RSA_OAEP_3072_SHA256 or RSA_OAEP_4096_SHA256),

    this field must contain the formatted key to be imported, wrapped with the public_key using RSAES-OAEP with SHA-256, MGF1 with SHA-256, and an empty label.

  • rsa_aes_wrapped_key (::String) — Optional. This field has the same meaning as wrapped_key. Prefer to use that field in new work. Either that field or this field (but not both) must be specified.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::ImportCryptoKeyVersionRequest.new

# Call the import_crypto_key_version method.
result = client.import_crypto_key_version request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKeyVersion.
p result

#initialize

def initialize() { |config| ... } -> Client

Create a new KeyManagementService client object.

Yields
  • (config) — Configure the KeyManagementService client.
Yield Parameter
Returns
  • (Client) — a new instance of Client
Example 
# Create a client using the default configuration
client = ::Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a client using a custom configuration
client = ::Google::Cloud::Kms::V1::KeyManagementService::Client.new do |config|
  config.timeout = 10.0
end

#list_crypto_key_versions

def list_crypto_key_versions(request, options = nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::CryptoKeyVersion>
def list_crypto_key_versions(parent: nil, page_size: nil, page_token: nil, view: nil, filter: nil, order_by: nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::CryptoKeyVersion>

Lists CryptoKeyVersions.

Overloads 
def list_crypto_key_versions(request, options = nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::CryptoKeyVersion>
Pass arguments to list_crypto_key_versions via a request object, either of type ListCryptoKeyVersionsRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::ListCryptoKeyVersionsRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def list_crypto_key_versions(parent: nil, page_size: nil, page_token: nil, view: nil, filter: nil, order_by: nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::CryptoKeyVersion>
Pass arguments to list_crypto_key_versions via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::ListCryptoKeyVersionsRequest.new

# Call the list_crypto_key_versions method.
result = client.list_crypto_key_versions request

# The returned object is of type Gapic::PagedEnumerable. You can iterate
# over elements, and API calls will be issued to fetch pages as needed.
result.each do |item|
  # Each element is of type ::Google::Cloud::Kms::V1::CryptoKeyVersion.
  p item
end

#list_crypto_keys

def list_crypto_keys(request, options = nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::CryptoKey>
def list_crypto_keys(parent: nil, page_size: nil, page_token: nil, version_view: nil, filter: nil, order_by: nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::CryptoKey>

Lists CryptoKeys.

Overloads 
def list_crypto_keys(request, options = nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::CryptoKey>
Pass arguments to list_crypto_keys via a request object, either of type ListCryptoKeysRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::ListCryptoKeysRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def list_crypto_keys(parent: nil, page_size: nil, page_token: nil, version_view: nil, filter: nil, order_by: nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::CryptoKey>
Pass arguments to list_crypto_keys via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::ListCryptoKeysRequest.new

# Call the list_crypto_keys method.
result = client.list_crypto_keys request

# The returned object is of type Gapic::PagedEnumerable. You can iterate
# over elements, and API calls will be issued to fetch pages as needed.
result.each do |item|
  # Each element is of type ::Google::Cloud::Kms::V1::CryptoKey.
  p item
end

#list_import_jobs

def list_import_jobs(request, options = nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::ImportJob>
def list_import_jobs(parent: nil, page_size: nil, page_token: nil, filter: nil, order_by: nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::ImportJob>

Lists ImportJobs.

Overloads 
def list_import_jobs(request, options = nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::ImportJob>
Pass arguments to list_import_jobs via a request object, either of type ListImportJobsRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::ListImportJobsRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def list_import_jobs(parent: nil, page_size: nil, page_token: nil, filter: nil, order_by: nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::ImportJob>
Pass arguments to list_import_jobs via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • parent (::String) — Required. The resource name of the KeyRing to list, in the format projects/*/locations/*/keyRings/*.
  • page_size (::Integer) — Optional. Optional limit on the number of ImportJobs to include in the response. Further ImportJobs can subsequently be obtained by including the ListImportJobsResponse.next_page_token in a subsequent request. If unspecified, the server will pick an appropriate default.
  • page_token (::String) — Optional. Optional pagination token, returned earlier via ListImportJobsResponse.next_page_token.
  • filter (::String) — Optional. Only include resources that match the filter in the response. For more information, see Sorting and filtering list results.
  • order_by (::String) — Optional. Specify how the results should be sorted. If not specified, the results will be sorted in the default order. For more information, see Sorting and filtering list results.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::ListImportJobsRequest.new

# Call the list_import_jobs method.
result = client.list_import_jobs request

# The returned object is of type Gapic::PagedEnumerable. You can iterate
# over elements, and API calls will be issued to fetch pages as needed.
result.each do |item|
  # Each element is of type ::Google::Cloud::Kms::V1::ImportJob.
  p item
end

#list_key_rings

def list_key_rings(request, options = nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::KeyRing>
def list_key_rings(parent: nil, page_size: nil, page_token: nil, filter: nil, order_by: nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::KeyRing>

Lists KeyRings.

Overloads 
def list_key_rings(request, options = nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::KeyRing>
Pass arguments to list_key_rings via a request object, either of type ListKeyRingsRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::ListKeyRingsRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def list_key_rings(parent: nil, page_size: nil, page_token: nil, filter: nil, order_by: nil) -> ::Gapic::PagedEnumerable<::Google::Cloud::Kms::V1::KeyRing>
Pass arguments to list_key_rings via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • parent (::String) — Required. The resource name of the location associated with the KeyRings, in the format projects/*/locations/*.
  • page_size (::Integer) — Optional. Optional limit on the number of KeyRings to include in the response. Further KeyRings can subsequently be obtained by including the ListKeyRingsResponse.next_page_token in a subsequent request. If unspecified, the server will pick an appropriate default.
  • page_token (::String) — Optional. Optional pagination token, returned earlier via ListKeyRingsResponse.next_page_token.
  • filter (::String) — Optional. Only include resources that match the filter in the response. For more information, see Sorting and filtering list results.
  • order_by (::String) — Optional. Specify how the results should be sorted. If not specified, the results will be sorted in the default order. For more information, see Sorting and filtering list results.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::ListKeyRingsRequest.new

# Call the list_key_rings method.
result = client.list_key_rings request

# The returned object is of type Gapic::PagedEnumerable. You can iterate
# over elements, and API calls will be issued to fetch pages as needed.
result.each do |item|
  # Each element is of type ::Google::Cloud::Kms::V1::KeyRing.
  p item
end

#location_client

def location_client() -> Google::Cloud::Location::Locations::Client

Get the associated client for mix-in of the Locations.

Returns
  • (Google::Cloud::Location::Locations::Client)

#mac_sign

def mac_sign(request, options = nil) -> ::Google::Cloud::Kms::V1::MacSignResponse
def mac_sign(name: nil, data: nil, data_crc32c: nil) -> ::Google::Cloud::Kms::V1::MacSignResponse

Signs data using a CryptoKeyVersion with CryptoKey.purpose MAC, producing a tag that can be verified by another source with the same key.

Overloads 
def mac_sign(request, options = nil) -> ::Google::Cloud::Kms::V1::MacSignResponse
Pass arguments to mac_sign via a request object, either of type MacSignRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::MacSignRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def mac_sign(name: nil, data: nil, data_crc32c: nil) -> ::Google::Cloud::Kms::V1::MacSignResponse
Pass arguments to mac_sign via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • name (::String) — Required. The resource name of the CryptoKeyVersion to use for signing.
  • data (::String) — Required. The data to sign. The MAC tag is computed over this data field based on the specific algorithm.
  • data_crc32c (::Google::Protobuf::Int64Value, ::Hash) — Optional. An optional CRC32C checksum of the MacSignRequest.data. If specified, KeyManagementService will verify the integrity of the received MacSignRequest.data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(MacSignRequest.data) is equal to MacSignRequest.data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::MacSignRequest.new

# Call the mac_sign method.
result = client.mac_sign request

# The returned object is of type Google::Cloud::Kms::V1::MacSignResponse.
p result

#mac_verify

def mac_verify(request, options = nil) -> ::Google::Cloud::Kms::V1::MacVerifyResponse
def mac_verify(name: nil, data: nil, data_crc32c: nil, mac: nil, mac_crc32c: nil) -> ::Google::Cloud::Kms::V1::MacVerifyResponse

Verifies MAC tag using a CryptoKeyVersion with CryptoKey.purpose MAC, and returns a response that indicates whether or not the verification was successful.

Overloads 
def mac_verify(request, options = nil) -> ::Google::Cloud::Kms::V1::MacVerifyResponse
Pass arguments to mac_verify via a request object, either of type MacVerifyRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::MacVerifyRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def mac_verify(name: nil, data: nil, data_crc32c: nil, mac: nil, mac_crc32c: nil) -> ::Google::Cloud::Kms::V1::MacVerifyResponse
Pass arguments to mac_verify via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • name (::String) — Required. The resource name of the CryptoKeyVersion to use for verification.
  • data (::String) — Required. The data used previously as a MacSignRequest.data to generate the MAC tag.
  • data_crc32c (::Google::Protobuf::Int64Value, ::Hash) — Optional. An optional CRC32C checksum of the MacVerifyRequest.data. If specified, KeyManagementService will verify the integrity of the received MacVerifyRequest.data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(MacVerifyRequest.data) is equal to MacVerifyRequest.data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
  • mac (::String) — Required. The signature to verify.
  • mac_crc32c (::Google::Protobuf::Int64Value, ::Hash) — Optional. An optional CRC32C checksum of the MacVerifyRequest.mac. If specified, KeyManagementService will verify the integrity of the received MacVerifyRequest.mac using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C([MacVerifyRequest.tag][]) is equal to MacVerifyRequest.mac_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::MacVerifyRequest.new

# Call the mac_verify method.
result = client.mac_verify request

# The returned object is of type Google::Cloud::Kms::V1::MacVerifyResponse.
p result

#raw_decrypt

def raw_decrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::RawDecryptResponse
def raw_decrypt(name: nil, ciphertext: nil, additional_authenticated_data: nil, initialization_vector: nil, tag_length: nil, ciphertext_crc32c: nil, additional_authenticated_data_crc32c: nil, initialization_vector_crc32c: nil) -> ::Google::Cloud::Kms::V1::RawDecryptResponse

Decrypts data that was originally encrypted using a raw cryptographic mechanism. The CryptoKey.purpose must be RAW_ENCRYPT_DECRYPT.

Overloads 
def raw_decrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::RawDecryptResponse
Pass arguments to raw_decrypt via a request object, either of type RawDecryptRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::RawDecryptRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def raw_decrypt(name: nil, ciphertext: nil, additional_authenticated_data: nil, initialization_vector: nil, tag_length: nil, ciphertext_crc32c: nil, additional_authenticated_data_crc32c: nil, initialization_vector_crc32c: nil) -> ::Google::Cloud::Kms::V1::RawDecryptResponse
Pass arguments to raw_decrypt via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • name (::String) — Required. The resource name of the CryptoKeyVersion to use for decryption.
  • ciphertext (::String) — Required. The encrypted data originally returned in RawEncryptResponse.ciphertext.
  • additional_authenticated_data (::String) — Optional. Optional data that must match the data originally supplied in RawEncryptRequest.additional_authenticated_data.
  • initialization_vector (::String) — Required. The initialization vector (IV) used during encryption, which must match the data originally provided in RawEncryptResponse.initialization_vector.
  • tag_length (::Integer) — The length of the authentication tag that is appended to the end of the ciphertext. If unspecified (0), the default value for the key's algorithm will be used (for AES-GCM, the default value is 16).
  • ciphertext_crc32c (::Google::Protobuf::Int64Value, ::Hash) — Optional. An optional CRC32C checksum of the RawDecryptRequest.ciphertext. If specified, KeyManagementService will verify the integrity of the received ciphertext using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(ciphertext) is equal to ciphertext_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
  • additional_authenticated_data_crc32c (::Google::Protobuf::Int64Value, ::Hash) — Optional. An optional CRC32C checksum of the RawDecryptRequest.additional_authenticated_data. If specified, KeyManagementService will verify the integrity of the received additional_authenticated_data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(additional_authenticated_data) is equal to additional_authenticated_data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
  • initialization_vector_crc32c (::Google::Protobuf::Int64Value, ::Hash) — Optional. An optional CRC32C checksum of the RawDecryptRequest.initialization_vector. If specified, KeyManagementService will verify the integrity of the received initialization_vector using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(initialization_vector) is equal to initialization_vector_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::RawDecryptRequest.new

# Call the raw_decrypt method.
result = client.raw_decrypt request

# The returned object is of type Google::Cloud::Kms::V1::RawDecryptResponse.
p result

#raw_encrypt

def raw_encrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::RawEncryptResponse
def raw_encrypt(name: nil, plaintext: nil, additional_authenticated_data: nil, plaintext_crc32c: nil, additional_authenticated_data_crc32c: nil, initialization_vector: nil, initialization_vector_crc32c: nil) -> ::Google::Cloud::Kms::V1::RawEncryptResponse

Encrypts data using portable cryptographic primitives. Most users should choose Encrypt and Decrypt rather than their raw counterparts. The CryptoKey.purpose must be RAW_ENCRYPT_DECRYPT.

Overloads 
def raw_encrypt(request, options = nil) -> ::Google::Cloud::Kms::V1::RawEncryptResponse
Pass arguments to raw_encrypt via a request object, either of type RawEncryptRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::RawEncryptRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def raw_encrypt(name: nil, plaintext: nil, additional_authenticated_data: nil, plaintext_crc32c: nil, additional_authenticated_data_crc32c: nil, initialization_vector: nil, initialization_vector_crc32c: nil) -> ::Google::Cloud::Kms::V1::RawEncryptResponse
Pass arguments to raw_encrypt via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • name (::String) — Required. The resource name of the CryptoKeyVersion to use for encryption.
  • plaintext (::String) — Required. The data to encrypt. Must be no larger than 64KiB.

    The maximum size depends on the key version's protection_level. For SOFTWARE keys, the plaintext must be no larger than 64KiB. For HSM keys, the combined length of the plaintext and additional_authenticated_data fields must be no larger than 8KiB.

  • additional_authenticated_data (::String) — Optional. Optional data that, if specified, must also be provided during decryption through RawDecryptRequest.additional_authenticated_data.

    This field may only be used in conjunction with an algorithm that accepts additional authenticated data (for example, AES-GCM).

    The maximum size depends on the key version's protection_level. For SOFTWARE keys, the plaintext must be no larger than 64KiB. For HSM keys, the combined length of the plaintext and additional_authenticated_data fields must be no larger than 8KiB.

  • plaintext_crc32c (::Google::Protobuf::Int64Value, ::Hash) — Optional. An optional CRC32C checksum of the RawEncryptRequest.plaintext. If specified, KeyManagementService will verify the integrity of the received plaintext using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(plaintext) is equal to plaintext_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
  • additional_authenticated_data_crc32c (::Google::Protobuf::Int64Value, ::Hash) — Optional. An optional CRC32C checksum of the RawEncryptRequest.additional_authenticated_data. If specified, KeyManagementService will verify the integrity of the received additional_authenticated_data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(additional_authenticated_data) is equal to additional_authenticated_data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
  • initialization_vector (::String) — Optional. A customer-supplied initialization vector that will be used for encryption. If it is not provided for AES-CBC and AES-CTR, one will be generated. It will be returned in RawEncryptResponse.initialization_vector.
  • initialization_vector_crc32c (::Google::Protobuf::Int64Value, ::Hash) — Optional. An optional CRC32C checksum of the RawEncryptRequest.initialization_vector. If specified, KeyManagementService will verify the integrity of the received initialization_vector using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(initialization_vector) is equal to initialization_vector_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::RawEncryptRequest.new

# Call the raw_encrypt method.
result = client.raw_encrypt request

# The returned object is of type Google::Cloud::Kms::V1::RawEncryptResponse.
p result

#restore_crypto_key_version

def restore_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
def restore_crypto_key_version(name: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion

Restore a CryptoKeyVersion in the DESTROY_SCHEDULED state.

Upon restoration of the CryptoKeyVersion, state will be set to DISABLED, and destroy_time will be cleared.

Overloads 
def restore_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to restore_crypto_key_version via a request object, either of type RestoreCryptoKeyVersionRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::RestoreCryptoKeyVersionRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def restore_crypto_key_version(name: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to restore_crypto_key_version via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameter
  • name (::String) — Required. The resource name of the CryptoKeyVersion to restore.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::RestoreCryptoKeyVersionRequest.new

# Call the restore_crypto_key_version method.
result = client.restore_crypto_key_version request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKeyVersion.
p result

#universe_domain

def universe_domain() -> String

The effective universe domain

Returns
  • (String)

#update_crypto_key

def update_crypto_key(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKey
def update_crypto_key(crypto_key: nil, update_mask: nil) -> ::Google::Cloud::Kms::V1::CryptoKey

Update a CryptoKey.

Overloads 
def update_crypto_key(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKey
Pass arguments to update_crypto_key via a request object, either of type UpdateCryptoKeyRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::UpdateCryptoKeyRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def update_crypto_key(crypto_key: nil, update_mask: nil) -> ::Google::Cloud::Kms::V1::CryptoKey
Pass arguments to update_crypto_key via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::UpdateCryptoKeyRequest.new

# Call the update_crypto_key method.
result = client.update_crypto_key request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKey.
p result

#update_crypto_key_primary_version

def update_crypto_key_primary_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKey
def update_crypto_key_primary_version(name: nil, crypto_key_version_id: nil) -> ::Google::Cloud::Kms::V1::CryptoKey

Update the version of a CryptoKey that will be used in Encrypt.

Returns an error if called on a key whose purpose is not ENCRYPT_DECRYPT.

Overloads 
def update_crypto_key_primary_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKey
Pass arguments to update_crypto_key_primary_version via a request object, either of type UpdateCryptoKeyPrimaryVersionRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::UpdateCryptoKeyPrimaryVersionRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def update_crypto_key_primary_version(name: nil, crypto_key_version_id: nil) -> ::Google::Cloud::Kms::V1::CryptoKey
Pass arguments to update_crypto_key_primary_version via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
  • name (::String) — Required. The resource name of the CryptoKey to update.
  • crypto_key_version_id (::String) — Required. The id of the child CryptoKeyVersion to use as primary.
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::UpdateCryptoKeyPrimaryVersionRequest.new

# Call the update_crypto_key_primary_version method.
result = client.update_crypto_key_primary_version request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKey.
p result

#update_crypto_key_version

def update_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
def update_crypto_key_version(crypto_key_version: nil, update_mask: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion

Update a CryptoKeyVersion's metadata.

state may be changed between ENABLED and DISABLED using this method. See DestroyCryptoKeyVersion and RestoreCryptoKeyVersion to move between other states.

Overloads 
def update_crypto_key_version(request, options = nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to update_crypto_key_version via a request object, either of type UpdateCryptoKeyVersionRequest or an equivalent Hash.
Parameters
  • request (::Google::Cloud::Kms::V1::UpdateCryptoKeyVersionRequest, ::Hash) — A request object representing the call parameters. Required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash.
  • options (::Gapic::CallOptions, ::Hash) — Overrides the default settings for this call, e.g, timeout, retries, etc. Optional. 
def update_crypto_key_version(crypto_key_version: nil, update_mask: nil) -> ::Google::Cloud::Kms::V1::CryptoKeyVersion
Pass arguments to update_crypto_key_version via keyword arguments. Note that at least one keyword argument is required. To specify no parameters, or to keep all the default parameter values, pass an empty Hash as a request object (see above).
Parameters
Yields
  • (response, operation) — Access the result along with the RPC operation
Yield Parameters
Returns
Raises
  • (::Google::Cloud::Error) — if the RPC is aborted.
Example

Basic example

require "google/cloud/kms/v1"

# Create a client object. The client can be reused for multiple calls.
client = Google::Cloud::Kms::V1::KeyManagementService::Client.new

# Create a request. To set request fields, pass in keyword arguments.
request = Google::Cloud::Kms::V1::UpdateCryptoKeyVersionRequest.new

# Call the update_crypto_key_version method.
result = client.update_crypto_key_version request

# The returned object is of type Google::Cloud::Kms::V1::CryptoKeyVersion.
p result