hmac - CRUD operations on service account HMAC keys.
gsutil hmac create [-p project] service_account_email gsutil hmac delete [-p project] access_id gsutil hmac get [-p project] access_id gsutil hmac list [-a] [-l] [-p project] [-u service_account_email] gsutil hmac update -s <ACTIVE|INACTIVE> [-e etag] [-p project] access_id
The hmac command is used to interact with service account HMAC keys.
The hmac command has five sub-commands:
hmac create command creates an HMAC key for the specified service
gsutil hmac create test.service.account@test_project.iam.gserviceaccount.com
The secret key material is only available upon creation, so be sure to store the returned secret along with the access_id.
The "create" sub-command has the following option
|Specify a project in which to create a key.|
hmac delete command permanently deletes the specified HMAC key:
gsutil hmac delete GOOG56JBMFZX6PMPTQ62VD2
Note that keys must be updated to be in the INACTIVE state before they can be deleted.
The "delete" sub-command has the following option
|Specify a project from which to delete a key.|
hmac get command retrieves the specified HMAC key's metadata:
gsutil hmac get GOOG56JBMFZX6PMPTQ62VD2
Note that there is no option to retrieve a key's secret material after it has been created.
The "get" sub-command has the following option
|Specify a project from which to get a key.|
hmac list command lists the HMAC key metadata for keys in the
specified project. If no project is specified in the command, the default
project is used.
The "list" sub-command has the following options
|-a||Show all keys, including recently deleted keys.|
|-l||Use long listing format. Shows each key's full metadata excluding the secret.|
|Specify a project from which to list keys.|
|Filter keys for a single service account.|
hmac update command sets the state of the specified key:
gsutil hmac update -s INACTIVE -e M42da= GOOG56JBMFZX6PMPTQ62VD2
Valid state arguments are ACTIVE and INACTIVE. To set a key to state DELETED use the "hmac delete" command on an INACTIVE key. If an etag is set in the command, it will only succeed if the provided etag matches the etag of the stored key.
The "update" sub-command has the following options
|Sets the state of the specified key to either ACTIVE or INACTIVE.|
|-e <etag>||If provided, the update will only be performed if the specified etag matches the etag of the stored key.|
|Specify a project in which to update a key.|