Cloud Key Management Service (KMS) V1 API - Module Google::Cloud::Kms::V1::EkmConnection::KeyManagementMode (v0.24.3)

Version 0.24.3

• 1.3.0 (latest)
• 1.2.1
• 1.1.0
• 1.0.2
• 0.27.0
• 0.26.0
• 0.25.1
• 0.24.3
• 0.23.0
• 0.22.1
• 0.21.0
• 0.20.0
• 0.19.0
• 0.18.1
• 0.17.0
• 0.16.0
• 0.15.0
• 0.14.0
• 0.13.0
• 0.12.0
• 0.11.0
• 0.10.2

Reference documentation and code samples for the Cloud Key Management Service (KMS) V1 API module Google::Cloud::Kms::V1::EkmConnection::KeyManagementMode.

KeyManagementMode describes who can perform control plane cryptographic operations using this EkmConnection.

Constants

KEY_MANAGEMENT_MODE_UNSPECIFIED

value: 0
Not specified.

MANUAL

value: 1

EKM-side key management operations on CryptoKeys created with this EkmConnection must be initiated from the EKM directly and cannot be performed from Cloud KMS. This means that:

• When creating a CryptoKeyVersion associated with this EkmConnection, the caller must supply the key path of pre-existing external key material that will be linked to the CryptoKeyVersion.
• Destruction of external key material cannot be requested via the Cloud KMS API and must be performed directly in the EKM.
• Automatic rotation of key material is not supported.

CLOUD_KMS

value: 2

All CryptoKeys created with this EkmConnection use EKM-side key management operations initiated from Cloud KMS. This means that:

• When a CryptoKeyVersion associated with this EkmConnection is created, the EKM automatically generates new key material and a new key path. The caller cannot supply the key path of pre-existing external key material.
• Destruction of external key material associated with this EkmConnection can be requested by calling [DestroyCryptoKeyVersion][EkmService.DestroyCryptoKeyVersion].
• Automatic rotation of key material is supported.