kms - Configure Cloud KMS encryption

Synopsis

gsutil kms authorize [-p <proj_id>] -k <kms_key>
gsutil kms encryption [(-d|[-k <kms_key>])] [-w] gs://<bucket_name>...
gsutil kms serviceaccount [-p <proj_id>]

Description

The kms command is used to configure Cloud Storage and Cloud KMS resources to support encryption of Cloud Storage objects with Cloud KMS keys.

The kms command has three sub-commands that deal with configuring Cloud Storage 's integration with Cloud KMS: authorize, encryption, and serviceaccount.

Authorize

The authorize sub-command checks that the default (or supplied) project has a Cloud Storage-owned service account created for it, and if not, it creates one. It then adds appropriate encrypt/decrypt permissions to Cloud KMS resources such that the Cloud Storage service account can write and read Cloud KMS-encrypted objects in buckets associated with the specified project.

Authorize Examples

Authorize your default project to use a Cloud KMS key:

gsutil kms authorize \
    -k projects/key-project/locations/us-east1/keyRings/key-ring/cryptoKeys/my-key

Authorize "my-project" to use a Cloud KMS key:

gsutil kms authorize -p my-project \
    -k projects/key-project/locations/us-east1/keyRings/key-ring/cryptoKeys/my-key

Encryption

The encryption sub-command is used to set, display, or clear a bucket's default KMS key, which is used to encrypt newly-written objects if no other key is specified.

Encryption Examples

Set the default KMS key for my-bucket:

gsutil kms encryption \
    -k projects/key-project/locations/us-east1/keyRings/key-ring/cryptoKeys/my-key \
    gs://my-bucket

Set the default KMS key for my-bucket, but display a warning rather than failing if gsutil is unable to verify that the specified key contains the correct IAM bindings for encryption/decryption. This is useful for users that do not have getIamPolicy permission but know that the key has the correct IAM policy for encryption in the user's project:

gsutil kms encryption \
    -k projects/key-project/locations/us-east1/keyRings/key-ring/cryptoKeys/my-key \
    -w gs://my-bucket

Show the default KMS key for my-bucket, if one is set:

gsutil kms encryption gs://my-bucket

Clear the default KMS key so newly-written objects will not be encrypted:

gsutil kms encryption -d gs://my-bucket

Options

-k <key>	Set the default KMS key for my-bucket using the full path to the key projects/[project-id]/locations/[location]/keyRings/[key-ring]/cryptoKeys/[my-key]
-w	(used with -k key) Display a warning rather than failing if gsutil is unable to verify that the specified key contains the correct IAM bindings for encryption/decryption. This is useful for users that do not have getIamPolicy permission but know that the key has the correct IAM policy for encryption in the user's project.
-d	Clear the default KMS key.

Serviceaccount

The serviceaccount sub-command displays the Cloud Storage-owned service account that is used to perform Cloud KMS operations against your default project (or a supplied project).

Serviceaccount Examples

Show the service account for your default project:

gsutil kms serviceaccount

Show the service account for my-project:

gsutil kms serviceaccount -p my-project