diff --git a/kms/google/cloud/kms_v1/gapic/enums.py b/kms/google/cloud/kms_v1/gapic/enums.py index 8094c535a919..894087ddacfa 100644 --- a/kms/google/cloud/kms_v1/gapic/enums.py +++ b/kms/google/cloud/kms_v1/gapic/enums.py @@ -22,7 +22,8 @@ class ProtectionLevel(enum.IntEnum): """ ``ProtectionLevel`` specifies how cryptographic operations are - performed. + performed. For more information, see [Protection levels] + (https://cloud.google.com/kms/docs/algorithms#protection\_levels). Attributes: PROTECTION_LEVEL_UNSPECIFIED (int): Not specified. @@ -40,7 +41,8 @@ class CryptoKeyPurpose(enum.IntEnum): """ ``CryptoKeyPurpose`` describes the cryptographic capabilities of a ``CryptoKey``. A given key can only be used for the operations allowed - by its purpose. + by its purpose. For more information, see `Key + purposes `__. Attributes: CRYPTO_KEY_PURPOSE_UNSPECIFIED (int): Not specified. @@ -90,18 +92,24 @@ class CryptoKeyVersionAlgorithm(enum.IntEnum): The fields in the name after "EC\_SIGN\_" correspond to the following parameters: elliptic curve, digest algorithm. + For more information, see [Key purposes and algorithms] + (https://cloud.google.com/kms/docs/algorithms). + Attributes: CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED (int): Not specified. GOOGLE_SYMMETRIC_ENCRYPTION (int): Creates symmetric encryption keys. RSA_SIGN_PSS_2048_SHA256 (int): RSASSA-PSS 2048 bit key with a SHA256 digest. RSA_SIGN_PSS_3072_SHA256 (int): RSASSA-PSS 3072 bit key with a SHA256 digest. RSA_SIGN_PSS_4096_SHA256 (int): RSASSA-PSS 4096 bit key with a SHA256 digest. + RSA_SIGN_PSS_4096_SHA512 (int): RSASSA-PSS 4096 bit key with a SHA512 digest. RSA_SIGN_PKCS1_2048_SHA256 (int): RSASSA-PKCS1-v1\_5 with a 2048 bit key and a SHA256 digest. RSA_SIGN_PKCS1_3072_SHA256 (int): RSASSA-PKCS1-v1\_5 with a 3072 bit key and a SHA256 digest. RSA_SIGN_PKCS1_4096_SHA256 (int): RSASSA-PKCS1-v1\_5 with a 4096 bit key and a SHA256 digest. + RSA_SIGN_PKCS1_4096_SHA512 (int): RSASSA-PKCS1-v1\_5 with a 4096 bit key and a SHA512 digest. RSA_DECRYPT_OAEP_2048_SHA256 (int): RSAES-OAEP 2048 bit key with a SHA256 digest. RSA_DECRYPT_OAEP_3072_SHA256 (int): RSAES-OAEP 3072 bit key with a SHA256 digest. RSA_DECRYPT_OAEP_4096_SHA256 (int): RSAES-OAEP 4096 bit key with a SHA256 digest. + RSA_DECRYPT_OAEP_4096_SHA512 (int): RSAES-OAEP 4096 bit key with a SHA512 digest. EC_SIGN_P256_SHA256 (int): ECDSA on the NIST P-256 curve with a SHA256 digest. EC_SIGN_P384_SHA384 (int): ECDSA on the NIST P-384 curve with a SHA384 digest. """ @@ -111,12 +119,15 @@ class CryptoKeyVersionAlgorithm(enum.IntEnum): RSA_SIGN_PSS_2048_SHA256 = 2 RSA_SIGN_PSS_3072_SHA256 = 3 RSA_SIGN_PSS_4096_SHA256 = 4 + RSA_SIGN_PSS_4096_SHA512 = 15 RSA_SIGN_PKCS1_2048_SHA256 = 5 RSA_SIGN_PKCS1_3072_SHA256 = 6 RSA_SIGN_PKCS1_4096_SHA256 = 7 + RSA_SIGN_PKCS1_4096_SHA512 = 16 RSA_DECRYPT_OAEP_2048_SHA256 = 8 RSA_DECRYPT_OAEP_3072_SHA256 = 9 RSA_DECRYPT_OAEP_4096_SHA256 = 10 + RSA_DECRYPT_OAEP_4096_SHA512 = 17 EC_SIGN_P256_SHA256 = 12 EC_SIGN_P384_SHA384 = 13 @@ -137,6 +148,13 @@ class CryptoKeyVersionState(enum.IntEnum): DESTROY_SCHEDULED (int): This version is scheduled for destruction, and will be destroyed soon. Call ``RestoreCryptoKeyVersion`` to put it back into the ``DISABLED`` state. + PENDING_IMPORT (int): This version is still being imported. It may not be used, enabled, + disabled, or destroyed yet. Cloud KMS will automatically mark this + version ``ENABLED`` as soon as the version is ready. + IMPORT_FAILED (int): This version was not imported successfully. It may not be used, enabled, + disabled, or destroyed. The submitted key material has been discarded. + Additional details can be found in + ``CryptoKeyVersion.import_failure_reason``. """ CRYPTO_KEY_VERSION_STATE_UNSPECIFIED = 0 @@ -145,6 +163,8 @@ class CryptoKeyVersionState(enum.IntEnum): DISABLED = 2 DESTROYED = 3 DESTROY_SCHEDULED = 4 + PENDING_IMPORT = 6 + IMPORT_FAILED = 7 class CryptoKeyVersionView(enum.IntEnum): """ @@ -164,17 +184,63 @@ class CryptoKeyVersionView(enum.IntEnum): FULL = 1 +class ImportJob(object): + class ImportJobState(enum.IntEnum): + """ + The state of the ``ImportJob``, indicating if it can be used. + + Attributes: + IMPORT_JOB_STATE_UNSPECIFIED (int): Not specified. + PENDING_GENERATION (int): The wrapping key for this job is still being generated. It may not be + used. Cloud KMS will automatically mark this job as ``ACTIVE`` as soon + as the wrapping key is generated. + ACTIVE (int): This job may be used in ``CreateCryptoKey`` and + ``CreateCryptoKeyVersion`` requests. + EXPIRED (int): This job can no longer be used and may not leave this state once entered. + """ + + IMPORT_JOB_STATE_UNSPECIFIED = 0 + PENDING_GENERATION = 1 + ACTIVE = 2 + EXPIRED = 3 + + class ImportMethod(enum.IntEnum): + """ + ``ImportMethod`` describes the key wrapping method chosen for this + ``ImportJob``. + + Attributes: + IMPORT_METHOD_UNSPECIFIED (int): Not specified. + RSA_OAEP_3072_SHA1_AES_256 (int): This ImportMethod represents the CKM\_RSA\_AES\_KEY\_WRAP key wrapping + scheme defined in the PKCS #11 standard. In summary, this involves + wrapping the raw key with an ephemeral AES key, and wrapping the + ephemeral AES key with a 3072 bit RSA key. For more details, see `RSA + AES key wrap + mechanism `__. + RSA_OAEP_4096_SHA1_AES_256 (int): This ImportMethod represents the CKM\_RSA\_AES\_KEY\_WRAP key wrapping + scheme defined in the PKCS #11 standard. In summary, this involves + wrapping the raw key with an ephemeral AES key, and wrapping the + ephemeral AES key with a 4096 bit RSA key. For more details, see `RSA + AES key wrap + mechanism `__. + """ + + IMPORT_METHOD_UNSPECIFIED = 0 + RSA_OAEP_3072_SHA1_AES_256 = 1 + RSA_OAEP_4096_SHA1_AES_256 = 2 + + class KeyOperationAttestation(object): class AttestationFormat(enum.IntEnum): """ - Attestion formats provided by the HSM. + Attestation formats provided by the HSM. Attributes: - ATTESTATION_FORMAT_UNSPECIFIED (int) + ATTESTATION_FORMAT_UNSPECIFIED (int): Not specified. CAVIUM_V1_COMPRESSED (int): Cavium HSM attestation compressed with gzip. Note that this format is defined by Cavium and subject to change at any time. CAVIUM_V2_COMPRESSED (int): Cavium HSM attestation V2 compressed with gzip. This is a new format - Introduced in Cavium's version 3.2-08 + introduced in Cavium's version 3.2-08. """ ATTESTATION_FORMAT_UNSPECIFIED = 0 diff --git a/kms/google/cloud/kms_v1/gapic/key_management_service_client.py b/kms/google/cloud/kms_v1/gapic/key_management_service_client.py index 8b9e2ed00eac..a516dd461003 100644 --- a/kms/google/cloud/kms_v1/gapic/key_management_service_client.py +++ b/kms/google/cloud/kms_v1/gapic/key_management_service_client.py @@ -28,6 +28,7 @@ import google.api_core.grpc_helpers import google.api_core.page_iterator import google.api_core.path_template +import google.api_core.protobuf_helpers import grpc from google.cloud.kms_v1.gapic import enums @@ -122,6 +123,17 @@ def crypto_key_version_path( crypto_key_version=crypto_key_version, ) + @classmethod + def import_job_path(cls, project, location, key_ring, import_job): + """Return a fully-qualified import_job string.""" + return google.api_core.path_template.expand( + "projects/{project}/locations/{location}/keyRings/{key_ring}/importJobs/{import_job}", + project=project, + location=location, + key_ring=key_ring, + import_job=import_job, + ) + @classmethod def key_ring_path(cls, project, location, key_ring): """Return a fully-qualified key_ring string.""" @@ -244,6 +256,8 @@ def list_key_rings( self, parent, page_size=None, + filter_=None, + order_by=None, retry=google.api_core.gapic_v1.method.DEFAULT, timeout=google.api_core.gapic_v1.method.DEFAULT, metadata=None, @@ -280,6 +294,9 @@ def list_key_rings( resource, this parameter does not affect the return value. If page streaming is performed per-page, this determines the maximum number of resources in a page. + filter_ (str): Optional. Only include resources that match the filter in the response. + order_by (str): Optional. Specify how the results should be sorted. If not specified, the + results will be sorted in the default order. retry (Optional[google.api_core.retry.Retry]): A retry object used to retry requests. If ``None`` is specified, requests will not be retried. @@ -313,7 +330,9 @@ def list_key_rings( client_info=self._client_info, ) - request = service_pb2.ListKeyRingsRequest(parent=parent, page_size=page_size) + request = service_pb2.ListKeyRingsRequest( + parent=parent, page_size=page_size, filter=filter_, order_by=order_by + ) if metadata is None: metadata = [] metadata = list(metadata) @@ -342,11 +361,122 @@ def list_key_rings( ) return iterator + def list_import_jobs( + self, + parent, + page_size=None, + filter_=None, + order_by=None, + retry=google.api_core.gapic_v1.method.DEFAULT, + timeout=google.api_core.gapic_v1.method.DEFAULT, + metadata=None, + ): + """ + Lists ``ImportJobs``. + + Example: + >>> from google.cloud import kms_v1 + >>> + >>> client = kms_v1.KeyManagementServiceClient() + >>> + >>> parent = client.key_ring_path('[PROJECT]', '[LOCATION]', '[KEY_RING]') + >>> + >>> # Iterate over all results + >>> for element in client.list_import_jobs(parent): + ... # process element + ... pass + >>> + >>> + >>> # Alternatively: + >>> + >>> # Iterate over results one page at a time + >>> for page in client.list_import_jobs(parent).pages: + ... for element in page: + ... # process element + ... pass + + Args: + parent (str): Required. The resource name of the ``KeyRing`` to list, in the format + ``projects/*/locations/*/keyRings/*``. + page_size (int): The maximum number of resources contained in the + underlying API response. If page streaming is performed per- + resource, this parameter does not affect the return value. If page + streaming is performed per-page, this determines the maximum number + of resources in a page. + filter_ (str): Optional. Only include resources that match the filter in the response. + order_by (str): Optional. Specify how the results should be sorted. If not specified, the + results will be sorted in the default order. + retry (Optional[google.api_core.retry.Retry]): A retry object used + to retry requests. If ``None`` is specified, requests will not + be retried. + timeout (Optional[float]): The amount of time, in seconds, to wait + for the request to complete. Note that if ``retry`` is + specified, the timeout applies to each individual attempt. + metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata + that is provided to the method. + + Returns: + A :class:`~google.gax.PageIterator` instance. By default, this + is an iterable of :class:`~google.cloud.kms_v1.types.ImportJob` instances. + This object can also be configured to iterate over the pages + of the response through the `options` parameter. + + Raises: + google.api_core.exceptions.GoogleAPICallError: If the request + failed for any reason. + google.api_core.exceptions.RetryError: If the request failed due + to a retryable error and retry attempts failed. + ValueError: If the parameters are invalid. + """ + # Wrap the transport method to add retry and timeout logic. + if "list_import_jobs" not in self._inner_api_calls: + self._inner_api_calls[ + "list_import_jobs" + ] = google.api_core.gapic_v1.method.wrap_method( + self.transport.list_import_jobs, + default_retry=self._method_configs["ListImportJobs"].retry, + default_timeout=self._method_configs["ListImportJobs"].timeout, + client_info=self._client_info, + ) + + request = service_pb2.ListImportJobsRequest( + parent=parent, page_size=page_size, filter=filter_, order_by=order_by + ) + if metadata is None: + metadata = [] + metadata = list(metadata) + try: + routing_header = [("parent", parent)] + except AttributeError: + pass + else: + routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata( + routing_header + ) + metadata.append(routing_metadata) + + iterator = google.api_core.page_iterator.GRPCIterator( + client=None, + method=functools.partial( + self._inner_api_calls["list_import_jobs"], + retry=retry, + timeout=timeout, + metadata=metadata, + ), + request=request, + items_field="import_jobs", + request_token_field="page_token", + response_token_field="next_page_token", + ) + return iterator + def list_crypto_keys( self, parent, page_size=None, version_view=None, + filter_=None, + order_by=None, retry=google.api_core.gapic_v1.method.DEFAULT, timeout=google.api_core.gapic_v1.method.DEFAULT, metadata=None, @@ -384,6 +514,9 @@ def list_crypto_keys( streaming is performed per-page, this determines the maximum number of resources in a page. version_view (~google.cloud.kms_v1.types.CryptoKeyVersionView): The fields of the primary version to include in the response. + filter_ (str): Optional. Only include resources that match the filter in the response. + order_by (str): Optional. Specify how the results should be sorted. If not specified, the + results will be sorted in the default order. retry (Optional[google.api_core.retry.Retry]): A retry object used to retry requests. If ``None`` is specified, requests will not be retried. @@ -418,7 +551,11 @@ def list_crypto_keys( ) request = service_pb2.ListCryptoKeysRequest( - parent=parent, page_size=page_size, version_view=version_view + parent=parent, + page_size=page_size, + version_view=version_view, + filter=filter_, + order_by=order_by, ) if metadata is None: metadata = [] @@ -453,6 +590,8 @@ def list_crypto_key_versions( parent, page_size=None, view=None, + filter_=None, + order_by=None, retry=google.api_core.gapic_v1.method.DEFAULT, timeout=google.api_core.gapic_v1.method.DEFAULT, metadata=None, @@ -490,6 +629,9 @@ def list_crypto_key_versions( streaming is performed per-page, this determines the maximum number of resources in a page. view (~google.cloud.kms_v1.types.CryptoKeyVersionView): The fields to include in the response. + filter_ (str): Optional. Only include resources that match the filter in the response. + order_by (str): Optional. Specify how the results should be sorted. If not specified, the + results will be sorted in the default order. retry (Optional[google.api_core.retry.Retry]): A retry object used to retry requests. If ``None`` is specified, requests will not be retried. @@ -524,7 +666,11 @@ def list_crypto_key_versions( ) request = service_pb2.ListCryptoKeyVersionsRequest( - parent=parent, page_size=page_size, view=view + parent=parent, + page_size=page_size, + view=view, + filter=filter_, + order_by=order_by, ) if metadata is None: metadata = [] @@ -623,6 +769,75 @@ def get_key_ring( request, retry=retry, timeout=timeout, metadata=metadata ) + def get_import_job( + self, + name, + retry=google.api_core.gapic_v1.method.DEFAULT, + timeout=google.api_core.gapic_v1.method.DEFAULT, + metadata=None, + ): + """ + Returns metadata for a given ``ImportJob``. + + Example: + >>> from google.cloud import kms_v1 + >>> + >>> client = kms_v1.KeyManagementServiceClient() + >>> + >>> name = client.import_job_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[IMPORT_JOB]') + >>> + >>> response = client.get_import_job(name) + + Args: + name (str): The ``name`` of the ``ImportJob`` to get. + retry (Optional[google.api_core.retry.Retry]): A retry object used + to retry requests. If ``None`` is specified, requests will not + be retried. + timeout (Optional[float]): The amount of time, in seconds, to wait + for the request to complete. Note that if ``retry`` is + specified, the timeout applies to each individual attempt. + metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata + that is provided to the method. + + Returns: + A :class:`~google.cloud.kms_v1.types.ImportJob` instance. + + Raises: + google.api_core.exceptions.GoogleAPICallError: If the request + failed for any reason. + google.api_core.exceptions.RetryError: If the request failed due + to a retryable error and retry attempts failed. + ValueError: If the parameters are invalid. + """ + # Wrap the transport method to add retry and timeout logic. + if "get_import_job" not in self._inner_api_calls: + self._inner_api_calls[ + "get_import_job" + ] = google.api_core.gapic_v1.method.wrap_method( + self.transport.get_import_job, + default_retry=self._method_configs["GetImportJob"].retry, + default_timeout=self._method_configs["GetImportJob"].timeout, + client_info=self._client_info, + ) + + request = service_pb2.GetImportJobRequest(name=name) + if metadata is None: + metadata = [] + metadata = list(metadata) + try: + routing_header = [("name", name)] + except AttributeError: + pass + else: + routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata( + routing_header + ) + metadata.append(routing_metadata) + + return self._inner_api_calls["get_import_job"]( + request, retry=retry, timeout=timeout, metadata=metadata + ) + def get_crypto_key( self, name, @@ -848,11 +1063,99 @@ def create_key_ring( request, retry=retry, timeout=timeout, metadata=metadata ) + def create_import_job( + self, + parent, + import_job_id, + import_job, + retry=google.api_core.gapic_v1.method.DEFAULT, + timeout=google.api_core.gapic_v1.method.DEFAULT, + metadata=None, + ): + """ + Create a new ``ImportJob`` within a ``KeyRing``. + + ``ImportJob.import_method`` is required. + + Example: + >>> from google.cloud import kms_v1 + >>> from google.cloud.kms_v1 import enums + >>> + >>> client = kms_v1.KeyManagementServiceClient() + >>> + >>> parent = client.key_ring_path('[PROJECT]', '[LOCATION]', '[KEY_RING]') + >>> import_job_id = 'my-import-job' + >>> import_method = enums.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256 + >>> protection_level = enums.ProtectionLevel.HSM + >>> import_job = {'import_method': import_method, 'protection_level': protection_level} + >>> + >>> response = client.create_import_job(parent, import_job_id, import_job) + + Args: + parent (str): Required. The ``name`` of the ``KeyRing`` associated with the + ``ImportJobs``. + import_job_id (str): Required. It must be unique within a KeyRing and match the regular + expression ``[a-zA-Z0-9_-]{1,63}`` + import_job (Union[dict, ~google.cloud.kms_v1.types.ImportJob]): Required. An ``ImportJob`` with initial field values. + + If a dict is provided, it must be of the same form as the protobuf + message :class:`~google.cloud.kms_v1.types.ImportJob` + retry (Optional[google.api_core.retry.Retry]): A retry object used + to retry requests. If ``None`` is specified, requests will not + be retried. + timeout (Optional[float]): The amount of time, in seconds, to wait + for the request to complete. Note that if ``retry`` is + specified, the timeout applies to each individual attempt. + metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata + that is provided to the method. + + Returns: + A :class:`~google.cloud.kms_v1.types.ImportJob` instance. + + Raises: + google.api_core.exceptions.GoogleAPICallError: If the request + failed for any reason. + google.api_core.exceptions.RetryError: If the request failed due + to a retryable error and retry attempts failed. + ValueError: If the parameters are invalid. + """ + # Wrap the transport method to add retry and timeout logic. + if "create_import_job" not in self._inner_api_calls: + self._inner_api_calls[ + "create_import_job" + ] = google.api_core.gapic_v1.method.wrap_method( + self.transport.create_import_job, + default_retry=self._method_configs["CreateImportJob"].retry, + default_timeout=self._method_configs["CreateImportJob"].timeout, + client_info=self._client_info, + ) + + request = service_pb2.CreateImportJobRequest( + parent=parent, import_job_id=import_job_id, import_job=import_job + ) + if metadata is None: + metadata = [] + metadata = list(metadata) + try: + routing_header = [("parent", parent)] + except AttributeError: + pass + else: + routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata( + routing_header + ) + metadata.append(routing_metadata) + + return self._inner_api_calls["create_import_job"]( + request, retry=retry, timeout=timeout, metadata=metadata + ) + def create_crypto_key( self, parent, crypto_key_id, crypto_key, + skip_initial_version_creation=None, retry=google.api_core.gapic_v1.method.DEFAULT, timeout=google.api_core.gapic_v1.method.DEFAULT, metadata=None, @@ -889,6 +1192,9 @@ def create_crypto_key( If a dict is provided, it must be of the same form as the protobuf message :class:`~google.cloud.kms_v1.types.CryptoKey` + skip_initial_version_creation (bool): If set to true, the request will create a ``CryptoKey`` without any + ``CryptoKeyVersions``. You must manually call ``CreateCryptoKeyVersion`` + or ``ImportCryptoKeyVersion`` before you can use this ``CryptoKey``. retry (Optional[google.api_core.retry.Retry]): A retry object used to retry requests. If ``None`` is specified, requests will not be retried. @@ -920,7 +1226,10 @@ def create_crypto_key( ) request = service_pb2.CreateCryptoKeyRequest( - parent=parent, crypto_key_id=crypto_key_id, crypto_key=crypto_key + parent=parent, + crypto_key_id=crypto_key_id, + crypto_key=crypto_key, + skip_initial_version_creation=skip_initial_version_creation, ) if metadata is None: metadata = [] @@ -1022,6 +1331,124 @@ def create_crypto_key_version( request, retry=retry, timeout=timeout, metadata=metadata ) + def import_crypto_key_version( + self, + parent, + algorithm, + import_job, + rsa_aes_wrapped_key=None, + retry=google.api_core.gapic_v1.method.DEFAULT, + timeout=google.api_core.gapic_v1.method.DEFAULT, + metadata=None, + ): + """ + Imports a new ``CryptoKeyVersion`` into an existing ``CryptoKey`` using + the wrapped key material provided in the request. + + The version ID will be assigned the next sequential id within the + ``CryptoKey``. + + Example: + >>> from google.cloud import kms_v1 + >>> from google.cloud.kms_v1 import enums + >>> + >>> client = kms_v1.KeyManagementServiceClient() + >>> + >>> parent = client.crypto_key_path('[PROJECT]', '[LOCATION]', '[KEY_RING]', '[CRYPTO_KEY]') + >>> + >>> # TODO: Initialize `algorithm`: + >>> algorithm = enums.CryptoKeyVersion.CryptoKeyVersionAlgorithm.CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED + >>> + >>> # TODO: Initialize `import_job`: + >>> import_job = '' + >>> + >>> response = client.import_crypto_key_version(parent, algorithm, import_job) + + Args: + parent (str): Required. The ``name`` of the ``CryptoKey`` to be imported into. + algorithm (~google.cloud.kms_v1.types.CryptoKeyVersionAlgorithm): Required. The ``algorithm`` of the key being imported. This does not + need to match the ``version_template`` of the ``CryptoKey`` this version + imports into. + import_job (str): Required. The ``name`` of the ``ImportJob`` that was used to wrap this + key material. + rsa_aes_wrapped_key (bytes): Wrapped key material produced with ``RSA_OAEP_3072_SHA1_AES_256`` or + ``RSA_OAEP_4096_SHA1_AES_256``. + + This field contains the concatenation of two wrapped keys: + + .. raw:: html + +
    +
  1. An ephemeral AES-256 wrapping key wrapped with the + `public_key` using RSAES-OAEP with SHA-1, + MGF1 with SHA-1, and an empty label. +
    2. +
  2. The key to be imported, wrapped with the ephemeral AES-256 key + using AES-KWP (RFC 5649). +
    3. +
+ + This format is the same as the format produced by PKCS#11 mechanism + CKM\_RSA\_AES\_KEY\_WRAP. + retry (Optional[google.api_core.retry.Retry]): A retry object used + to retry requests. If ``None`` is specified, requests will not + be retried. + timeout (Optional[float]): The amount of time, in seconds, to wait + for the request to complete. Note that if ``retry`` is + specified, the timeout applies to each individual attempt. + metadata (Optional[Sequence[Tuple[str, str]]]): Additional metadata + that is provided to the method. + + Returns: + A :class:`~google.cloud.kms_v1.types.CryptoKeyVersion` instance. + + Raises: + google.api_core.exceptions.GoogleAPICallError: If the request + failed for any reason. + google.api_core.exceptions.RetryError: If the request failed due + to a retryable error and retry attempts failed. + ValueError: If the parameters are invalid. + """ + # Wrap the transport method to add retry and timeout logic. + if "import_crypto_key_version" not in self._inner_api_calls: + self._inner_api_calls[ + "import_crypto_key_version" + ] = google.api_core.gapic_v1.method.wrap_method( + self.transport.import_crypto_key_version, + default_retry=self._method_configs["ImportCryptoKeyVersion"].retry, + default_timeout=self._method_configs["ImportCryptoKeyVersion"].timeout, + client_info=self._client_info, + ) + + # Sanity check: We have some fields which are mutually exclusive; + # raise ValueError if more than one is sent. + google.api_core.protobuf_helpers.check_oneof( + rsa_aes_wrapped_key=rsa_aes_wrapped_key + ) + + request = service_pb2.ImportCryptoKeyVersionRequest( + parent=parent, + algorithm=algorithm, + import_job=import_job, + rsa_aes_wrapped_key=rsa_aes_wrapped_key, + ) + if metadata is None: + metadata = [] + metadata = list(metadata) + try: + routing_header = [("parent", parent)] + except AttributeError: + pass + else: + routing_metadata = google.api_core.gapic_v1.routing_header.to_grpc_metadata( + routing_header + ) + metadata.append(routing_metadata) + + return self._inner_api_calls["import_crypto_key_version"]( + request, retry=retry, timeout=timeout, metadata=metadata + ) + def update_crypto_key( self, crypto_key, @@ -1843,8 +2270,8 @@ def set_iam_policy( metadata=None, ): """ - Sets the access control policy on the specified resource. Replaces any - existing policy. + Sets the access control policy on the specified resource. Replaces + any existing policy. Example: >>> from google.cloud import kms_v1 @@ -1924,9 +2351,8 @@ def get_iam_policy( metadata=None, ): """ - Gets the access control policy for a resource. - Returns an empty policy if the resource exists and does not have a policy - set. + Gets the access control policy for a resource. Returns an empty policy + if the resource exists and does not have a policy set. Example: >>> from google.cloud import kms_v1 @@ -1998,8 +2424,8 @@ def test_iam_permissions( ): """ Returns permissions that a caller has on the specified resource. If the - resource does not exist, this will return an empty set of permissions, - not a NOT\_FOUND error. + resource does not exist, this will return an empty set of + permissions, not a NOT_FOUND error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization diff --git a/kms/google/cloud/kms_v1/gapic/key_management_service_client_config.py b/kms/google/cloud/kms_v1/gapic/key_management_service_client_config.py index 0d3efae962ce..0f86e6b5d7a8 100644 --- a/kms/google/cloud/kms_v1/gapic/key_management_service_client_config.py +++ b/kms/google/cloud/kms_v1/gapic/key_management_service_client_config.py @@ -22,6 +22,11 @@ "retry_codes_name": "idempotent", "retry_params_name": "default", }, + "ListImportJobs": { + "timeout_millis": 60000, + "retry_codes_name": "idempotent", + "retry_params_name": "default", + }, "ListCryptoKeys": { "timeout_millis": 60000, "retry_codes_name": "idempotent", @@ -37,6 +42,11 @@ "retry_codes_name": "idempotent", "retry_params_name": "default", }, + "GetImportJob": { + "timeout_millis": 60000, + "retry_codes_name": "idempotent", + "retry_params_name": "default", + }, "GetCryptoKey": { "timeout_millis": 60000, "retry_codes_name": "idempotent", @@ -52,6 +62,11 @@ "retry_codes_name": "non_idempotent", "retry_params_name": "default", }, + "CreateImportJob": { + "timeout_millis": 60000, + "retry_codes_name": "non_idempotent", + "retry_params_name": "default", + }, "CreateCryptoKey": { "timeout_millis": 60000, "retry_codes_name": "non_idempotent", @@ -62,6 +77,11 @@ "retry_codes_name": "non_idempotent", "retry_params_name": "default", }, + "ImportCryptoKeyVersion": { + "timeout_millis": 60000, + "retry_codes_name": "non_idempotent", + "retry_params_name": "default", + }, "UpdateCryptoKey": { "timeout_millis": 60000, "retry_codes_name": "non_idempotent", diff --git a/kms/google/cloud/kms_v1/gapic/transports/key_management_service_grpc_transport.py b/kms/google/cloud/kms_v1/gapic/transports/key_management_service_grpc_transport.py index d0ef03fb2ec3..43f66e0288fc 100644 --- a/kms/google/cloud/kms_v1/gapic/transports/key_management_service_grpc_transport.py +++ b/kms/google/cloud/kms_v1/gapic/transports/key_management_service_grpc_transport.py @@ -32,7 +32,10 @@ class KeyManagementServiceGrpcTransport(object): # The scopes needed to make gRPC calls to all of the methods defined # in this service. - _OAUTH_SCOPES = ("https://www.googleapis.com/auth/cloud-platform",) + _OAUTH_SCOPES = ( + "https://www.googleapis.com/auth/cloud-platform", + "https://www.googleapis.com/auth/cloudkms", + ) def __init__( self, channel=None, credentials=None, address="cloudkms.googleapis.com:443" @@ -113,6 +116,19 @@ def list_key_rings(self): """ return self._stubs["key_management_service_stub"].ListKeyRings + @property + def list_import_jobs(self): + """Return the gRPC stub for :meth:`KeyManagementServiceClient.list_import_jobs`. + + Lists ``ImportJobs``. + + Returns: + Callable: A callable which accepts the appropriate + deserialized request object and returns a + deserialized response object. + """ + return self._stubs["key_management_service_stub"].ListImportJobs + @property def list_crypto_keys(self): """Return the gRPC stub for :meth:`KeyManagementServiceClient.list_crypto_keys`. @@ -152,6 +168,19 @@ def get_key_ring(self): """ return self._stubs["key_management_service_stub"].GetKeyRing + @property + def get_import_job(self): + """Return the gRPC stub for :meth:`KeyManagementServiceClient.get_import_job`. + + Returns metadata for a given ``ImportJob``. + + Returns: + Callable: A callable which accepts the appropriate + deserialized request object and returns a + deserialized response object. + """ + return self._stubs["key_management_service_stub"].GetImportJob + @property def get_crypto_key(self): """Return the gRPC stub for :meth:`KeyManagementServiceClient.get_crypto_key`. @@ -192,6 +221,21 @@ def create_key_ring(self): """ return self._stubs["key_management_service_stub"].CreateKeyRing + @property + def create_import_job(self): + """Return the gRPC stub for :meth:`KeyManagementServiceClient.create_import_job`. + + Create a new ``ImportJob`` within a ``KeyRing``. + + ``ImportJob.import_method`` is required. + + Returns: + Callable: A callable which accepts the appropriate + deserialized request object and returns a + deserialized response object. + """ + return self._stubs["key_management_service_stub"].CreateImportJob + @property def create_crypto_key(self): """Return the gRPC stub for :meth:`KeyManagementServiceClient.create_crypto_key`. @@ -224,6 +268,23 @@ def create_crypto_key_version(self): """ return self._stubs["key_management_service_stub"].CreateCryptoKeyVersion + @property + def import_crypto_key_version(self): + """Return the gRPC stub for :meth:`KeyManagementServiceClient.import_crypto_key_version`. + + Imports a new ``CryptoKeyVersion`` into an existing ``CryptoKey`` using + the wrapped key material provided in the request. + + The version ID will be assigned the next sequential id within the + ``CryptoKey``. + + Returns: + Callable: A callable which accepts the appropriate + deserialized request object and returns a + deserialized response object. + """ + return self._stubs["key_management_service_stub"].ImportCryptoKeyVersion + @property def update_crypto_key(self): """Return the gRPC stub for :meth:`KeyManagementServiceClient.update_crypto_key`. @@ -383,8 +444,8 @@ def asymmetric_sign(self): def set_iam_policy(self): """Return the gRPC stub for :meth:`KeyManagementServiceClient.set_iam_policy`. - Sets the access control policy on the specified resource. Replaces any - existing policy. + Sets the access control policy on the specified resource. Replaces + any existing policy. Returns: Callable: A callable which accepts the appropriate @@ -397,9 +458,8 @@ def set_iam_policy(self): def get_iam_policy(self): """Return the gRPC stub for :meth:`KeyManagementServiceClient.get_iam_policy`. - Gets the access control policy for a resource. - Returns an empty policy if the resource exists and does not have a policy - set. + Gets the access control policy for a resource. Returns an empty policy + if the resource exists and does not have a policy set. Returns: Callable: A callable which accepts the appropriate @@ -413,8 +473,8 @@ def test_iam_permissions(self): """Return the gRPC stub for :meth:`KeyManagementServiceClient.test_iam_permissions`. Returns permissions that a caller has on the specified resource. If the - resource does not exist, this will return an empty set of permissions, - not a NOT\_FOUND error. + resource does not exist, this will return an empty set of + permissions, not a NOT_FOUND error. Note: This operation is designed to be used for building permission-aware UIs and command-line tools, not for authorization diff --git a/kms/google/cloud/kms_v1/proto/resources.proto b/kms/google/cloud/kms_v1/proto/resources.proto index 95dfc91b61d7..09baaf1becfa 100644 --- a/kms/google/cloud/kms_v1/proto/resources.proto +++ b/kms/google/cloud/kms_v1/proto/resources.proto @@ -1,4 +1,4 @@ -// Copyright 2018 Google LLC. +// Copyright 2019 Google LLC. // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. @@ -29,122 +29,100 @@ option java_outer_classname = "KmsResourcesProto"; option java_package = "com.google.cloud.kms.v1"; option php_namespace = "Google\\Cloud\\Kms\\V1"; -// A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of -// [CryptoKeys][google.cloud.kms.v1.CryptoKey]. +// A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of [CryptoKeys][google.cloud.kms.v1.CryptoKey]. message KeyRing { - // Output only. The resource name for the - // [KeyRing][google.cloud.kms.v1.KeyRing] in the format + // Output only. The resource name for the [KeyRing][google.cloud.kms.v1.KeyRing] in the format // `projects/*/locations/*/keyRings/*`. string name = 1; - // Output only. The time at which this [KeyRing][google.cloud.kms.v1.KeyRing] - // was created. + // Output only. The time at which this [KeyRing][google.cloud.kms.v1.KeyRing] was created. google.protobuf.Timestamp create_time = 2; } -// A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that -// can be used for cryptographic operations. +// A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that can be used for cryptographic +// operations. // -// A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of one or more -// [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual -// key material used in cryptographic operations. +// A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of one or more [versions][google.cloud.kms.v1.CryptoKeyVersion], which +// represent the actual key material used in cryptographic operations. message CryptoKey { - // [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] - // describes the cryptographic capabilities of a - // [CryptoKey][google.cloud.kms.v1.CryptoKey]. A given key can only be used - // for the operations allowed by its purpose. + // [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] describes the cryptographic capabilities of a + // [CryptoKey][google.cloud.kms.v1.CryptoKey]. A given key can only be used for the operations allowed by + // its purpose. For more information, see + // [Key purposes](https://cloud.google.com/kms/docs/algorithms#key_purposes). enum CryptoKeyPurpose { // Not specified. CRYPTO_KEY_PURPOSE_UNSPECIFIED = 0; - // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used - // with [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] and + // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used with + // [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] and // [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. ENCRYPT_DECRYPT = 1; - // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used - // with - // [AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign] - // and + // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used with + // [AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign] and // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. ASYMMETRIC_SIGN = 5; - // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used - // with - // [AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt] - // and + // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used with + // [AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt] and // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. ASYMMETRIC_DECRYPT = 6; } - // Output only. The resource name for this - // [CryptoKey][google.cloud.kms.v1.CryptoKey] in the format + // Output only. The resource name for this [CryptoKey][google.cloud.kms.v1.CryptoKey] in the format // `projects/*/locations/*/keyRings/*/cryptoKeys/*`. string name = 1; - // Output only. A copy of the "primary" - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that will be used - // by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] when this - // [CryptoKey][google.cloud.kms.v1.CryptoKey] is given in - // [EncryptRequest.name][google.cloud.kms.v1.EncryptRequest.name]. + // Output only. A copy of the "primary" [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that will be used + // by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] when this [CryptoKey][google.cloud.kms.v1.CryptoKey] is given + // in [EncryptRequest.name][google.cloud.kms.v1.EncryptRequest.name]. // - // The [CryptoKey][google.cloud.kms.v1.CryptoKey]'s primary version can be - // updated via + // The [CryptoKey][google.cloud.kms.v1.CryptoKey]'s primary version can be updated via // [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion]. // // All keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose] - // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] - // have a primary. For other keys, this field will be omitted. + // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] have a + // primary. For other keys, this field will be omitted. CryptoKeyVersion primary = 2; // The immutable purpose of this [CryptoKey][google.cloud.kms.v1.CryptoKey]. CryptoKeyPurpose purpose = 3; - // Output only. The time at which this - // [CryptoKey][google.cloud.kms.v1.CryptoKey] was created. + // Output only. The time at which this [CryptoKey][google.cloud.kms.v1.CryptoKey] was created. google.protobuf.Timestamp create_time = 5; - // At [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time], - // the Key Management Service will automatically: + // At [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time], the Key Management Service will automatically: // // 1. Create a new version of this [CryptoKey][google.cloud.kms.v1.CryptoKey]. // 2. Mark the new version as primary. // // Key rotations performed manually via - // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] - // and + // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] and // [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion] - // do not affect - // [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]. + // do not affect [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]. // // Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose] - // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] - // support automatic rotation. For other keys, this field must be omitted. + // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] support + // automatic rotation. For other keys, this field must be omitted. google.protobuf.Timestamp next_rotation_time = 7; // Controls the rate of automatic rotation. oneof rotation_schedule { - // [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time] - // will be advanced by this period when the service automatically rotates a - // key. Must be at least one day. + // [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time] will be advanced by this period when the service + // automatically rotates a key. Must be at least one day. // - // If [rotation_period][google.cloud.kms.v1.CryptoKey.rotation_period] is - // set, - // [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time] - // must also be set. + // If [rotation_period][google.cloud.kms.v1.CryptoKey.rotation_period] is set, [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time] must also be set. // // Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose] - // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] - // support automatic rotation. For other keys, this field must be omitted. + // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] support + // automatic rotation. For other keys, this field must be omitted. google.protobuf.Duration rotation_period = 8; } - // A template describing settings for new - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances. The - // properties of new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] - // instances created by either - // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] - // or auto-rotation are controlled by this template. + // A template describing settings for new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances. + // The properties of new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances created by either + // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] or + // auto-rotation are controlled by this template. CryptoKeyVersionTemplate version_template = 11; // Labels with user-defined metadata. For more information, see @@ -152,36 +130,31 @@ message CryptoKey { map labels = 10; } -// A [CryptoKeyVersionTemplate][google.cloud.kms.v1.CryptoKeyVersionTemplate] -// specifies the properties to use when creating a new -// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], either manually -// with -// [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] -// or automatically as a result of auto-rotation. +// A [CryptoKeyVersionTemplate][google.cloud.kms.v1.CryptoKeyVersionTemplate] specifies the properties to use when creating +// a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], either manually with +// [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] or +// automatically as a result of auto-rotation. message CryptoKeyVersionTemplate { - // [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when creating - // a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on this - // template. Immutable. Defaults to - // [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE]. + // [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when creating a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on + // this template. Immutable. Defaults to [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE]. ProtectionLevel protection_level = 1; - // Required. - // [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] - // to use when creating a - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on this - // template. + // Required. [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] to use + // when creating a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on this template. // // For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both - // this field is omitted and - // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] is + // this field is omitted and [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] is // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. CryptoKeyVersion.CryptoKeyVersionAlgorithm algorithm = 3; } -// Contains an HSM-generated attestation about a key operation. +// Contains an HSM-generated attestation about a key operation. For more +// information, see [Verifying attestations] +// (https://cloud.google.com/kms/docs/attest-key). message KeyOperationAttestation { - // Attestion formats provided by the HSM. + // Attestation formats provided by the HSM. enum AttestationFormat { + // Not specified. ATTESTATION_FORMAT_UNSPECIFIED = 0; // Cavium HSM attestation compressed with gzip. Note that this format is @@ -189,7 +162,7 @@ message KeyOperationAttestation { CAVIUM_V1_COMPRESSED = 3; // Cavium HSM attestation V2 compressed with gzip. This is a new format - // Introduced in Cavium's version 3.2-08 + // introduced in Cavium's version 3.2-08. CAVIUM_V2_COMPRESSED = 4; } @@ -201,30 +174,26 @@ message KeyOperationAttestation { bytes content = 5; } -// A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an -// individual cryptographic key, and the associated key material. +// A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an individual cryptographic key, and the +// associated key material. // -// An -// [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] -// version can be used for cryptographic operations. +// An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be +// used for cryptographic operations. // // For security reasons, the raw cryptographic key material represented by a -// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed -// or exported. It can only be used to encrypt, decrypt, or sign data when an -// authorized user or application invokes Cloud KMS. +// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to +// encrypt, decrypt, or sign data when an authorized user or application invokes +// Cloud KMS. message CryptoKeyVersion { - // The algorithm of the - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], indicating what + // The algorithm of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], indicating what // parameters must be used for each cryptographic operation. // // The // [GOOGLE_SYMMETRIC_ENCRYPTION][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION] - // algorithm is usable with - // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] + // algorithm is usable with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. // - // Algorithms beginning with "RSA_SIGN_" are usable with - // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] + // Algorithms beginning with "RSA_SIGN_" are usable with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN]. // // The fields in the name after "RSA_SIGN_" correspond to the following @@ -242,12 +211,14 @@ message CryptoKeyVersion { // The fields in the name after "RSA_DECRYPT_" correspond to the following // parameters: padding algorithm, modulus bit length, and digest algorithm. // - // Algorithms beginning with "EC_SIGN_" are usable with - // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] + // Algorithms beginning with "EC_SIGN_" are usable with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] // [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN]. // // The fields in the name after "EC_SIGN_" correspond to the following // parameters: elliptic curve, digest algorithm. + // + // For more information, see [Key purposes and algorithms] + // (https://cloud.google.com/kms/docs/algorithms). enum CryptoKeyVersionAlgorithm { // Not specified. CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED = 0; @@ -264,6 +235,9 @@ message CryptoKeyVersion { // RSASSA-PSS 4096 bit key with a SHA256 digest. RSA_SIGN_PSS_4096_SHA256 = 4; + // RSASSA-PSS 4096 bit key with a SHA512 digest. + RSA_SIGN_PSS_4096_SHA512 = 15; + // RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest. RSA_SIGN_PKCS1_2048_SHA256 = 5; @@ -273,6 +247,9 @@ message CryptoKeyVersion { // RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest. RSA_SIGN_PKCS1_4096_SHA256 = 7; + // RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest. + RSA_SIGN_PKCS1_4096_SHA512 = 16; + // RSAES-OAEP 2048 bit key with a SHA256 digest. RSA_DECRYPT_OAEP_2048_SHA256 = 8; @@ -282,6 +259,9 @@ message CryptoKeyVersion { // RSAES-OAEP 4096 bit key with a SHA256 digest. RSA_DECRYPT_OAEP_4096_SHA256 = 10; + // RSAES-OAEP 4096 bit key with a SHA512 digest. + RSA_DECRYPT_OAEP_4096_SHA512 = 17; + // ECDSA on the NIST P-256 curve with a SHA256 digest. EC_SIGN_P256_SHA256 = 12; @@ -289,26 +269,21 @@ message CryptoKeyVersion { EC_SIGN_P384_SHA384 = 13; } - // The state of a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], - // indicating if it can be used. + // The state of a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], indicating if it can be used. enum CryptoKeyVersionState { // Not specified. CRYPTO_KEY_VERSION_STATE_UNSPECIFIED = 0; // This version is still being generated. It may not be used, enabled, // disabled, or destroyed yet. Cloud KMS will automatically mark this - // version - // [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] - // as soon as the version is ready. + // version [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] as soon as the version is ready. PENDING_GENERATION = 5; // This version may be used for cryptographic operations. ENABLED = 1; // This version may not be used, but the key material is still available, - // and the version can be placed back into the - // [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] - // state. + // and the version can be placed back into the [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] state. DISABLED = 2; // This version is destroyed, and the key material is no longer stored. @@ -318,83 +293,89 @@ message CryptoKeyVersion { // This version is scheduled for destruction, and will be destroyed soon. // Call // [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] - // to put it back into the - // [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] - // state. + // to put it back into the [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] state. DESTROY_SCHEDULED = 4; + + // This version is still being imported. It may not be used, enabled, + // disabled, or destroyed yet. Cloud KMS will automatically mark this + // version [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] as soon as the version is ready. + PENDING_IMPORT = 6; + + // This version was not imported successfully. It may not be used, enabled, + // disabled, or destroyed. The submitted key material has been discarded. + // Additional details can be found in + // [CryptoKeyVersion.import_failure_reason][google.cloud.kms.v1.CryptoKeyVersion.import_failure_reason]. + IMPORT_FAILED = 7; } - // A view for [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]s. - // Controls the level of detail returned for - // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] in - // [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions] - // and + // A view for [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]s. Controls the level of detail returned + // for [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] in + // [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions] and // [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys]. enum CryptoKeyVersionView { - // Default view for each - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Does not - // include the - // [attestation][google.cloud.kms.v1.CryptoKeyVersion.attestation] field. + // Default view for each [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Does not include + // the [attestation][google.cloud.kms.v1.CryptoKeyVersion.attestation] field. CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED = 0; - // Provides all fields in each - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], including the + // Provides all fields in each [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], including the // [attestation][google.cloud.kms.v1.CryptoKeyVersion.attestation]. FULL = 1; } - // Output only. The resource name for this - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the format + // Output only. The resource name for this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the format // `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`. string name = 1; - // The current state of the - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. + // The current state of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. CryptoKeyVersionState state = 3; - // Output only. The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] - // describing how crypto operations are performed with this - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. + // Output only. The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] describing how crypto operations are + // performed with this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. ProtectionLevel protection_level = 7; - // Output only. The - // [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] - // that this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] - // supports. + // Output only. The [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] that this + // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] supports. CryptoKeyVersionAlgorithm algorithm = 10; // Output only. Statement that was generated and signed by the HSM at key // creation time. Use this statement to verify attributes of the key as stored // on the HSM, independently of Google. Only provided for key versions with - // [protection_level][google.cloud.kms.v1.CryptoKeyVersion.protection_level] - // [HSM][google.cloud.kms.v1.ProtectionLevel.HSM]. + // [protection_level][google.cloud.kms.v1.CryptoKeyVersion.protection_level] [HSM][google.cloud.kms.v1.ProtectionLevel.HSM]. KeyOperationAttestation attestation = 8; - // Output only. The time at which this - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] was created. + // Output only. The time at which this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] was created. google.protobuf.Timestamp create_time = 4; - // Output only. The time this - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material was + // Output only. The time this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material was // generated. google.protobuf.Timestamp generate_time = 11; - // Output only. The time this - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material is - // scheduled for destruction. Only present if - // [state][google.cloud.kms.v1.CryptoKeyVersion.state] is + // Output only. The time this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material is scheduled + // for destruction. Only present if [state][google.cloud.kms.v1.CryptoKeyVersion.state] is // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]. google.protobuf.Timestamp destroy_time = 5; // Output only. The time this CryptoKeyVersion's key material was - // destroyed. Only present if - // [state][google.cloud.kms.v1.CryptoKeyVersion.state] is + // destroyed. Only present if [state][google.cloud.kms.v1.CryptoKeyVersion.state] is // [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED]. google.protobuf.Timestamp destroy_event_time = 6; + + // Output only. The name of the [ImportJob][google.cloud.kms.v1.ImportJob] used to import this + // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Only present if the underlying key material was + // imported. + string import_job = 14; + + // Output only. The time at which this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material + // was imported. + google.protobuf.Timestamp import_time = 15; + + // Output only. The root cause of an import failure. Only present if + // [state][google.cloud.kms.v1.CryptoKeyVersion.state] is + // [IMPORT_FAILED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.IMPORT_FAILED]. + string import_failure_reason = 16; } -// The public key for a given -// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained via +// The public key for a given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained via // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. message PublicKey { // The public key, encoded in PEM format. For more information, see the @@ -404,14 +385,14 @@ message PublicKey { // (https://tools.ietf.org/html/rfc7468#section-13). string pem = 1; - // The - // [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] - // associated with this key. + // The [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] associated + // with this key. CryptoKeyVersion.CryptoKeyVersionAlgorithm algorithm = 2; } -// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] specifies how -// cryptographic operations are performed. +// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] specifies how cryptographic operations are performed. +// For more information, see [Protection levels] +// (https://cloud.google.com/kms/docs/algorithms#protection_levels). enum ProtectionLevel { // Not specified. PROTECTION_LEVEL_UNSPECIFIED = 0; @@ -422,3 +403,131 @@ enum ProtectionLevel { // Crypto operations are performed in a Hardware Security Module. HSM = 2; } + +// An [ImportJob][google.cloud.kms.v1.ImportJob] can be used to create [CryptoKeys][google.cloud.kms.v1.CryptoKey] and +// [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] using pre-existing key material, +// generated outside of Cloud KMS. +// +// When an [ImportJob][google.cloud.kms.v1.ImportJob] is created, Cloud KMS will generate a "wrapping key", +// which is a public/private key pair. You use the wrapping key to encrypt (also +// known as wrap) the pre-existing key material to protect it during the import +// process. The nature of the wrapping key depends on the choice of +// [import_method][google.cloud.kms.v1.ImportJob.import_method]. When the wrapping key generation +// is complete, the [state][google.cloud.kms.v1.ImportJob.state] will be set to +// [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE] and the [public_key][google.cloud.kms.v1.ImportJob.public_key] +// can be fetched. The fetched public key can then be used to wrap your +// pre-existing key material. +// +// Once the key material is wrapped, it can be imported into a new +// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in an existing [CryptoKey][google.cloud.kms.v1.CryptoKey] by calling +// [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]. +// Multiple [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] can be imported with a single +// [ImportJob][google.cloud.kms.v1.ImportJob]. Cloud KMS uses the private key portion of the wrapping key to +// unwrap the key material. Only Cloud KMS has access to the private key. +// +// An [ImportJob][google.cloud.kms.v1.ImportJob] expires 3 days after it is created. Once expired, Cloud KMS +// will no longer be able to import or unwrap any key material that was wrapped +// with the [ImportJob][google.cloud.kms.v1.ImportJob]'s public key. +// +// For more information, see +// [Importing a key](https://cloud.google.com/kms/docs/importing-a-key). +message ImportJob { + // The public key component of the wrapping key. For details of the type of + // key this public key corresponds to, see the [ImportMethod][google.cloud.kms.v1.ImportJob.ImportMethod]. + message WrappingPublicKey { + // The public key, encoded in PEM format. For more information, see the [RFC + // 7468](https://tools.ietf.org/html/rfc7468) sections for [General + // Considerations](https://tools.ietf.org/html/rfc7468#section-2) and + // [Textual Encoding of Subject Public Key Info] + // (https://tools.ietf.org/html/rfc7468#section-13). + string pem = 1; + } + + // [ImportMethod][google.cloud.kms.v1.ImportJob.ImportMethod] describes the key wrapping method chosen for this + // [ImportJob][google.cloud.kms.v1.ImportJob]. + enum ImportMethod { + // Not specified. + IMPORT_METHOD_UNSPECIFIED = 0; + + // This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping + // scheme defined in the PKCS #11 standard. In summary, this involves + // wrapping the raw key with an ephemeral AES key, and wrapping the + // ephemeral AES key with a 3072 bit RSA key. For more details, see + // [RSA AES key wrap + // mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908). + RSA_OAEP_3072_SHA1_AES_256 = 1; + + // This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping + // scheme defined in the PKCS #11 standard. In summary, this involves + // wrapping the raw key with an ephemeral AES key, and wrapping the + // ephemeral AES key with a 4096 bit RSA key. For more details, see + // [RSA AES key wrap + // mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908). + RSA_OAEP_4096_SHA1_AES_256 = 2; + } + + // The state of the [ImportJob][google.cloud.kms.v1.ImportJob], indicating if it can be used. + enum ImportJobState { + // Not specified. + IMPORT_JOB_STATE_UNSPECIFIED = 0; + + // The wrapping key for this job is still being generated. It may not be + // used. Cloud KMS will automatically mark this job as + // [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE] as soon as the wrapping key is generated. + PENDING_GENERATION = 1; + + // This job may be used in + // [CreateCryptoKey][google.cloud.kms.v1.KeyManagementService.CreateCryptoKey] and + // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] + // requests. + ACTIVE = 2; + + // This job can no longer be used and may not leave this state once entered. + EXPIRED = 3; + } + + // Output only. The resource name for this [ImportJob][google.cloud.kms.v1.ImportJob] in the format + // `projects/*/locations/*/keyRings/*/importJobs/*`. + string name = 1; + + // Required and immutable. The wrapping method to be used for incoming + // key material. + ImportMethod import_method = 2; + + // Required and immutable. The protection level of the [ImportJob][google.cloud.kms.v1.ImportJob]. This + // must match the + // [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level] of the + // [version_template][google.cloud.kms.v1.CryptoKey.version_template] on the [CryptoKey][google.cloud.kms.v1.CryptoKey] you + // attempt to import into. + ProtectionLevel protection_level = 9; + + // Output only. The time at which this [ImportJob][google.cloud.kms.v1.ImportJob] was created. + google.protobuf.Timestamp create_time = 3; + + // Output only. The time this [ImportJob][google.cloud.kms.v1.ImportJob]'s key material was generated. + google.protobuf.Timestamp generate_time = 4; + + // Output only. The time at which this [ImportJob][google.cloud.kms.v1.ImportJob] is scheduled for + // expiration and can no longer be used to import key material. + google.protobuf.Timestamp expire_time = 5; + + // Output only. The time this [ImportJob][google.cloud.kms.v1.ImportJob] expired. Only present if + // [state][google.cloud.kms.v1.ImportJob.state] is [EXPIRED][google.cloud.kms.v1.ImportJob.ImportJobState.EXPIRED]. + google.protobuf.Timestamp expire_event_time = 10; + + // Output only. The current state of the [ImportJob][google.cloud.kms.v1.ImportJob], indicating if it can + // be used. + ImportJobState state = 6; + + // Output only. The public key with which to wrap key material prior to + // import. Only returned if [state][google.cloud.kms.v1.ImportJob.state] is + // [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE]. + WrappingPublicKey public_key = 7; + + // Output only. Statement that was generated and signed by the key creator + // (for example, an HSM) at key creation time. Use this statement to verify + // attributes of the key as stored on the HSM, independently of Google. + // Only present if the chosen [ImportMethod][google.cloud.kms.v1.ImportJob.ImportMethod] is one with a protection + // level of [HSM][google.cloud.kms.v1.ProtectionLevel.HSM]. + KeyOperationAttestation attestation = 8; +} diff --git a/kms/google/cloud/kms_v1/proto/resources_pb2.py b/kms/google/cloud/kms_v1/proto/resources_pb2.py index fa655a91ad26..2ba0aef61b86 100644 --- a/kms/google/cloud/kms_v1/proto/resources_pb2.py +++ b/kms/google/cloud/kms_v1/proto/resources_pb2.py @@ -1,3 +1,4 @@ +# -*- coding: utf-8 -*- # Generated by the protocol buffer compiler. DO NOT EDIT! # source: google/cloud/kms_v1/proto/resources.proto @@ -28,7 +29,7 @@ "\n\027com.google.cloud.kms.v1B\021KmsResourcesProtoP\001Z6google.golang.org/genproto/googleapis/cloud/kms/v1;kms\370\001\001\252\002\023Google.Cloud.Kms.V1\312\002\023Google\\Cloud\\Kms\\V1" ), serialized_pb=_b( - '\n)google/cloud/kms_v1/proto/resources.proto\x12\x13google.cloud.kms.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto"H\n\x07KeyRing\x12\x0c\n\x04name\x18\x01 \x01(\t\x12/\n\x0b\x63reate_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp"\xf5\x04\n\tCryptoKey\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x36\n\x07primary\x18\x02 \x01(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersion\x12@\n\x07purpose\x18\x03 \x01(\x0e\x32/.google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12next_rotation_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x0frotation_period\x18\x08 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12G\n\x10version_template\x18\x0b \x01(\x0b\x32-.google.cloud.kms.v1.CryptoKeyVersionTemplate\x12:\n\x06labels\x18\n \x03(\x0b\x32*.google.cloud.kms.v1.CryptoKey.LabelsEntry\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01"x\n\x10\x43ryptoKeyPurpose\x12"\n\x1e\x43RYPTO_KEY_PURPOSE_UNSPECIFIED\x10\x00\x12\x13\n\x0f\x45NCRYPT_DECRYPT\x10\x01\x12\x13\n\x0f\x41SYMMETRIC_SIGN\x10\x05\x12\x16\n\x12\x41SYMMETRIC_DECRYPT\x10\x06\x42\x13\n\x11rotation_schedule"\xae\x01\n\x18\x43ryptoKeyVersionTemplate\x12>\n\x10protection_level\x18\x01 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevel\x12R\n\talgorithm\x18\x03 \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm"\xe7\x01\n\x17KeyOperationAttestation\x12N\n\x06\x66ormat\x18\x04 \x01(\x0e\x32>.google.cloud.kms.v1.KeyOperationAttestation.AttestationFormat\x12\x0f\n\x07\x63ontent\x18\x05 \x01(\x0c"k\n\x11\x41ttestationFormat\x12"\n\x1e\x41TTESTATION_FORMAT_UNSPECIFIED\x10\x00\x12\x18\n\x14\x43\x41VIUM_V1_COMPRESSED\x10\x03\x12\x18\n\x14\x43\x41VIUM_V2_COMPRESSED\x10\x04"\xb8\t\n\x10\x43ryptoKeyVersion\x12\x0c\n\x04name\x18\x01 \x01(\t\x12J\n\x05state\x18\x03 \x01(\x0e\x32;.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState\x12>\n\x10protection_level\x18\x07 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevel\x12R\n\talgorithm\x18\n \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm\x12\x41\n\x0b\x61ttestation\x18\x08 \x01(\x0b\x32,.google.cloud.kms.v1.KeyOperationAttestation\x12/\n\x0b\x63reate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x31\n\rgenerate_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0c\x64\x65stroy_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12\x64\x65stroy_event_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp"\xbc\x03\n\x19\x43ryptoKeyVersionAlgorithm\x12,\n(CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED\x10\x00\x12\x1f\n\x1bGOOGLE_SYMMETRIC_ENCRYPTION\x10\x01\x12\x1c\n\x18RSA_SIGN_PSS_2048_SHA256\x10\x02\x12\x1c\n\x18RSA_SIGN_PSS_3072_SHA256\x10\x03\x12\x1c\n\x18RSA_SIGN_PSS_4096_SHA256\x10\x04\x12\x1e\n\x1aRSA_SIGN_PKCS1_2048_SHA256\x10\x05\x12\x1e\n\x1aRSA_SIGN_PKCS1_3072_SHA256\x10\x06\x12\x1e\n\x1aRSA_SIGN_PKCS1_4096_SHA256\x10\x07\x12 \n\x1cRSA_DECRYPT_OAEP_2048_SHA256\x10\x08\x12 \n\x1cRSA_DECRYPT_OAEP_3072_SHA256\x10\t\x12 \n\x1cRSA_DECRYPT_OAEP_4096_SHA256\x10\n\x12\x17\n\x13\x45\x43_SIGN_P256_SHA256\x10\x0c\x12\x17\n\x13\x45\x43_SIGN_P384_SHA384\x10\r"\x9a\x01\n\x15\x43ryptoKeyVersionState\x12(\n$CRYPTO_KEY_VERSION_STATE_UNSPECIFIED\x10\x00\x12\x16\n\x12PENDING_GENERATION\x10\x05\x12\x0b\n\x07\x45NABLED\x10\x01\x12\x0c\n\x08\x44ISABLED\x10\x02\x12\r\n\tDESTROYED\x10\x03\x12\x15\n\x11\x44\x45STROY_SCHEDULED\x10\x04"I\n\x14\x43ryptoKeyVersionView\x12\'\n#CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED\x10\x00\x12\x08\n\x04\x46ULL\x10\x01"l\n\tPublicKey\x12\x0b\n\x03pem\x18\x01 \x01(\t\x12R\n\talgorithm\x18\x02 \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm*J\n\x0fProtectionLevel\x12 \n\x1cPROTECTION_LEVEL_UNSPECIFIED\x10\x00\x12\x0c\n\x08SOFTWARE\x10\x01\x12\x07\n\x03HSM\x10\x02\x42\x95\x01\n\x17\x63om.google.cloud.kms.v1B\x11KmsResourcesProtoP\x01Z6google.golang.org/genproto/googleapis/cloud/kms/v1;kms\xf8\x01\x01\xaa\x02\x13Google.Cloud.Kms.V1\xca\x02\x13Google\\Cloud\\Kms\\V1b\x06proto3' + '\n)google/cloud/kms_v1/proto/resources.proto\x12\x13google.cloud.kms.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto"H\n\x07KeyRing\x12\x0c\n\x04name\x18\x01 \x01(\t\x12/\n\x0b\x63reate_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp"\xf5\x04\n\tCryptoKey\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x36\n\x07primary\x18\x02 \x01(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersion\x12@\n\x07purpose\x18\x03 \x01(\x0e\x32/.google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12next_rotation_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x0frotation_period\x18\x08 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12G\n\x10version_template\x18\x0b \x01(\x0b\x32-.google.cloud.kms.v1.CryptoKeyVersionTemplate\x12:\n\x06labels\x18\n \x03(\x0b\x32*.google.cloud.kms.v1.CryptoKey.LabelsEntry\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01"x\n\x10\x43ryptoKeyPurpose\x12"\n\x1e\x43RYPTO_KEY_PURPOSE_UNSPECIFIED\x10\x00\x12\x13\n\x0f\x45NCRYPT_DECRYPT\x10\x01\x12\x13\n\x0f\x41SYMMETRIC_SIGN\x10\x05\x12\x16\n\x12\x41SYMMETRIC_DECRYPT\x10\x06\x42\x13\n\x11rotation_schedule"\xae\x01\n\x18\x43ryptoKeyVersionTemplate\x12>\n\x10protection_level\x18\x01 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevel\x12R\n\talgorithm\x18\x03 \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm"\xe7\x01\n\x17KeyOperationAttestation\x12N\n\x06\x66ormat\x18\x04 \x01(\x0e\x32>.google.cloud.kms.v1.KeyOperationAttestation.AttestationFormat\x12\x0f\n\x07\x63ontent\x18\x05 \x01(\x0c"k\n\x11\x41ttestationFormat\x12"\n\x1e\x41TTESTATION_FORMAT_UNSPECIFIED\x10\x00\x12\x18\n\x14\x43\x41VIUM_V1_COMPRESSED\x10\x03\x12\x18\n\x14\x43\x41VIUM_V2_COMPRESSED\x10\x04"\xa3\x0b\n\x10\x43ryptoKeyVersion\x12\x0c\n\x04name\x18\x01 \x01(\t\x12J\n\x05state\x18\x03 \x01(\x0e\x32;.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState\x12>\n\x10protection_level\x18\x07 \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevel\x12R\n\talgorithm\x18\n \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm\x12\x41\n\x0b\x61ttestation\x18\x08 \x01(\x0b\x32,.google.cloud.kms.v1.KeyOperationAttestation\x12/\n\x0b\x63reate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x31\n\rgenerate_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0c\x64\x65stroy_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12\x64\x65stroy_event_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\nimport_job\x18\x0e \x01(\t\x12/\n\x0bimport_time\x18\x0f \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1d\n\x15import_failure_reason\x18\x10 \x01(\t"\x9c\x04\n\x19\x43ryptoKeyVersionAlgorithm\x12,\n(CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED\x10\x00\x12\x1f\n\x1bGOOGLE_SYMMETRIC_ENCRYPTION\x10\x01\x12\x1c\n\x18RSA_SIGN_PSS_2048_SHA256\x10\x02\x12\x1c\n\x18RSA_SIGN_PSS_3072_SHA256\x10\x03\x12\x1c\n\x18RSA_SIGN_PSS_4096_SHA256\x10\x04\x12\x1c\n\x18RSA_SIGN_PSS_4096_SHA512\x10\x0f\x12\x1e\n\x1aRSA_SIGN_PKCS1_2048_SHA256\x10\x05\x12\x1e\n\x1aRSA_SIGN_PKCS1_3072_SHA256\x10\x06\x12\x1e\n\x1aRSA_SIGN_PKCS1_4096_SHA256\x10\x07\x12\x1e\n\x1aRSA_SIGN_PKCS1_4096_SHA512\x10\x10\x12 \n\x1cRSA_DECRYPT_OAEP_2048_SHA256\x10\x08\x12 \n\x1cRSA_DECRYPT_OAEP_3072_SHA256\x10\t\x12 \n\x1cRSA_DECRYPT_OAEP_4096_SHA256\x10\n\x12 \n\x1cRSA_DECRYPT_OAEP_4096_SHA512\x10\x11\x12\x17\n\x13\x45\x43_SIGN_P256_SHA256\x10\x0c\x12\x17\n\x13\x45\x43_SIGN_P384_SHA384\x10\r"\xc1\x01\n\x15\x43ryptoKeyVersionState\x12(\n$CRYPTO_KEY_VERSION_STATE_UNSPECIFIED\x10\x00\x12\x16\n\x12PENDING_GENERATION\x10\x05\x12\x0b\n\x07\x45NABLED\x10\x01\x12\x0c\n\x08\x44ISABLED\x10\x02\x12\r\n\tDESTROYED\x10\x03\x12\x15\n\x11\x44\x45STROY_SCHEDULED\x10\x04\x12\x12\n\x0ePENDING_IMPORT\x10\x06\x12\x11\n\rIMPORT_FAILED\x10\x07"I\n\x14\x43ryptoKeyVersionView\x12\'\n#CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED\x10\x00\x12\x08\n\x04\x46ULL\x10\x01"l\n\tPublicKey\x12\x0b\n\x03pem\x18\x01 \x01(\t\x12R\n\talgorithm\x18\x02 \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm"\xa6\x06\n\tImportJob\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x42\n\rimport_method\x18\x02 \x01(\x0e\x32+.google.cloud.kms.v1.ImportJob.ImportMethod\x12>\n\x10protection_level\x18\t \x01(\x0e\x32$.google.cloud.kms.v1.ProtectionLevel\x12/\n\x0b\x63reate_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x31\n\rgenerate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x65xpire_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x11\x65xpire_event_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12<\n\x05state\x18\x06 \x01(\x0e\x32-.google.cloud.kms.v1.ImportJob.ImportJobState\x12\x44\n\npublic_key\x18\x07 \x01(\x0b\x32\x30.google.cloud.kms.v1.ImportJob.WrappingPublicKey\x12\x41\n\x0b\x61ttestation\x18\x08 \x01(\x0b\x32,.google.cloud.kms.v1.KeyOperationAttestation\x1a \n\x11WrappingPublicKey\x12\x0b\n\x03pem\x18\x01 \x01(\t"m\n\x0cImportMethod\x12\x1d\n\x19IMPORT_METHOD_UNSPECIFIED\x10\x00\x12\x1e\n\x1aRSA_OAEP_3072_SHA1_AES_256\x10\x01\x12\x1e\n\x1aRSA_OAEP_4096_SHA1_AES_256\x10\x02"c\n\x0eImportJobState\x12 \n\x1cIMPORT_JOB_STATE_UNSPECIFIED\x10\x00\x12\x16\n\x12PENDING_GENERATION\x10\x01\x12\n\n\x06\x41\x43TIVE\x10\x02\x12\x0b\n\x07\x45XPIRED\x10\x03*J\n\x0fProtectionLevel\x12 \n\x1cPROTECTION_LEVEL_UNSPECIFIED\x10\x00\x12\x0c\n\x08SOFTWARE\x10\x01\x12\x07\n\x03HSM\x10\x02\x42\x95\x01\n\x17\x63om.google.cloud.kms.v1B\x11KmsResourcesProtoP\x01Z6google.golang.org/genproto/googleapis/cloud/kms/v1;kms\xf8\x01\x01\xaa\x02\x13Google.Cloud.Kms.V1\xca\x02\x13Google\\Cloud\\Kms\\V1b\x06proto3' ), dependencies=[ google_dot_api_dot_annotations__pb2.DESCRIPTOR, @@ -59,8 +60,8 @@ ], containing_type=None, serialized_options=None, - serialized_start=2599, - serialized_end=2673, + serialized_start=3643, + serialized_end=3717, ) _sym_db.RegisterEnumDescriptor(_PROTECTIONLEVEL) @@ -189,57 +190,78 @@ type=None, ), _descriptor.EnumValueDescriptor( - name="RSA_SIGN_PKCS1_2048_SHA256", + name="RSA_SIGN_PSS_4096_SHA512", index=5, + number=15, + serialized_options=None, + type=None, + ), + _descriptor.EnumValueDescriptor( + name="RSA_SIGN_PKCS1_2048_SHA256", + index=6, number=5, serialized_options=None, type=None, ), _descriptor.EnumValueDescriptor( name="RSA_SIGN_PKCS1_3072_SHA256", - index=6, + index=7, number=6, serialized_options=None, type=None, ), _descriptor.EnumValueDescriptor( name="RSA_SIGN_PKCS1_4096_SHA256", - index=7, + index=8, number=7, serialized_options=None, type=None, ), + _descriptor.EnumValueDescriptor( + name="RSA_SIGN_PKCS1_4096_SHA512", + index=9, + number=16, + serialized_options=None, + type=None, + ), _descriptor.EnumValueDescriptor( name="RSA_DECRYPT_OAEP_2048_SHA256", - index=8, + index=10, number=8, serialized_options=None, type=None, ), _descriptor.EnumValueDescriptor( name="RSA_DECRYPT_OAEP_3072_SHA256", - index=9, + index=11, number=9, serialized_options=None, type=None, ), _descriptor.EnumValueDescriptor( name="RSA_DECRYPT_OAEP_4096_SHA256", - index=10, + index=12, number=10, serialized_options=None, type=None, ), + _descriptor.EnumValueDescriptor( + name="RSA_DECRYPT_OAEP_4096_SHA512", + index=13, + number=17, + serialized_options=None, + type=None, + ), _descriptor.EnumValueDescriptor( name="EC_SIGN_P256_SHA256", - index=11, + index=14, number=12, serialized_options=None, type=None, ), _descriptor.EnumValueDescriptor( name="EC_SIGN_P384_SHA384", - index=12, + index=15, number=13, serialized_options=None, type=None, @@ -247,8 +269,8 @@ ], containing_type=None, serialized_options=None, - serialized_start=1811, - serialized_end=2255, + serialized_start=1911, + serialized_end=2451, ) _sym_db.RegisterEnumDescriptor(_CRYPTOKEYVERSION_CRYPTOKEYVERSIONALGORITHM) @@ -288,11 +310,17 @@ serialized_options=None, type=None, ), + _descriptor.EnumValueDescriptor( + name="PENDING_IMPORT", index=6, number=6, serialized_options=None, type=None + ), + _descriptor.EnumValueDescriptor( + name="IMPORT_FAILED", index=7, number=7, serialized_options=None, type=None + ), ], containing_type=None, serialized_options=None, - serialized_start=2258, - serialized_end=2412, + serialized_start=2454, + serialized_end=2647, ) _sym_db.RegisterEnumDescriptor(_CRYPTOKEYVERSION_CRYPTOKEYVERSIONSTATE) @@ -315,11 +343,80 @@ ], containing_type=None, serialized_options=None, - serialized_start=2414, - serialized_end=2487, + serialized_start=2649, + serialized_end=2722, ) _sym_db.RegisterEnumDescriptor(_CRYPTOKEYVERSION_CRYPTOKEYVERSIONVIEW) +_IMPORTJOB_IMPORTMETHOD = _descriptor.EnumDescriptor( + name="ImportMethod", + full_name="google.cloud.kms.v1.ImportJob.ImportMethod", + filename=None, + file=DESCRIPTOR, + values=[ + _descriptor.EnumValueDescriptor( + name="IMPORT_METHOD_UNSPECIFIED", + index=0, + number=0, + serialized_options=None, + type=None, + ), + _descriptor.EnumValueDescriptor( + name="RSA_OAEP_3072_SHA1_AES_256", + index=1, + number=1, + serialized_options=None, + type=None, + ), + _descriptor.EnumValueDescriptor( + name="RSA_OAEP_4096_SHA1_AES_256", + index=2, + number=2, + serialized_options=None, + type=None, + ), + ], + containing_type=None, + serialized_options=None, + serialized_start=3431, + serialized_end=3540, +) +_sym_db.RegisterEnumDescriptor(_IMPORTJOB_IMPORTMETHOD) + +_IMPORTJOB_IMPORTJOBSTATE = _descriptor.EnumDescriptor( + name="ImportJobState", + full_name="google.cloud.kms.v1.ImportJob.ImportJobState", + filename=None, + file=DESCRIPTOR, + values=[ + _descriptor.EnumValueDescriptor( + name="IMPORT_JOB_STATE_UNSPECIFIED", + index=0, + number=0, + serialized_options=None, + type=None, + ), + _descriptor.EnumValueDescriptor( + name="PENDING_GENERATION", + index=1, + number=1, + serialized_options=None, + type=None, + ), + _descriptor.EnumValueDescriptor( + name="ACTIVE", index=2, number=2, serialized_options=None, type=None + ), + _descriptor.EnumValueDescriptor( + name="EXPIRED", index=3, number=3, serialized_options=None, type=None + ), + ], + containing_type=None, + serialized_options=None, + serialized_start=3542, + serialized_end=3641, +) +_sym_db.RegisterEnumDescriptor(_IMPORTJOB_IMPORTJOBSTATE) + _KEYRING = _descriptor.Descriptor( name="KeyRing", @@ -890,6 +987,60 @@ serialized_options=None, file=DESCRIPTOR, ), + _descriptor.FieldDescriptor( + name="import_job", + full_name="google.cloud.kms.v1.CryptoKeyVersion.import_job", + index=9, + number=14, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="import_time", + full_name="google.cloud.kms.v1.CryptoKeyVersion.import_time", + index=10, + number=15, + type=11, + cpp_type=10, + label=1, + has_default_value=False, + default_value=None, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="import_failure_reason", + full_name="google.cloud.kms.v1.CryptoKeyVersion.import_failure_reason", + index=11, + number=16, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), ], extensions=[], nested_types=[], @@ -904,7 +1055,7 @@ extension_ranges=[], oneofs=[], serialized_start=1279, - serialized_end=2487, + serialized_end=2722, ) @@ -960,8 +1111,247 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2489, - serialized_end=2597, + serialized_start=2724, + serialized_end=2832, +) + + +_IMPORTJOB_WRAPPINGPUBLICKEY = _descriptor.Descriptor( + name="WrappingPublicKey", + full_name="google.cloud.kms.v1.ImportJob.WrappingPublicKey", + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name="pem", + full_name="google.cloud.kms.v1.ImportJob.WrappingPublicKey.pem", + index=0, + number=1, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ) + ], + extensions=[], + nested_types=[], + enum_types=[], + serialized_options=None, + is_extendable=False, + syntax="proto3", + extension_ranges=[], + oneofs=[], + serialized_start=3397, + serialized_end=3429, +) + +_IMPORTJOB = _descriptor.Descriptor( + name="ImportJob", + full_name="google.cloud.kms.v1.ImportJob", + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name="name", + full_name="google.cloud.kms.v1.ImportJob.name", + index=0, + number=1, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="import_method", + full_name="google.cloud.kms.v1.ImportJob.import_method", + index=1, + number=2, + type=14, + cpp_type=8, + label=1, + has_default_value=False, + default_value=0, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="protection_level", + full_name="google.cloud.kms.v1.ImportJob.protection_level", + index=2, + number=9, + type=14, + cpp_type=8, + label=1, + has_default_value=False, + default_value=0, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="create_time", + full_name="google.cloud.kms.v1.ImportJob.create_time", + index=3, + number=3, + type=11, + cpp_type=10, + label=1, + has_default_value=False, + default_value=None, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="generate_time", + full_name="google.cloud.kms.v1.ImportJob.generate_time", + index=4, + number=4, + type=11, + cpp_type=10, + label=1, + has_default_value=False, + default_value=None, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="expire_time", + full_name="google.cloud.kms.v1.ImportJob.expire_time", + index=5, + number=5, + type=11, + cpp_type=10, + label=1, + has_default_value=False, + default_value=None, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="expire_event_time", + full_name="google.cloud.kms.v1.ImportJob.expire_event_time", + index=6, + number=10, + type=11, + cpp_type=10, + label=1, + has_default_value=False, + default_value=None, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="state", + full_name="google.cloud.kms.v1.ImportJob.state", + index=7, + number=6, + type=14, + cpp_type=8, + label=1, + has_default_value=False, + default_value=0, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="public_key", + full_name="google.cloud.kms.v1.ImportJob.public_key", + index=8, + number=7, + type=11, + cpp_type=10, + label=1, + has_default_value=False, + default_value=None, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="attestation", + full_name="google.cloud.kms.v1.ImportJob.attestation", + index=9, + number=8, + type=11, + cpp_type=10, + label=1, + has_default_value=False, + default_value=None, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + ], + extensions=[], + nested_types=[_IMPORTJOB_WRAPPINGPUBLICKEY], + enum_types=[_IMPORTJOB_IMPORTMETHOD, _IMPORTJOB_IMPORTJOBSTATE], + serialized_options=None, + is_extendable=False, + syntax="proto3", + extension_ranges=[], + oneofs=[], + serialized_start=2835, + serialized_end=3641, ) _KEYRING.fields_by_name[ @@ -1018,18 +1408,42 @@ _CRYPTOKEYVERSION.fields_by_name[ "destroy_event_time" ].message_type = google_dot_protobuf_dot_timestamp__pb2._TIMESTAMP +_CRYPTOKEYVERSION.fields_by_name[ + "import_time" +].message_type = google_dot_protobuf_dot_timestamp__pb2._TIMESTAMP _CRYPTOKEYVERSION_CRYPTOKEYVERSIONALGORITHM.containing_type = _CRYPTOKEYVERSION _CRYPTOKEYVERSION_CRYPTOKEYVERSIONSTATE.containing_type = _CRYPTOKEYVERSION _CRYPTOKEYVERSION_CRYPTOKEYVERSIONVIEW.containing_type = _CRYPTOKEYVERSION _PUBLICKEY.fields_by_name[ "algorithm" ].enum_type = _CRYPTOKEYVERSION_CRYPTOKEYVERSIONALGORITHM +_IMPORTJOB_WRAPPINGPUBLICKEY.containing_type = _IMPORTJOB +_IMPORTJOB.fields_by_name["import_method"].enum_type = _IMPORTJOB_IMPORTMETHOD +_IMPORTJOB.fields_by_name["protection_level"].enum_type = _PROTECTIONLEVEL +_IMPORTJOB.fields_by_name[ + "create_time" +].message_type = google_dot_protobuf_dot_timestamp__pb2._TIMESTAMP +_IMPORTJOB.fields_by_name[ + "generate_time" +].message_type = google_dot_protobuf_dot_timestamp__pb2._TIMESTAMP +_IMPORTJOB.fields_by_name[ + "expire_time" +].message_type = google_dot_protobuf_dot_timestamp__pb2._TIMESTAMP +_IMPORTJOB.fields_by_name[ + "expire_event_time" +].message_type = google_dot_protobuf_dot_timestamp__pb2._TIMESTAMP +_IMPORTJOB.fields_by_name["state"].enum_type = _IMPORTJOB_IMPORTJOBSTATE +_IMPORTJOB.fields_by_name["public_key"].message_type = _IMPORTJOB_WRAPPINGPUBLICKEY +_IMPORTJOB.fields_by_name["attestation"].message_type = _KEYOPERATIONATTESTATION +_IMPORTJOB_IMPORTMETHOD.containing_type = _IMPORTJOB +_IMPORTJOB_IMPORTJOBSTATE.containing_type = _IMPORTJOB DESCRIPTOR.message_types_by_name["KeyRing"] = _KEYRING DESCRIPTOR.message_types_by_name["CryptoKey"] = _CRYPTOKEY DESCRIPTOR.message_types_by_name["CryptoKeyVersionTemplate"] = _CRYPTOKEYVERSIONTEMPLATE DESCRIPTOR.message_types_by_name["KeyOperationAttestation"] = _KEYOPERATIONATTESTATION DESCRIPTOR.message_types_by_name["CryptoKeyVersion"] = _CRYPTOKEYVERSION DESCRIPTOR.message_types_by_name["PublicKey"] = _PUBLICKEY +DESCRIPTOR.message_types_by_name["ImportJob"] = _IMPORTJOB DESCRIPTOR.enum_types_by_name["ProtectionLevel"] = _PROTECTIONLEVEL _sym_db.RegisterFileDescriptor(DESCRIPTOR) @@ -1196,7 +1610,9 @@ dict( DESCRIPTOR=_KEYOPERATIONATTESTATION, __module__="google.cloud.kms_v1.proto.resources_pb2", - __doc__="""Contains an HSM-generated attestation about a key operation. + __doc__="""Contains an HSM-generated attestation about a key operation. For more + information, see [Verifying attestations] + (https://cloud.google.com/kms/docs/attest-key). Attributes: @@ -1277,6 +1693,20 @@ [state][google.cloud.kms.v1.CryptoKeyVersion.state] is [DESTRO YED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionStat e.DESTROYED]. + import_job: + Output only. The name of the + [ImportJob][google.cloud.kms.v1.ImportJob] used to import this + [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Only + present if the underlying key material was imported. + import_time: + Output only. The time at which this + [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key + material was imported. + import_failure_reason: + Output only. The root cause of an import failure. Only present + if [state][google.cloud.kms.v1.CryptoKeyVersion.state] is [IMP + ORT\_FAILED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVer + sionState.IMPORT\_FAILED]. """, # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.CryptoKeyVersion) ), @@ -1311,6 +1741,127 @@ ) _sym_db.RegisterMessage(PublicKey) +ImportJob = _reflection.GeneratedProtocolMessageType( + "ImportJob", + (_message.Message,), + dict( + WrappingPublicKey=_reflection.GeneratedProtocolMessageType( + "WrappingPublicKey", + (_message.Message,), + dict( + DESCRIPTOR=_IMPORTJOB_WRAPPINGPUBLICKEY, + __module__="google.cloud.kms_v1.proto.resources_pb2", + __doc__="""The public key component of the wrapping key. For details of the type of + key this public key corresponds to, see the + [ImportMethod][google.cloud.kms.v1.ImportJob.ImportMethod]. + + + Attributes: + pem: + The public key, encoded in PEM format. For more information, + see the `RFC 7468 `__ + sections for `General Considerations + `__ and + [Textual Encoding of Subject Public Key Info] + (https://tools.ietf.org/html/rfc7468#section-13). + """, + # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.ImportJob.WrappingPublicKey) + ), + ), + DESCRIPTOR=_IMPORTJOB, + __module__="google.cloud.kms_v1.proto.resources_pb2", + __doc__="""An [ImportJob][google.cloud.kms.v1.ImportJob] can be used to create + [CryptoKeys][google.cloud.kms.v1.CryptoKey] and + [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] using + pre-existing key material, generated outside of Cloud KMS. + + When an [ImportJob][google.cloud.kms.v1.ImportJob] is created, Cloud KMS + will generate a "wrapping key", which is a public/private key pair. You + use the wrapping key to encrypt (also known as wrap) the pre-existing + key material to protect it during the import process. The nature of the + wrapping key depends on the choice of + [import\_method][google.cloud.kms.v1.ImportJob.import\_method]. When the + wrapping key generation is complete, the + [state][google.cloud.kms.v1.ImportJob.state] will be set to + [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE] and the + [public\_key][google.cloud.kms.v1.ImportJob.public\_key] can be fetched. + The fetched public key can then be used to wrap your pre-existing key + material. + + Once the key material is wrapped, it can be imported into a new + [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in an existing + [CryptoKey][google.cloud.kms.v1.CryptoKey] by calling + [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]. + Multiple [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] can + be imported with a single [ImportJob][google.cloud.kms.v1.ImportJob]. + Cloud KMS uses the private key portion of the wrapping key to unwrap the + key material. Only Cloud KMS has access to the private key. + + An [ImportJob][google.cloud.kms.v1.ImportJob] expires 3 days after it is + created. Once expired, Cloud KMS will no longer be able to import or + unwrap any key material that was wrapped with the + [ImportJob][google.cloud.kms.v1.ImportJob]'s public key. + + For more information, see `Importing a + key `__. + + + Attributes: + name: + Output only. The resource name for this + [ImportJob][google.cloud.kms.v1.ImportJob] in the format + ``projects/*/locations/*/keyRings/*/importJobs/*``. + import_method: + Required and immutable. The wrapping method to be used for + incoming key material. + protection_level: + Required and immutable. The protection level of the + [ImportJob][google.cloud.kms.v1.ImportJob]. This must match + the [protection\_level][google.cloud.kms.v1.CryptoKeyVersionTe + mplate.protection\_level] of the [version\_template][google.cl + oud.kms.v1.CryptoKey.version\_template] on the + [CryptoKey][google.cloud.kms.v1.CryptoKey] you attempt to + import into. + create_time: + Output only. The time at which this + [ImportJob][google.cloud.kms.v1.ImportJob] was created. + generate_time: + Output only. The time this + [ImportJob][google.cloud.kms.v1.ImportJob]'s key material was + generated. + expire_time: + Output only. The time at which this + [ImportJob][google.cloud.kms.v1.ImportJob] is scheduled for + expiration and can no longer be used to import key material. + expire_event_time: + Output only. The time this + [ImportJob][google.cloud.kms.v1.ImportJob] expired. Only + present if [state][google.cloud.kms.v1.ImportJob.state] is [EX + PIRED][google.cloud.kms.v1.ImportJob.ImportJobState.EXPIRED]. + state: + Output only. The current state of the + [ImportJob][google.cloud.kms.v1.ImportJob], indicating if it + can be used. + public_key: + Output only. The public key with which to wrap key material + prior to import. Only returned if + [state][google.cloud.kms.v1.ImportJob.state] is + [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE]. + attestation: + Output only. Statement that was generated and signed by the + key creator (for example, an HSM) at key creation time. Use + this statement to verify attributes of the key as stored on + the HSM, independently of Google. Only present if the chosen + [ImportMethod][google.cloud.kms.v1.ImportJob.ImportMethod] is + one with a protection level of + [HSM][google.cloud.kms.v1.ProtectionLevel.HSM]. + """, + # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.ImportJob) + ), +) +_sym_db.RegisterMessage(ImportJob) +_sym_db.RegisterMessage(ImportJob.WrappingPublicKey) + DESCRIPTOR._options = None _CRYPTOKEY_LABELSENTRY._options = None diff --git a/kms/google/cloud/kms_v1/proto/service.proto b/kms/google/cloud/kms_v1/proto/service.proto index 81e22c25f706..0f1266dfe834 100644 --- a/kms/google/cloud/kms_v1/proto/service.proto +++ b/kms/google/cloud/kms_v1/proto/service.proto @@ -1,4 +1,4 @@ -// Copyright 2018 Google LLC. +// Copyright 2019 Google LLC. // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. @@ -20,8 +20,7 @@ package google.cloud.kms.v1; import "google/api/annotations.proto"; import "google/cloud/kms/v1/resources.proto"; import "google/protobuf/field_mask.proto"; -import "google/protobuf/struct.proto"; -import "google/protobuf/wrappers.proto"; +import "google/api/client.proto"; option cc_enable_arenas = true; option csharp_namespace = "Google.Cloud.Kms.V1"; @@ -43,6 +42,11 @@ option php_namespace = "Google\\Cloud\\Kms\\V1"; // If you are using manual gRPC libraries, see // [Using gRPC with Cloud KMS](https://cloud.google.com/kms/docs/grpc). service KeyManagementService { + option (google.api.default_host) = "cloudkms.googleapis.com"; + option (google.api.oauth_scopes) = + "https://www.googleapis.com/auth/cloud-platform," + "https://www.googleapis.com/auth/cloudkms"; + // Lists [KeyRings][google.cloud.kms.v1.KeyRing]. rpc ListKeyRings(ListKeyRingsRequest) returns (ListKeyRingsResponse) { option (google.api.http) = { @@ -58,13 +62,19 @@ service KeyManagementService { } // Lists [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]. - rpc ListCryptoKeyVersions(ListCryptoKeyVersionsRequest) - returns (ListCryptoKeyVersionsResponse) { + rpc ListCryptoKeyVersions(ListCryptoKeyVersionsRequest) returns (ListCryptoKeyVersionsResponse) { option (google.api.http) = { get: "/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions" }; } + // Lists [ImportJobs][google.cloud.kms.v1.ImportJob]. + rpc ListImportJobs(ListImportJobsRequest) returns (ListImportJobsResponse) { + option (google.api.http) = { + get: "/v1/{parent=projects/*/locations/*/keyRings/*}/importJobs" + }; + } + // Returns metadata for a given [KeyRing][google.cloud.kms.v1.KeyRing]. rpc GetKeyRing(GetKeyRingRequest) returns (KeyRing) { option (google.api.http) = { @@ -72,29 +82,24 @@ service KeyManagementService { }; } - // Returns metadata for a given [CryptoKey][google.cloud.kms.v1.CryptoKey], as - // well as its [primary][google.cloud.kms.v1.CryptoKey.primary] - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. + // Returns metadata for a given [CryptoKey][google.cloud.kms.v1.CryptoKey], as well as its + // [primary][google.cloud.kms.v1.CryptoKey.primary] [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. rpc GetCryptoKey(GetCryptoKeyRequest) returns (CryptoKey) { option (google.api.http) = { get: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}" }; } - // Returns metadata for a given - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. - rpc GetCryptoKeyVersion(GetCryptoKeyVersionRequest) - returns (CryptoKeyVersion) { + // Returns metadata for a given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. + rpc GetCryptoKeyVersion(GetCryptoKeyVersionRequest) returns (CryptoKeyVersion) { option (google.api.http) = { get: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}" }; } - // Returns the public key for the given - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. The + // Returns the public key for the given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. The // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be - // [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN] - // or + // [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN] or // [ASYMMETRIC_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT]. rpc GetPublicKey(GetPublicKeyRequest) returns (PublicKey) { option (google.api.http) = { @@ -102,8 +107,14 @@ service KeyManagementService { }; } - // Create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and - // Location. + // Returns metadata for a given [ImportJob][google.cloud.kms.v1.ImportJob]. + rpc GetImportJob(GetImportJobRequest) returns (ImportJob) { + option (google.api.http) = { + get: "/v1/{name=projects/*/locations/*/keyRings/*/importJobs/*}" + }; + } + + // Create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and Location. rpc CreateKeyRing(CreateKeyRingRequest) returns (KeyRing) { option (google.api.http) = { post: "/v1/{parent=projects/*/locations/*}/keyRings" @@ -111,8 +122,7 @@ service KeyManagementService { }; } - // Create a new [CryptoKey][google.cloud.kms.v1.CryptoKey] within a - // [KeyRing][google.cloud.kms.v1.KeyRing]. + // Create a new [CryptoKey][google.cloud.kms.v1.CryptoKey] within a [KeyRing][google.cloud.kms.v1.KeyRing]. // // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] and // [CryptoKey.version_template.algorithm][google.cloud.kms.v1.CryptoKeyVersionTemplate.algorithm] @@ -124,20 +134,40 @@ service KeyManagementService { }; } - // Create a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in a - // [CryptoKey][google.cloud.kms.v1.CryptoKey]. + // Create a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in a [CryptoKey][google.cloud.kms.v1.CryptoKey]. // // The server will assign the next sequential id. If unset, // [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to // [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED]. - rpc CreateCryptoKeyVersion(CreateCryptoKeyVersionRequest) - returns (CryptoKeyVersion) { + rpc CreateCryptoKeyVersion(CreateCryptoKeyVersionRequest) returns (CryptoKeyVersion) { option (google.api.http) = { post: "/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions" body: "crypto_key_version" }; } + // Imports a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] into an existing [CryptoKey][google.cloud.kms.v1.CryptoKey] using the + // wrapped key material provided in the request. + // + // The version ID will be assigned the next sequential id within the + // [CryptoKey][google.cloud.kms.v1.CryptoKey]. + rpc ImportCryptoKeyVersion(ImportCryptoKeyVersionRequest) returns (CryptoKeyVersion) { + option (google.api.http) = { + post: "/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions:import" + body: "*" + }; + } + + // Create a new [ImportJob][google.cloud.kms.v1.ImportJob] within a [KeyRing][google.cloud.kms.v1.KeyRing]. + // + // [ImportJob.import_method][google.cloud.kms.v1.ImportJob.import_method] is required. + rpc CreateImportJob(CreateImportJobRequest) returns (ImportJob) { + option (google.api.http) = { + post: "/v1/{parent=projects/*/locations/*/keyRings/*}/importJobs" + body: "import_job" + }; + } + // Update a [CryptoKey][google.cloud.kms.v1.CryptoKey]. rpc UpdateCryptoKey(UpdateCryptoKeyRequest) returns (CryptoKey) { option (google.api.http) = { @@ -146,29 +176,22 @@ service KeyManagementService { }; } - // Update a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s - // metadata. + // Update a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s metadata. // // [state][google.cloud.kms.v1.CryptoKeyVersion.state] may be changed between - // [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] - // and - // [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] - // using this method. See - // [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion] - // and - // [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] - // to move between other states. - rpc UpdateCryptoKeyVersion(UpdateCryptoKeyVersionRequest) - returns (CryptoKeyVersion) { + // [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] and + // [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] using this + // method. See [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion] and [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] to + // move between other states. + rpc UpdateCryptoKeyVersion(UpdateCryptoKeyVersionRequest) returns (CryptoKeyVersion) { option (google.api.http) = { patch: "/v1/{crypto_key_version.name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}" body: "crypto_key_version" }; } - // Encrypts data, so that it can only be recovered by a call to - // [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. The - // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be + // Encrypts data, so that it can only be recovered by a call to [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. + // The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. rpc Encrypt(EncryptRequest) returns (EncryptResponse) { option (google.api.http) = { @@ -177,10 +200,8 @@ service KeyManagementService { }; } - // Decrypts data that was protected by - // [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. The - // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be - // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. + // Decrypts data that was protected by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] + // must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. rpc Decrypt(DecryptRequest) returns (DecryptResponse) { option (google.api.http) = { post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:decrypt" @@ -188,11 +209,9 @@ service KeyManagementService { }; } - // Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] - // with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] + // Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] // ASYMMETRIC_SIGN, producing a signature that can be verified with the public - // key retrieved from - // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. + // key retrieved from [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. rpc AsymmetricSign(AsymmetricSignRequest) returns (AsymmetricSignResponse) { option (google.api.http) = { post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:asymmetricSign" @@ -201,51 +220,38 @@ service KeyManagementService { } // Decrypts data that was encrypted with a public key retrieved from - // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] - // corresponding to a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] - // with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] - // ASYMMETRIC_DECRYPT. - rpc AsymmetricDecrypt(AsymmetricDecryptRequest) - returns (AsymmetricDecryptResponse) { + // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] corresponding to a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with + // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_DECRYPT. + rpc AsymmetricDecrypt(AsymmetricDecryptRequest) returns (AsymmetricDecryptResponse) { option (google.api.http) = { post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:asymmetricDecrypt" body: "*" }; } - // Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that - // will be used in - // [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. + // Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. // // Returns an error if called on an asymmetric key. - rpc UpdateCryptoKeyPrimaryVersion(UpdateCryptoKeyPrimaryVersionRequest) - returns (CryptoKey) { + rpc UpdateCryptoKeyPrimaryVersion(UpdateCryptoKeyPrimaryVersionRequest) returns (CryptoKey) { option (google.api.http) = { post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:updatePrimaryVersion" body: "*" }; } - // Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for - // destruction. + // Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction. // - // Upon calling this method, - // [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will - // be set to + // Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED] - // and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will - // be set to a time 24 hours in the future, at which point the - // [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be changed to - // [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], - // and the key material will be irrevocably destroyed. + // and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24 + // hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state] + // will be changed to + // [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key + // material will be irrevocably destroyed. // - // Before the - // [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is - // reached, - // [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] - // may be called to reverse the process. - rpc DestroyCryptoKeyVersion(DestroyCryptoKeyVersionRequest) - returns (CryptoKeyVersion) { + // Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached, + // [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process. + rpc DestroyCryptoKeyVersion(DestroyCryptoKeyVersionRequest) returns (CryptoKeyVersion) { option (google.api.http) = { post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:destroy" body: "*" @@ -256,13 +262,10 @@ service KeyManagementService { // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED] // state. // - // Upon restoration of the CryptoKeyVersion, - // [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to - // [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], - // and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will - // be cleared. - rpc RestoreCryptoKeyVersion(RestoreCryptoKeyVersionRequest) - returns (CryptoKeyVersion) { + // Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state] + // will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], + // and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared. + rpc RestoreCryptoKeyVersion(RestoreCryptoKeyVersionRequest) returns (CryptoKeyVersion) { option (google.api.http) = { post: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:restore" body: "*" @@ -270,41 +273,40 @@ service KeyManagementService { } } -// Request message for -// [KeyManagementService.ListKeyRings][google.cloud.kms.v1.KeyManagementService.ListKeyRings]. +// Request message for [KeyManagementService.ListKeyRings][google.cloud.kms.v1.KeyManagementService.ListKeyRings]. message ListKeyRingsRequest { // Required. The resource name of the location associated with the - // [KeyRings][google.cloud.kms.v1.KeyRing], in the format - // `projects/*/locations/*`. + // [KeyRings][google.cloud.kms.v1.KeyRing], in the format `projects/*/locations/*`. string parent = 1; - // Optional limit on the number of [KeyRings][google.cloud.kms.v1.KeyRing] to - // include in the response. Further [KeyRings][google.cloud.kms.v1.KeyRing] - // can subsequently be obtained by including the - // [ListKeyRingsResponse.next_page_token][google.cloud.kms.v1.ListKeyRingsResponse.next_page_token] - // in a subsequent request. If unspecified, the server will pick an - // appropriate default. + // Optional limit on the number of [KeyRings][google.cloud.kms.v1.KeyRing] to include in the + // response. Further [KeyRings][google.cloud.kms.v1.KeyRing] can subsequently be obtained by + // including the [ListKeyRingsResponse.next_page_token][google.cloud.kms.v1.ListKeyRingsResponse.next_page_token] in a subsequent + // request. If unspecified, the server will pick an appropriate default. int32 page_size = 2; // Optional pagination token, returned earlier via // [ListKeyRingsResponse.next_page_token][google.cloud.kms.v1.ListKeyRingsResponse.next_page_token]. string page_token = 3; + + // Optional. Only include resources that match the filter in the response. + string filter = 4; + + // Optional. Specify how the results should be sorted. If not specified, the + // results will be sorted in the default order. + string order_by = 5; } -// Request message for -// [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys]. +// Request message for [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys]. message ListCryptoKeysRequest { - // Required. The resource name of the [KeyRing][google.cloud.kms.v1.KeyRing] - // to list, in the format `projects/*/locations/*/keyRings/*`. + // Required. The resource name of the [KeyRing][google.cloud.kms.v1.KeyRing] to list, in the format + // `projects/*/locations/*/keyRings/*`. string parent = 1; - // Optional limit on the number of [CryptoKeys][google.cloud.kms.v1.CryptoKey] - // to include in the response. Further - // [CryptoKeys][google.cloud.kms.v1.CryptoKey] can subsequently be obtained by - // including the - // [ListCryptoKeysResponse.next_page_token][google.cloud.kms.v1.ListCryptoKeysResponse.next_page_token] - // in a subsequent request. If unspecified, the server will pick an - // appropriate default. + // Optional limit on the number of [CryptoKeys][google.cloud.kms.v1.CryptoKey] to include in the + // response. Further [CryptoKeys][google.cloud.kms.v1.CryptoKey] can subsequently be obtained by + // including the [ListCryptoKeysResponse.next_page_token][google.cloud.kms.v1.ListCryptoKeysResponse.next_page_token] in a subsequent + // request. If unspecified, the server will pick an appropriate default. int32 page_size = 2; // Optional pagination token, returned earlier via @@ -313,23 +315,26 @@ message ListCryptoKeysRequest { // The fields of the primary version to include in the response. CryptoKeyVersion.CryptoKeyVersionView version_view = 4; + + // Optional. Only include resources that match the filter in the response. + string filter = 5; + + // Optional. Specify how the results should be sorted. If not specified, the + // results will be sorted in the default order. + string order_by = 6; } -// Request message for -// [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions]. +// Request message for [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions]. message ListCryptoKeyVersionsRequest { - // Required. The resource name of the - // [CryptoKey][google.cloud.kms.v1.CryptoKey] to list, in the format + // Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to list, in the format // `projects/*/locations/*/keyRings/*/cryptoKeys/*`. string parent = 1; - // Optional limit on the number of - // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] to include in the - // response. Further [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] - // can subsequently be obtained by including the - // [ListCryptoKeyVersionsResponse.next_page_token][google.cloud.kms.v1.ListCryptoKeyVersionsResponse.next_page_token] - // in a subsequent request. If unspecified, the server will pick an - // appropriate default. + // Optional limit on the number of [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] to + // include in the response. Further [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] can + // subsequently be obtained by including the + // [ListCryptoKeyVersionsResponse.next_page_token][google.cloud.kms.v1.ListCryptoKeyVersionsResponse.next_page_token] in a subsequent request. + // If unspecified, the server will pick an appropriate default. int32 page_size = 2; // Optional pagination token, returned earlier via @@ -338,95 +343,128 @@ message ListCryptoKeyVersionsRequest { // The fields to include in the response. CryptoKeyVersion.CryptoKeyVersionView view = 4; + + // Optional. Only include resources that match the filter in the response. + string filter = 5; + + // Optional. Specify how the results should be sorted. If not specified, the + // results will be sorted in the default order. + string order_by = 6; } -// Response message for -// [KeyManagementService.ListKeyRings][google.cloud.kms.v1.KeyManagementService.ListKeyRings]. +// Request message for [KeyManagementService.ListImportJobs][google.cloud.kms.v1.KeyManagementService.ListImportJobs]. +message ListImportJobsRequest { + // Required. The resource name of the [KeyRing][google.cloud.kms.v1.KeyRing] to list, in the format + // `projects/*/locations/*/keyRings/*`. + string parent = 1; + + // Optional limit on the number of [ImportJobs][google.cloud.kms.v1.ImportJob] to include in the + // response. Further [ImportJobs][google.cloud.kms.v1.ImportJob] can subsequently be obtained by + // including the [ListImportJobsResponse.next_page_token][google.cloud.kms.v1.ListImportJobsResponse.next_page_token] in a subsequent + // request. If unspecified, the server will pick an appropriate default. + int32 page_size = 2; + + // Optional pagination token, returned earlier via + // [ListImportJobsResponse.next_page_token][google.cloud.kms.v1.ListImportJobsResponse.next_page_token]. + string page_token = 3; + + // Optional. Only include resources that match the filter in the response. + string filter = 4; + + // Optional. Specify how the results should be sorted. If not specified, the + // results will be sorted in the default order. + string order_by = 5; +} + +// Response message for [KeyManagementService.ListKeyRings][google.cloud.kms.v1.KeyManagementService.ListKeyRings]. message ListKeyRingsResponse { // The list of [KeyRings][google.cloud.kms.v1.KeyRing]. repeated KeyRing key_rings = 1; // A token to retrieve next page of results. Pass this value in - // [ListKeyRingsRequest.page_token][google.cloud.kms.v1.ListKeyRingsRequest.page_token] - // to retrieve the next page of results. + // [ListKeyRingsRequest.page_token][google.cloud.kms.v1.ListKeyRingsRequest.page_token] to retrieve the next page of results. string next_page_token = 2; - // The total number of [KeyRings][google.cloud.kms.v1.KeyRing] that matched - // the query. + // The total number of [KeyRings][google.cloud.kms.v1.KeyRing] that matched the query. int32 total_size = 3; } -// Response message for -// [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys]. +// Response message for [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys]. message ListCryptoKeysResponse { // The list of [CryptoKeys][google.cloud.kms.v1.CryptoKey]. repeated CryptoKey crypto_keys = 1; // A token to retrieve next page of results. Pass this value in - // [ListCryptoKeysRequest.page_token][google.cloud.kms.v1.ListCryptoKeysRequest.page_token] - // to retrieve the next page of results. + // [ListCryptoKeysRequest.page_token][google.cloud.kms.v1.ListCryptoKeysRequest.page_token] to retrieve the next page of results. string next_page_token = 2; - // The total number of [CryptoKeys][google.cloud.kms.v1.CryptoKey] that - // matched the query. + // The total number of [CryptoKeys][google.cloud.kms.v1.CryptoKey] that matched the query. int32 total_size = 3; } -// Response message for -// [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions]. +// Response message for [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions]. message ListCryptoKeyVersionsResponse { // The list of [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]. repeated CryptoKeyVersion crypto_key_versions = 1; // A token to retrieve next page of results. Pass this value in - // [ListCryptoKeyVersionsRequest.page_token][google.cloud.kms.v1.ListCryptoKeyVersionsRequest.page_token] - // to retrieve the next page of results. + // [ListCryptoKeyVersionsRequest.page_token][google.cloud.kms.v1.ListCryptoKeyVersionsRequest.page_token] to retrieve the next page of + // results. string next_page_token = 2; - // The total number of - // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] that matched the + // The total number of [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] that matched the // query. int32 total_size = 3; } -// Request message for -// [KeyManagementService.GetKeyRing][google.cloud.kms.v1.KeyManagementService.GetKeyRing]. +// Response message for [KeyManagementService.ListImportJobs][google.cloud.kms.v1.KeyManagementService.ListImportJobs]. +message ListImportJobsResponse { + // The list of [ImportJobs][google.cloud.kms.v1.ImportJob]. + repeated ImportJob import_jobs = 1; + + // A token to retrieve next page of results. Pass this value in + // [ListImportJobsRequest.page_token][google.cloud.kms.v1.ListImportJobsRequest.page_token] to retrieve the next page of results. + string next_page_token = 2; + + // The total number of [ImportJobs][google.cloud.kms.v1.ImportJob] that matched the query. + int32 total_size = 3; +} + +// Request message for [KeyManagementService.GetKeyRing][google.cloud.kms.v1.KeyManagementService.GetKeyRing]. message GetKeyRingRequest { - // The [name][google.cloud.kms.v1.KeyRing.name] of the - // [KeyRing][google.cloud.kms.v1.KeyRing] to get. + // The [name][google.cloud.kms.v1.KeyRing.name] of the [KeyRing][google.cloud.kms.v1.KeyRing] to get. string name = 1; } -// Request message for -// [KeyManagementService.GetCryptoKey][google.cloud.kms.v1.KeyManagementService.GetCryptoKey]. +// Request message for [KeyManagementService.GetCryptoKey][google.cloud.kms.v1.KeyManagementService.GetCryptoKey]. message GetCryptoKeyRequest { - // The [name][google.cloud.kms.v1.CryptoKey.name] of the - // [CryptoKey][google.cloud.kms.v1.CryptoKey] to get. + // The [name][google.cloud.kms.v1.CryptoKey.name] of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to get. string name = 1; } -// Request message for -// [KeyManagementService.GetCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.GetCryptoKeyVersion]. +// Request message for [KeyManagementService.GetCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.GetCryptoKeyVersion]. message GetCryptoKeyVersionRequest { - // The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to get. + // The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to get. string name = 1; } -// Request message for -// [KeyManagementService.GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. +// Request message for [KeyManagementService.GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. message GetPublicKeyRequest { - // The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key to get. + // The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key to + // get. string name = 1; } -// Request message for -// [KeyManagementService.CreateKeyRing][google.cloud.kms.v1.KeyManagementService.CreateKeyRing]. +// Request message for [KeyManagementService.GetImportJob][google.cloud.kms.v1.KeyManagementService.GetImportJob]. +message GetImportJobRequest { + // The [name][google.cloud.kms.v1.ImportJob.name] of the [ImportJob][google.cloud.kms.v1.ImportJob] to get. + string name = 1; +} + +// Request message for [KeyManagementService.CreateKeyRing][google.cloud.kms.v1.KeyManagementService.CreateKeyRing]. message CreateKeyRingRequest { // Required. The resource name of the location associated with the - // [KeyRings][google.cloud.kms.v1.KeyRing], in the format - // `projects/*/locations/*`. + // [KeyRings][google.cloud.kms.v1.KeyRing], in the format `projects/*/locations/*`. string parent = 1; // Required. It must be unique within a location and match the regular @@ -437,11 +475,10 @@ message CreateKeyRingRequest { KeyRing key_ring = 3; } -// Request message for -// [KeyManagementService.CreateCryptoKey][google.cloud.kms.v1.KeyManagementService.CreateCryptoKey]. +// Request message for [KeyManagementService.CreateCryptoKey][google.cloud.kms.v1.KeyManagementService.CreateCryptoKey]. message CreateCryptoKeyRequest { - // Required. The [name][google.cloud.kms.v1.KeyRing.name] of the KeyRing - // associated with the [CryptoKeys][google.cloud.kms.v1.CryptoKey]. + // Required. The [name][google.cloud.kms.v1.KeyRing.name] of the KeyRing associated with the + // [CryptoKeys][google.cloud.kms.v1.CryptoKey]. string parent = 1; // Required. It must be unique within a KeyRing and match the regular @@ -450,23 +487,80 @@ message CreateCryptoKeyRequest { // A [CryptoKey][google.cloud.kms.v1.CryptoKey] with initial field values. CryptoKey crypto_key = 3; + + // If set to true, the request will create a [CryptoKey][google.cloud.kms.v1.CryptoKey] without any + // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]. You must manually call + // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] or + // [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion] + // before you can use this [CryptoKey][google.cloud.kms.v1.CryptoKey]. + bool skip_initial_version_creation = 5; } -// Request message for -// [KeyManagementService.CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]. +// Request message for [KeyManagementService.CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]. message CreateCryptoKeyVersionRequest { - // Required. The [name][google.cloud.kms.v1.CryptoKey.name] of the - // [CryptoKey][google.cloud.kms.v1.CryptoKey] associated with the - // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]. + // Required. The [name][google.cloud.kms.v1.CryptoKey.name] of the [CryptoKey][google.cloud.kms.v1.CryptoKey] associated with + // the [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]. string parent = 1; - // A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with initial - // field values. + // A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with initial field values. CryptoKeyVersion crypto_key_version = 2; } -// Request message for -// [KeyManagementService.UpdateCryptoKey][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKey]. +// Request message for [KeyManagementService.ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]. +message ImportCryptoKeyVersionRequest { + // Required. The [name][google.cloud.kms.v1.CryptoKey.name] of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to + // be imported into. + string parent = 1; + + // Required. The [algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] of + // the key being imported. This does not need to match the + // [version_template][google.cloud.kms.v1.CryptoKey.version_template] of the [CryptoKey][google.cloud.kms.v1.CryptoKey] this + // version imports into. + CryptoKeyVersion.CryptoKeyVersionAlgorithm algorithm = 2; + + // Required. The [name][google.cloud.kms.v1.ImportJob.name] of the [ImportJob][google.cloud.kms.v1.ImportJob] that was used to + // wrap this key material. + string import_job = 4; + + // Required. The incoming wrapped key material that is to be imported. + oneof wrapped_key_material { + // Wrapped key material produced with + // [RSA_OAEP_3072_SHA1_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256] + // or + // [RSA_OAEP_4096_SHA1_AES_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA_OAEP_4096_SHA1_AES_256]. + // + // This field contains the concatenation of two wrapped keys: + //
    + //
  1. An ephemeral AES-256 wrapping key wrapped with the + // [public_key][google.cloud.kms.v1.ImportJob.public_key] using RSAES-OAEP with SHA-1, + // MGF1 with SHA-1, and an empty label. + //
    2. + //
  2. The key to be imported, wrapped with the ephemeral AES-256 key + // using AES-KWP (RFC 5649). + //
    3. + //
+ // + // This format is the same as the format produced by PKCS#11 mechanism + // CKM_RSA_AES_KEY_WRAP. + bytes rsa_aes_wrapped_key = 5; + } +} + +// Request message for [KeyManagementService.CreateImportJob][google.cloud.kms.v1.KeyManagementService.CreateImportJob]. +message CreateImportJobRequest { + // Required. The [name][google.cloud.kms.v1.KeyRing.name] of the [KeyRing][google.cloud.kms.v1.KeyRing] associated with the + // [ImportJobs][google.cloud.kms.v1.ImportJob]. + string parent = 1; + + // Required. It must be unique within a KeyRing and match the regular + // expression `[a-zA-Z0-9_-]{1,63}` + string import_job_id = 2; + + // Required. An [ImportJob][google.cloud.kms.v1.ImportJob] with initial field values. + ImportJob import_job = 3; +} + +// Request message for [KeyManagementService.UpdateCryptoKey][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKey]. message UpdateCryptoKeyRequest { // [CryptoKey][google.cloud.kms.v1.CryptoKey] with updated values. CryptoKey crypto_key = 1; @@ -475,60 +569,50 @@ message UpdateCryptoKeyRequest { google.protobuf.FieldMask update_mask = 2; } -// Request message for -// [KeyManagementService.UpdateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyVersion]. +// Request message for [KeyManagementService.UpdateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyVersion]. message UpdateCryptoKeyVersionRequest { - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with updated - // values. + // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with updated values. CryptoKeyVersion crypto_key_version = 1; // Required list of fields to be updated in this request. google.protobuf.FieldMask update_mask = 2; } -// Request message for -// [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. +// Request message for [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. message EncryptRequest { - // Required. The resource name of the - // [CryptoKey][google.cloud.kms.v1.CryptoKey] or - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for - // encryption. + // Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] or [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] + // to use for encryption. // - // If a [CryptoKey][google.cloud.kms.v1.CryptoKey] is specified, the server - // will use its [primary version][google.cloud.kms.v1.CryptoKey.primary]. + // If a [CryptoKey][google.cloud.kms.v1.CryptoKey] is specified, the server will use its + // [primary version][google.cloud.kms.v1.CryptoKey.primary]. string name = 1; // Required. The data to encrypt. Must be no larger than 64KiB. // // The maximum size depends on the key version's - // [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]. - // For [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE] keys, the - // plaintext must be no larger than 64KiB. For - // [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] keys, the combined length of - // the plaintext and additional_authenticated_data fields must be no larger - // than 8KiB. + // [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]. For + // [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE] keys, the plaintext must be no larger + // than 64KiB. For [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] keys, the combined length of the + // plaintext and additional_authenticated_data fields must be no larger than + // 8KiB. bytes plaintext = 2; // Optional data that, if specified, must also be provided during decryption - // through - // [DecryptRequest.additional_authenticated_data][google.cloud.kms.v1.DecryptRequest.additional_authenticated_data]. + // through [DecryptRequest.additional_authenticated_data][google.cloud.kms.v1.DecryptRequest.additional_authenticated_data]. // // The maximum size depends on the key version's - // [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]. - // For [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE] keys, the AAD - // must be no larger than 64KiB. For - // [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] keys, the combined length of - // the plaintext and additional_authenticated_data fields must be no larger - // than 8KiB. + // [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]. For + // [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE] keys, the AAD must be no larger than + // 64KiB. For [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] keys, the combined length of the + // plaintext and additional_authenticated_data fields must be no larger than + // 8KiB. bytes additional_authenticated_data = 3; } -// Request message for -// [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. +// Request message for [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. message DecryptRequest { - // Required. The resource name of the - // [CryptoKey][google.cloud.kms.v1.CryptoKey] to use for decryption. The - // server will choose the appropriate version. + // Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to use for decryption. + // The server will choose the appropriate version. string name = 1; // Required. The encrypted data originally returned in @@ -540,12 +624,9 @@ message DecryptRequest { bytes additional_authenticated_data = 3; } -// Request message for -// [KeyManagementService.AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign]. +// Request message for [KeyManagementService.AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign]. message AsymmetricSignRequest { - // Required. The resource name of the - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for - // signing. + // Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing. string name = 1; // Required. The digest of the data to sign. The digest must be produced with @@ -554,79 +635,62 @@ message AsymmetricSignRequest { Digest digest = 3; } -// Request message for -// [KeyManagementService.AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt]. +// Request message for [KeyManagementService.AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt]. message AsymmetricDecryptRequest { - // Required. The resource name of the - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for + // Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for // decryption. string name = 1; - // Required. The data encrypted with the named - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s public key using - // OAEP. + // Required. The data encrypted with the named [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s public + // key using OAEP. bytes ciphertext = 3; } -// Response message for -// [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. +// Response message for [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. message DecryptResponse { - // The decrypted data originally supplied in - // [EncryptRequest.plaintext][google.cloud.kms.v1.EncryptRequest.plaintext]. + // The decrypted data originally supplied in [EncryptRequest.plaintext][google.cloud.kms.v1.EncryptRequest.plaintext]. bytes plaintext = 1; } -// Response message for -// [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. +// Response message for [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. message EncryptResponse { - // The resource name of the - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in - // encryption. + // The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] used in encryption. string name = 1; // The encrypted data. bytes ciphertext = 2; } -// Response message for -// [KeyManagementService.AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign]. +// Response message for [KeyManagementService.AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign]. message AsymmetricSignResponse { // The created signature. bytes signature = 1; } -// Response message for -// [KeyManagementService.AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt]. +// Response message for [KeyManagementService.AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt]. message AsymmetricDecryptResponse { // The decrypted data originally encrypted with the matching public key. bytes plaintext = 1; } -// Request message for -// [KeyManagementService.UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion]. +// Request message for [KeyManagementService.UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion]. message UpdateCryptoKeyPrimaryVersionRequest { - // The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to - // update. + // The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to update. string name = 1; - // The id of the child - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary. + // The id of the child [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary. string crypto_key_version_id = 2; } -// Request message for -// [KeyManagementService.DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion]. +// Request message for [KeyManagementService.DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion]. message DestroyCryptoKeyVersionRequest { - // The resource name of the - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy. + // The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy. string name = 1; } -// Request message for -// [KeyManagementService.RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion]. +// Request message for [KeyManagementService.RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion]. message RestoreCryptoKeyVersionRequest { - // The resource name of the - // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore. + // The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore. string name = 1; } @@ -645,12 +709,10 @@ message Digest { } } -// Cloud KMS metadata for the given -// [google.cloud.location.Location][google.cloud.location.Location]. +// Cloud KMS metadata for the given [google.cloud.location.Location][google.cloud.location.Location]. message LocationMetadata { // Indicates whether [CryptoKeys][google.cloud.kms.v1.CryptoKey] with // [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level] - // [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] can be created in this - // location. + // [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] can be created in this location. bool hsm_available = 1; } diff --git a/kms/google/cloud/kms_v1/proto/service_pb2.py b/kms/google/cloud/kms_v1/proto/service_pb2.py index d4a58a249bf0..8342ee0a60af 100644 --- a/kms/google/cloud/kms_v1/proto/service_pb2.py +++ b/kms/google/cloud/kms_v1/proto/service_pb2.py @@ -1,3 +1,4 @@ +# -*- coding: utf-8 -*- # Generated by the protocol buffer compiler. DO NOT EDIT! # source: google/cloud/kms_v1/proto/service.proto @@ -19,8 +20,7 @@ resources_pb2 as google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2, ) from google.protobuf import field_mask_pb2 as google_dot_protobuf_dot_field__mask__pb2 -from google.protobuf import struct_pb2 as google_dot_protobuf_dot_struct__pb2 -from google.protobuf import wrappers_pb2 as google_dot_protobuf_dot_wrappers__pb2 +from google.api import client_pb2 as google_dot_api_dot_client__pb2 DESCRIPTOR = _descriptor.FileDescriptor( @@ -31,14 +31,13 @@ "\n\027com.google.cloud.kms.v1B\010KmsProtoP\001Z6google.golang.org/genproto/googleapis/cloud/kms/v1;kms\370\001\001\252\002\023Google.Cloud.Kms.V1\312\002\023Google\\Cloud\\Kms\\V1" ), serialized_pb=_b( - '\n\'google/cloud/kms_v1/proto/service.proto\x12\x13google.cloud.kms.v1\x1a\x1cgoogle/api/annotations.proto\x1a)google/cloud/kms_v1/proto/resources.proto\x1a google/protobuf/field_mask.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1egoogle/protobuf/wrappers.proto"L\n\x13ListKeyRingsRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t"\xa0\x01\n\x15ListCryptoKeysRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\x12P\n\x0cversion_view\x18\x04 \x01(\x0e\x32:.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionView"\x9f\x01\n\x1cListCryptoKeyVersionsRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\x12H\n\x04view\x18\x04 \x01(\x0e\x32:.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionView"t\n\x14ListKeyRingsResponse\x12/\n\tkey_rings\x18\x01 \x03(\x0b\x32\x1c.google.cloud.kms.v1.KeyRing\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\x12\x12\n\ntotal_size\x18\x03 \x01(\x05"z\n\x16ListCryptoKeysResponse\x12\x33\n\x0b\x63rypto_keys\x18\x01 \x03(\x0b\x32\x1e.google.cloud.kms.v1.CryptoKey\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\x12\x12\n\ntotal_size\x18\x03 \x01(\x05"\x90\x01\n\x1dListCryptoKeyVersionsResponse\x12\x42\n\x13\x63rypto_key_versions\x18\x01 \x03(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersion\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\x12\x12\n\ntotal_size\x18\x03 \x01(\x05"!\n\x11GetKeyRingRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"#\n\x13GetCryptoKeyRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"*\n\x1aGetCryptoKeyVersionRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"#\n\x13GetPublicKeyRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"k\n\x14\x43reateKeyRingRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x13\n\x0bkey_ring_id\x18\x02 \x01(\t\x12.\n\x08key_ring\x18\x03 \x01(\x0b\x32\x1c.google.cloud.kms.v1.KeyRing"s\n\x16\x43reateCryptoKeyRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x15\n\rcrypto_key_id\x18\x02 \x01(\t\x12\x32\n\ncrypto_key\x18\x03 \x01(\x0b\x32\x1e.google.cloud.kms.v1.CryptoKey"r\n\x1d\x43reateCryptoKeyVersionRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x41\n\x12\x63rypto_key_version\x18\x02 \x01(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersion"}\n\x16UpdateCryptoKeyRequest\x12\x32\n\ncrypto_key\x18\x01 \x01(\x0b\x32\x1e.google.cloud.kms.v1.CryptoKey\x12/\n\x0bupdate_mask\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.FieldMask"\x93\x01\n\x1dUpdateCryptoKeyVersionRequest\x12\x41\n\x12\x63rypto_key_version\x18\x01 \x01(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersion\x12/\n\x0bupdate_mask\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.FieldMask"X\n\x0e\x45ncryptRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tplaintext\x18\x02 \x01(\x0c\x12%\n\x1d\x61\x64\x64itional_authenticated_data\x18\x03 \x01(\x0c"Y\n\x0e\x44\x65\x63ryptRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\nciphertext\x18\x02 \x01(\x0c\x12%\n\x1d\x61\x64\x64itional_authenticated_data\x18\x03 \x01(\x0c"R\n\x15\x41symmetricSignRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12+\n\x06\x64igest\x18\x03 \x01(\x0b\x32\x1b.google.cloud.kms.v1.Digest"<\n\x18\x41symmetricDecryptRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\nciphertext\x18\x03 \x01(\x0c"$\n\x0f\x44\x65\x63ryptResponse\x12\x11\n\tplaintext\x18\x01 \x01(\x0c"3\n\x0f\x45ncryptResponse\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\nciphertext\x18\x02 \x01(\x0c"+\n\x16\x41symmetricSignResponse\x12\x11\n\tsignature\x18\x01 \x01(\x0c".\n\x19\x41symmetricDecryptResponse\x12\x11\n\tplaintext\x18\x01 \x01(\x0c"S\n$UpdateCryptoKeyPrimaryVersionRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x1d\n\x15\x63rypto_key_version_id\x18\x02 \x01(\t".\n\x1e\x44\x65stroyCryptoKeyVersionRequest\x12\x0c\n\x04name\x18\x01 \x01(\t".\n\x1eRestoreCryptoKeyVersionRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"H\n\x06\x44igest\x12\x10\n\x06sha256\x18\x01 \x01(\x0cH\x00\x12\x10\n\x06sha384\x18\x02 \x01(\x0cH\x00\x12\x10\n\x06sha512\x18\x03 \x01(\x0cH\x00\x42\x08\n\x06\x64igest")\n\x10LocationMetadata\x12\x15\n\rhsm_available\x18\x01 \x01(\x08\x32\xcd\x1c\n\x14KeyManagementService\x12\x99\x01\n\x0cListKeyRings\x12(.google.cloud.kms.v1.ListKeyRingsRequest\x1a).google.cloud.kms.v1.ListKeyRingsResponse"4\x82\xd3\xe4\x93\x02.\x12,/v1/{parent=projects/*/locations/*}/keyRings\x12\xac\x01\n\x0eListCryptoKeys\x12*.google.cloud.kms.v1.ListCryptoKeysRequest\x1a+.google.cloud.kms.v1.ListCryptoKeysResponse"A\x82\xd3\xe4\x93\x02;\x12\x39/v1/{parent=projects/*/locations/*/keyRings/*}/cryptoKeys\x12\xd5\x01\n\x15ListCryptoKeyVersions\x12\x31.google.cloud.kms.v1.ListCryptoKeyVersionsRequest\x1a\x32.google.cloud.kms.v1.ListCryptoKeyVersionsResponse"U\x82\xd3\xe4\x93\x02O\x12M/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions\x12\x88\x01\n\nGetKeyRing\x12&.google.cloud.kms.v1.GetKeyRingRequest\x1a\x1c.google.cloud.kms.v1.KeyRing"4\x82\xd3\xe4\x93\x02.\x12,/v1/{name=projects/*/locations/*/keyRings/*}\x12\x9b\x01\n\x0cGetCryptoKey\x12(.google.cloud.kms.v1.GetCryptoKeyRequest\x1a\x1e.google.cloud.kms.v1.CryptoKey"A\x82\xd3\xe4\x93\x02;\x12\x39/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}\x12\xc4\x01\n\x13GetCryptoKeyVersion\x12/.google.cloud.kms.v1.GetCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"U\x82\xd3\xe4\x93\x02O\x12M/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}\x12\xb9\x01\n\x0cGetPublicKey\x12(.google.cloud.kms.v1.GetPublicKeyRequest\x1a\x1e.google.cloud.kms.v1.PublicKey"_\x82\xd3\xe4\x93\x02Y\x12W/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}/publicKey\x12\x98\x01\n\rCreateKeyRing\x12).google.cloud.kms.v1.CreateKeyRingRequest\x1a\x1c.google.cloud.kms.v1.KeyRing">\x82\xd3\xe4\x93\x02\x38",/v1/{parent=projects/*/locations/*}/keyRings:\x08key_ring\x12\xad\x01\n\x0f\x43reateCryptoKey\x12+.google.cloud.kms.v1.CreateCryptoKeyRequest\x1a\x1e.google.cloud.kms.v1.CryptoKey"M\x82\xd3\xe4\x93\x02G"9/v1/{parent=projects/*/locations/*/keyRings/*}/cryptoKeys:\ncrypto_key\x12\xde\x01\n\x16\x43reateCryptoKeyVersion\x12\x32.google.cloud.kms.v1.CreateCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"i\x82\xd3\xe4\x93\x02\x63"M/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions:\x12\x63rypto_key_version\x12\xb8\x01\n\x0fUpdateCryptoKey\x12+.google.cloud.kms.v1.UpdateCryptoKeyRequest\x1a\x1e.google.cloud.kms.v1.CryptoKey"X\x82\xd3\xe4\x93\x02R2D/v1/{crypto_key.name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:\ncrypto_key\x12\xf1\x01\n\x16UpdateCryptoKeyVersion\x12\x32.google.cloud.kms.v1.UpdateCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"|\x82\xd3\xe4\x93\x02v2`/v1/{crypto_key_version.name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:\x12\x63rypto_key_version\x12\xa3\x01\n\x07\x45ncrypt\x12#.google.cloud.kms.v1.EncryptRequest\x1a$.google.cloud.kms.v1.EncryptResponse"M\x82\xd3\xe4\x93\x02G"B/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/**}:encrypt:\x01*\x12\xa2\x01\n\x07\x44\x65\x63rypt\x12#.google.cloud.kms.v1.DecryptRequest\x1a$.google.cloud.kms.v1.DecryptResponse"L\x82\xd3\xe4\x93\x02\x46"A/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:decrypt:\x01*\x12\xd2\x01\n\x0e\x41symmetricSign\x12*.google.cloud.kms.v1.AsymmetricSignRequest\x1a+.google.cloud.kms.v1.AsymmetricSignResponse"g\x82\xd3\xe4\x93\x02\x61"\\/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:asymmetricSign:\x01*\x12\xde\x01\n\x11\x41symmetricDecrypt\x12-.google.cloud.kms.v1.AsymmetricDecryptRequest\x1a..google.cloud.kms.v1.AsymmetricDecryptResponse"j\x82\xd3\xe4\x93\x02\x64"_/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:asymmetricDecrypt:\x01*\x12\xd5\x01\n\x1dUpdateCryptoKeyPrimaryVersion\x12\x39.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest\x1a\x1e.google.cloud.kms.v1.CryptoKey"Y\x82\xd3\xe4\x93\x02S"N/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:updatePrimaryVersion:\x01*\x12\xd7\x01\n\x17\x44\x65stroyCryptoKeyVersion\x12\x33.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"`\x82\xd3\xe4\x93\x02Z"U/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:destroy:\x01*\x12\xd7\x01\n\x17RestoreCryptoKeyVersion\x12\x33.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"`\x82\xd3\xe4\x93\x02Z"U/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:restore:\x01*B\x8c\x01\n\x17\x63om.google.cloud.kms.v1B\x08KmsProtoP\x01Z6google.golang.org/genproto/googleapis/cloud/kms/v1;kms\xf8\x01\x01\xaa\x02\x13Google.Cloud.Kms.V1\xca\x02\x13Google\\Cloud\\Kms\\V1b\x06proto3' + '\n\'google/cloud/kms_v1/proto/service.proto\x12\x13google.cloud.kms.v1\x1a\x1cgoogle/api/annotations.proto\x1a)google/cloud/kms_v1/proto/resources.proto\x1a google/protobuf/field_mask.proto\x1a\x17google/api/client.proto"n\n\x13ListKeyRingsRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\x12\x0e\n\x06\x66ilter\x18\x04 \x01(\t\x12\x10\n\x08order_by\x18\x05 \x01(\t"\xc2\x01\n\x15ListCryptoKeysRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\x12P\n\x0cversion_view\x18\x04 \x01(\x0e\x32:.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionView\x12\x0e\n\x06\x66ilter\x18\x05 \x01(\t\x12\x10\n\x08order_by\x18\x06 \x01(\t"\xc1\x01\n\x1cListCryptoKeyVersionsRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\x12H\n\x04view\x18\x04 \x01(\x0e\x32:.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionView\x12\x0e\n\x06\x66ilter\x18\x05 \x01(\t\x12\x10\n\x08order_by\x18\x06 \x01(\t"p\n\x15ListImportJobsRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\x12\x0e\n\x06\x66ilter\x18\x04 \x01(\t\x12\x10\n\x08order_by\x18\x05 \x01(\t"t\n\x14ListKeyRingsResponse\x12/\n\tkey_rings\x18\x01 \x03(\x0b\x32\x1c.google.cloud.kms.v1.KeyRing\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\x12\x12\n\ntotal_size\x18\x03 \x01(\x05"z\n\x16ListCryptoKeysResponse\x12\x33\n\x0b\x63rypto_keys\x18\x01 \x03(\x0b\x32\x1e.google.cloud.kms.v1.CryptoKey\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\x12\x12\n\ntotal_size\x18\x03 \x01(\x05"\x90\x01\n\x1dListCryptoKeyVersionsResponse\x12\x42\n\x13\x63rypto_key_versions\x18\x01 \x03(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersion\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\x12\x12\n\ntotal_size\x18\x03 \x01(\x05"z\n\x16ListImportJobsResponse\x12\x33\n\x0bimport_jobs\x18\x01 \x03(\x0b\x32\x1e.google.cloud.kms.v1.ImportJob\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\x12\x12\n\ntotal_size\x18\x03 \x01(\x05"!\n\x11GetKeyRingRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"#\n\x13GetCryptoKeyRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"*\n\x1aGetCryptoKeyVersionRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"#\n\x13GetPublicKeyRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"#\n\x13GetImportJobRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"k\n\x14\x43reateKeyRingRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x13\n\x0bkey_ring_id\x18\x02 \x01(\t\x12.\n\x08key_ring\x18\x03 \x01(\x0b\x32\x1c.google.cloud.kms.v1.KeyRing"\x9a\x01\n\x16\x43reateCryptoKeyRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x15\n\rcrypto_key_id\x18\x02 \x01(\t\x12\x32\n\ncrypto_key\x18\x03 \x01(\x0b\x32\x1e.google.cloud.kms.v1.CryptoKey\x12%\n\x1dskip_initial_version_creation\x18\x05 \x01(\x08"r\n\x1d\x43reateCryptoKeyVersionRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x41\n\x12\x63rypto_key_version\x18\x02 \x01(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersion"\xce\x01\n\x1dImportCryptoKeyVersionRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12R\n\talgorithm\x18\x02 \x01(\x0e\x32?.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm\x12\x12\n\nimport_job\x18\x04 \x01(\t\x12\x1d\n\x13rsa_aes_wrapped_key\x18\x05 \x01(\x0cH\x00\x42\x16\n\x14wrapped_key_material"s\n\x16\x43reateImportJobRequest\x12\x0e\n\x06parent\x18\x01 \x01(\t\x12\x15\n\rimport_job_id\x18\x02 \x01(\t\x12\x32\n\nimport_job\x18\x03 \x01(\x0b\x32\x1e.google.cloud.kms.v1.ImportJob"}\n\x16UpdateCryptoKeyRequest\x12\x32\n\ncrypto_key\x18\x01 \x01(\x0b\x32\x1e.google.cloud.kms.v1.CryptoKey\x12/\n\x0bupdate_mask\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.FieldMask"\x93\x01\n\x1dUpdateCryptoKeyVersionRequest\x12\x41\n\x12\x63rypto_key_version\x18\x01 \x01(\x0b\x32%.google.cloud.kms.v1.CryptoKeyVersion\x12/\n\x0bupdate_mask\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.FieldMask"X\n\x0e\x45ncryptRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tplaintext\x18\x02 \x01(\x0c\x12%\n\x1d\x61\x64\x64itional_authenticated_data\x18\x03 \x01(\x0c"Y\n\x0e\x44\x65\x63ryptRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\nciphertext\x18\x02 \x01(\x0c\x12%\n\x1d\x61\x64\x64itional_authenticated_data\x18\x03 \x01(\x0c"R\n\x15\x41symmetricSignRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12+\n\x06\x64igest\x18\x03 \x01(\x0b\x32\x1b.google.cloud.kms.v1.Digest"<\n\x18\x41symmetricDecryptRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\nciphertext\x18\x03 \x01(\x0c"$\n\x0f\x44\x65\x63ryptResponse\x12\x11\n\tplaintext\x18\x01 \x01(\x0c"3\n\x0f\x45ncryptResponse\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\nciphertext\x18\x02 \x01(\x0c"+\n\x16\x41symmetricSignResponse\x12\x11\n\tsignature\x18\x01 \x01(\x0c".\n\x19\x41symmetricDecryptResponse\x12\x11\n\tplaintext\x18\x01 \x01(\x0c"S\n$UpdateCryptoKeyPrimaryVersionRequest\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x1d\n\x15\x63rypto_key_version_id\x18\x02 \x01(\t".\n\x1e\x44\x65stroyCryptoKeyVersionRequest\x12\x0c\n\x04name\x18\x01 \x01(\t".\n\x1eRestoreCryptoKeyVersionRequest\x12\x0c\n\x04name\x18\x01 \x01(\t"H\n\x06\x44igest\x12\x10\n\x06sha256\x18\x01 \x01(\x0cH\x00\x12\x10\n\x06sha384\x18\x02 \x01(\x0cH\x00\x12\x10\n\x06sha512\x18\x03 \x01(\x0cH\x00\x42\x08\n\x06\x64igest")\n\x10LocationMetadata\x12\x15\n\rhsm_available\x18\x01 \x01(\x08\x32\x97#\n\x14KeyManagementService\x12\x99\x01\n\x0cListKeyRings\x12(.google.cloud.kms.v1.ListKeyRingsRequest\x1a).google.cloud.kms.v1.ListKeyRingsResponse"4\x82\xd3\xe4\x93\x02.\x12,/v1/{parent=projects/*/locations/*}/keyRings\x12\xac\x01\n\x0eListCryptoKeys\x12*.google.cloud.kms.v1.ListCryptoKeysRequest\x1a+.google.cloud.kms.v1.ListCryptoKeysResponse"A\x82\xd3\xe4\x93\x02;\x12\x39/v1/{parent=projects/*/locations/*/keyRings/*}/cryptoKeys\x12\xd5\x01\n\x15ListCryptoKeyVersions\x12\x31.google.cloud.kms.v1.ListCryptoKeyVersionsRequest\x1a\x32.google.cloud.kms.v1.ListCryptoKeyVersionsResponse"U\x82\xd3\xe4\x93\x02O\x12M/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions\x12\xac\x01\n\x0eListImportJobs\x12*.google.cloud.kms.v1.ListImportJobsRequest\x1a+.google.cloud.kms.v1.ListImportJobsResponse"A\x82\xd3\xe4\x93\x02;\x12\x39/v1/{parent=projects/*/locations/*/keyRings/*}/importJobs\x12\x88\x01\n\nGetKeyRing\x12&.google.cloud.kms.v1.GetKeyRingRequest\x1a\x1c.google.cloud.kms.v1.KeyRing"4\x82\xd3\xe4\x93\x02.\x12,/v1/{name=projects/*/locations/*/keyRings/*}\x12\x9b\x01\n\x0cGetCryptoKey\x12(.google.cloud.kms.v1.GetCryptoKeyRequest\x1a\x1e.google.cloud.kms.v1.CryptoKey"A\x82\xd3\xe4\x93\x02;\x12\x39/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}\x12\xc4\x01\n\x13GetCryptoKeyVersion\x12/.google.cloud.kms.v1.GetCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"U\x82\xd3\xe4\x93\x02O\x12M/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}\x12\xb9\x01\n\x0cGetPublicKey\x12(.google.cloud.kms.v1.GetPublicKeyRequest\x1a\x1e.google.cloud.kms.v1.PublicKey"_\x82\xd3\xe4\x93\x02Y\x12W/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}/publicKey\x12\x9b\x01\n\x0cGetImportJob\x12(.google.cloud.kms.v1.GetImportJobRequest\x1a\x1e.google.cloud.kms.v1.ImportJob"A\x82\xd3\xe4\x93\x02;\x12\x39/v1/{name=projects/*/locations/*/keyRings/*/importJobs/*}\x12\x98\x01\n\rCreateKeyRing\x12).google.cloud.kms.v1.CreateKeyRingRequest\x1a\x1c.google.cloud.kms.v1.KeyRing">\x82\xd3\xe4\x93\x02\x38",/v1/{parent=projects/*/locations/*}/keyRings:\x08key_ring\x12\xad\x01\n\x0f\x43reateCryptoKey\x12+.google.cloud.kms.v1.CreateCryptoKeyRequest\x1a\x1e.google.cloud.kms.v1.CryptoKey"M\x82\xd3\xe4\x93\x02G"9/v1/{parent=projects/*/locations/*/keyRings/*}/cryptoKeys:\ncrypto_key\x12\xde\x01\n\x16\x43reateCryptoKeyVersion\x12\x32.google.cloud.kms.v1.CreateCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"i\x82\xd3\xe4\x93\x02\x63"M/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions:\x12\x63rypto_key_version\x12\xd4\x01\n\x16ImportCryptoKeyVersion\x12\x32.google.cloud.kms.v1.ImportCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"_\x82\xd3\xe4\x93\x02Y"T/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions:import:\x01*\x12\xad\x01\n\x0f\x43reateImportJob\x12+.google.cloud.kms.v1.CreateImportJobRequest\x1a\x1e.google.cloud.kms.v1.ImportJob"M\x82\xd3\xe4\x93\x02G"9/v1/{parent=projects/*/locations/*/keyRings/*}/importJobs:\nimport_job\x12\xb8\x01\n\x0fUpdateCryptoKey\x12+.google.cloud.kms.v1.UpdateCryptoKeyRequest\x1a\x1e.google.cloud.kms.v1.CryptoKey"X\x82\xd3\xe4\x93\x02R2D/v1/{crypto_key.name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:\ncrypto_key\x12\xf1\x01\n\x16UpdateCryptoKeyVersion\x12\x32.google.cloud.kms.v1.UpdateCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"|\x82\xd3\xe4\x93\x02v2`/v1/{crypto_key_version.name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:\x12\x63rypto_key_version\x12\xa3\x01\n\x07\x45ncrypt\x12#.google.cloud.kms.v1.EncryptRequest\x1a$.google.cloud.kms.v1.EncryptResponse"M\x82\xd3\xe4\x93\x02G"B/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/**}:encrypt:\x01*\x12\xa2\x01\n\x07\x44\x65\x63rypt\x12#.google.cloud.kms.v1.DecryptRequest\x1a$.google.cloud.kms.v1.DecryptResponse"L\x82\xd3\xe4\x93\x02\x46"A/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:decrypt:\x01*\x12\xd2\x01\n\x0e\x41symmetricSign\x12*.google.cloud.kms.v1.AsymmetricSignRequest\x1a+.google.cloud.kms.v1.AsymmetricSignResponse"g\x82\xd3\xe4\x93\x02\x61"\\/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:asymmetricSign:\x01*\x12\xde\x01\n\x11\x41symmetricDecrypt\x12-.google.cloud.kms.v1.AsymmetricDecryptRequest\x1a..google.cloud.kms.v1.AsymmetricDecryptResponse"j\x82\xd3\xe4\x93\x02\x64"_/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:asymmetricDecrypt:\x01*\x12\xd5\x01\n\x1dUpdateCryptoKeyPrimaryVersion\x12\x39.google.cloud.kms.v1.UpdateCryptoKeyPrimaryVersionRequest\x1a\x1e.google.cloud.kms.v1.CryptoKey"Y\x82\xd3\xe4\x93\x02S"N/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}:updatePrimaryVersion:\x01*\x12\xd7\x01\n\x17\x44\x65stroyCryptoKeyVersion\x12\x33.google.cloud.kms.v1.DestroyCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"`\x82\xd3\xe4\x93\x02Z"U/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:destroy:\x01*\x12\xd7\x01\n\x17RestoreCryptoKeyVersion\x12\x33.google.cloud.kms.v1.RestoreCryptoKeyVersionRequest\x1a%.google.cloud.kms.v1.CryptoKeyVersion"`\x82\xd3\xe4\x93\x02Z"U/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}:restore:\x01*\x1at\xca\x41\x17\x63loudkms.googleapis.com\xd2\x41Whttps://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/cloudkmsB\x8c\x01\n\x17\x63om.google.cloud.kms.v1B\x08KmsProtoP\x01Z6google.golang.org/genproto/googleapis/cloud/kms/v1;kms\xf8\x01\x01\xaa\x02\x13Google.Cloud.Kms.V1\xca\x02\x13Google\\Cloud\\Kms\\V1b\x06proto3' ), dependencies=[ google_dot_api_dot_annotations__pb2.DESCRIPTOR, google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.DESCRIPTOR, google_dot_protobuf_dot_field__mask__pb2.DESCRIPTOR, - google_dot_protobuf_dot_struct__pb2.DESCRIPTOR, - google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR, + google_dot_api_dot_client__pb2.DESCRIPTOR, ], ) @@ -104,6 +103,42 @@ serialized_options=None, file=DESCRIPTOR, ), + _descriptor.FieldDescriptor( + name="filter", + full_name="google.cloud.kms.v1.ListKeyRingsRequest.filter", + index=3, + number=4, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="order_by", + full_name="google.cloud.kms.v1.ListKeyRingsRequest.order_by", + index=4, + number=5, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), ], extensions=[], nested_types=[], @@ -113,8 +148,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=233, - serialized_end=309, + serialized_start=196, + serialized_end=306, ) @@ -197,6 +232,42 @@ serialized_options=None, file=DESCRIPTOR, ), + _descriptor.FieldDescriptor( + name="filter", + full_name="google.cloud.kms.v1.ListCryptoKeysRequest.filter", + index=4, + number=5, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="order_by", + full_name="google.cloud.kms.v1.ListCryptoKeysRequest.order_by", + index=5, + number=6, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), ], extensions=[], nested_types=[], @@ -206,8 +277,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=312, - serialized_end=472, + serialized_start=309, + serialized_end=503, ) @@ -290,6 +361,42 @@ serialized_options=None, file=DESCRIPTOR, ), + _descriptor.FieldDescriptor( + name="filter", + full_name="google.cloud.kms.v1.ListCryptoKeyVersionsRequest.filter", + index=4, + number=5, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="order_by", + full_name="google.cloud.kms.v1.ListCryptoKeyVersionsRequest.order_by", + index=5, + number=6, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), ], extensions=[], nested_types=[], @@ -299,8 +406,119 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=475, - serialized_end=634, + serialized_start=506, + serialized_end=699, +) + + +_LISTIMPORTJOBSREQUEST = _descriptor.Descriptor( + name="ListImportJobsRequest", + full_name="google.cloud.kms.v1.ListImportJobsRequest", + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name="parent", + full_name="google.cloud.kms.v1.ListImportJobsRequest.parent", + index=0, + number=1, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="page_size", + full_name="google.cloud.kms.v1.ListImportJobsRequest.page_size", + index=1, + number=2, + type=5, + cpp_type=1, + label=1, + has_default_value=False, + default_value=0, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="page_token", + full_name="google.cloud.kms.v1.ListImportJobsRequest.page_token", + index=2, + number=3, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="filter", + full_name="google.cloud.kms.v1.ListImportJobsRequest.filter", + index=3, + number=4, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="order_by", + full_name="google.cloud.kms.v1.ListImportJobsRequest.order_by", + index=4, + number=5, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + ], + extensions=[], + nested_types=[], + enum_types=[], + serialized_options=None, + is_extendable=False, + syntax="proto3", + extension_ranges=[], + oneofs=[], + serialized_start=701, + serialized_end=813, ) @@ -374,8 +592,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=636, - serialized_end=752, + serialized_start=815, + serialized_end=931, ) @@ -449,8 +667,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=754, - serialized_end=876, + serialized_start=933, + serialized_end=1055, ) @@ -524,8 +742,83 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=879, - serialized_end=1023, + serialized_start=1058, + serialized_end=1202, +) + + +_LISTIMPORTJOBSRESPONSE = _descriptor.Descriptor( + name="ListImportJobsResponse", + full_name="google.cloud.kms.v1.ListImportJobsResponse", + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name="import_jobs", + full_name="google.cloud.kms.v1.ListImportJobsResponse.import_jobs", + index=0, + number=1, + type=11, + cpp_type=10, + label=3, + has_default_value=False, + default_value=[], + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="next_page_token", + full_name="google.cloud.kms.v1.ListImportJobsResponse.next_page_token", + index=1, + number=2, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="total_size", + full_name="google.cloud.kms.v1.ListImportJobsResponse.total_size", + index=2, + number=3, + type=5, + cpp_type=1, + label=1, + has_default_value=False, + default_value=0, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + ], + extensions=[], + nested_types=[], + enum_types=[], + serialized_options=None, + is_extendable=False, + syntax="proto3", + extension_ranges=[], + oneofs=[], + serialized_start=1204, + serialized_end=1326, ) @@ -563,8 +856,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1025, - serialized_end=1058, + serialized_start=1328, + serialized_end=1361, ) @@ -602,8 +895,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1060, - serialized_end=1095, + serialized_start=1363, + serialized_end=1398, ) @@ -641,8 +934,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1097, - serialized_end=1139, + serialized_start=1400, + serialized_end=1442, ) @@ -654,15 +947,222 @@ containing_type=None, fields=[ _descriptor.FieldDescriptor( - name="name", - full_name="google.cloud.kms.v1.GetPublicKeyRequest.name", - index=0, - number=1, - type=9, - cpp_type=9, + name="name", + full_name="google.cloud.kms.v1.GetPublicKeyRequest.name", + index=0, + number=1, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ) + ], + extensions=[], + nested_types=[], + enum_types=[], + serialized_options=None, + is_extendable=False, + syntax="proto3", + extension_ranges=[], + oneofs=[], + serialized_start=1444, + serialized_end=1479, +) + + +_GETIMPORTJOBREQUEST = _descriptor.Descriptor( + name="GetImportJobRequest", + full_name="google.cloud.kms.v1.GetImportJobRequest", + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name="name", + full_name="google.cloud.kms.v1.GetImportJobRequest.name", + index=0, + number=1, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ) + ], + extensions=[], + nested_types=[], + enum_types=[], + serialized_options=None, + is_extendable=False, + syntax="proto3", + extension_ranges=[], + oneofs=[], + serialized_start=1481, + serialized_end=1516, +) + + +_CREATEKEYRINGREQUEST = _descriptor.Descriptor( + name="CreateKeyRingRequest", + full_name="google.cloud.kms.v1.CreateKeyRingRequest", + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name="parent", + full_name="google.cloud.kms.v1.CreateKeyRingRequest.parent", + index=0, + number=1, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="key_ring_id", + full_name="google.cloud.kms.v1.CreateKeyRingRequest.key_ring_id", + index=1, + number=2, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="key_ring", + full_name="google.cloud.kms.v1.CreateKeyRingRequest.key_ring", + index=2, + number=3, + type=11, + cpp_type=10, + label=1, + has_default_value=False, + default_value=None, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + ], + extensions=[], + nested_types=[], + enum_types=[], + serialized_options=None, + is_extendable=False, + syntax="proto3", + extension_ranges=[], + oneofs=[], + serialized_start=1518, + serialized_end=1625, +) + + +_CREATECRYPTOKEYREQUEST = _descriptor.Descriptor( + name="CreateCryptoKeyRequest", + full_name="google.cloud.kms.v1.CreateCryptoKeyRequest", + filename=None, + file=DESCRIPTOR, + containing_type=None, + fields=[ + _descriptor.FieldDescriptor( + name="parent", + full_name="google.cloud.kms.v1.CreateCryptoKeyRequest.parent", + index=0, + number=1, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="crypto_key_id", + full_name="google.cloud.kms.v1.CreateCryptoKeyRequest.crypto_key_id", + index=1, + number=2, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="crypto_key", + full_name="google.cloud.kms.v1.CreateCryptoKeyRequest.crypto_key", + index=2, + number=3, + type=11, + cpp_type=10, + label=1, + has_default_value=False, + default_value=None, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="skip_initial_version_creation", + full_name="google.cloud.kms.v1.CreateCryptoKeyRequest.skip_initial_version_creation", + index=3, + number=5, + type=8, + cpp_type=7, label=1, has_default_value=False, - default_value=_b("").decode("utf-8"), + default_value=False, message_type=None, enum_type=None, containing_type=None, @@ -670,7 +1170,7 @@ extension_scope=None, serialized_options=None, file=DESCRIPTOR, - ) + ), ], extensions=[], nested_types=[], @@ -680,21 +1180,21 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1141, - serialized_end=1176, + serialized_start=1628, + serialized_end=1782, ) -_CREATEKEYRINGREQUEST = _descriptor.Descriptor( - name="CreateKeyRingRequest", - full_name="google.cloud.kms.v1.CreateKeyRingRequest", +_CREATECRYPTOKEYVERSIONREQUEST = _descriptor.Descriptor( + name="CreateCryptoKeyVersionRequest", + full_name="google.cloud.kms.v1.CreateCryptoKeyVersionRequest", filename=None, file=DESCRIPTOR, containing_type=None, fields=[ _descriptor.FieldDescriptor( name="parent", - full_name="google.cloud.kms.v1.CreateKeyRingRequest.parent", + full_name="google.cloud.kms.v1.CreateCryptoKeyVersionRequest.parent", index=0, number=1, type=9, @@ -711,28 +1211,10 @@ file=DESCRIPTOR, ), _descriptor.FieldDescriptor( - name="key_ring_id", - full_name="google.cloud.kms.v1.CreateKeyRingRequest.key_ring_id", + name="crypto_key_version", + full_name="google.cloud.kms.v1.CreateCryptoKeyVersionRequest.crypto_key_version", index=1, number=2, - type=9, - cpp_type=9, - label=1, - has_default_value=False, - default_value=_b("").decode("utf-8"), - message_type=None, - enum_type=None, - containing_type=None, - is_extension=False, - extension_scope=None, - serialized_options=None, - file=DESCRIPTOR, - ), - _descriptor.FieldDescriptor( - name="key_ring", - full_name="google.cloud.kms.v1.CreateKeyRingRequest.key_ring", - index=2, - number=3, type=11, cpp_type=10, label=1, @@ -755,21 +1237,21 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1178, - serialized_end=1285, + serialized_start=1784, + serialized_end=1898, ) -_CREATECRYPTOKEYREQUEST = _descriptor.Descriptor( - name="CreateCryptoKeyRequest", - full_name="google.cloud.kms.v1.CreateCryptoKeyRequest", +_IMPORTCRYPTOKEYVERSIONREQUEST = _descriptor.Descriptor( + name="ImportCryptoKeyVersionRequest", + full_name="google.cloud.kms.v1.ImportCryptoKeyVersionRequest", filename=None, file=DESCRIPTOR, containing_type=None, fields=[ _descriptor.FieldDescriptor( name="parent", - full_name="google.cloud.kms.v1.CreateCryptoKeyRequest.parent", + full_name="google.cloud.kms.v1.ImportCryptoKeyVersionRequest.parent", index=0, number=1, type=9, @@ -786,10 +1268,28 @@ file=DESCRIPTOR, ), _descriptor.FieldDescriptor( - name="crypto_key_id", - full_name="google.cloud.kms.v1.CreateCryptoKeyRequest.crypto_key_id", + name="algorithm", + full_name="google.cloud.kms.v1.ImportCryptoKeyVersionRequest.algorithm", index=1, number=2, + type=14, + cpp_type=8, + label=1, + has_default_value=False, + default_value=0, + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="import_job", + full_name="google.cloud.kms.v1.ImportCryptoKeyVersionRequest.import_job", + index=2, + number=4, type=9, cpp_type=9, label=1, @@ -804,15 +1304,15 @@ file=DESCRIPTOR, ), _descriptor.FieldDescriptor( - name="crypto_key", - full_name="google.cloud.kms.v1.CreateCryptoKeyRequest.crypto_key", - index=2, - number=3, - type=11, - cpp_type=10, + name="rsa_aes_wrapped_key", + full_name="google.cloud.kms.v1.ImportCryptoKeyVersionRequest.rsa_aes_wrapped_key", + index=3, + number=5, + type=12, + cpp_type=9, label=1, has_default_value=False, - default_value=None, + default_value=_b(""), message_type=None, enum_type=None, containing_type=None, @@ -829,22 +1329,30 @@ is_extendable=False, syntax="proto3", extension_ranges=[], - oneofs=[], - serialized_start=1287, - serialized_end=1402, + oneofs=[ + _descriptor.OneofDescriptor( + name="wrapped_key_material", + full_name="google.cloud.kms.v1.ImportCryptoKeyVersionRequest.wrapped_key_material", + index=0, + containing_type=None, + fields=[], + ) + ], + serialized_start=1901, + serialized_end=2107, ) -_CREATECRYPTOKEYVERSIONREQUEST = _descriptor.Descriptor( - name="CreateCryptoKeyVersionRequest", - full_name="google.cloud.kms.v1.CreateCryptoKeyVersionRequest", +_CREATEIMPORTJOBREQUEST = _descriptor.Descriptor( + name="CreateImportJobRequest", + full_name="google.cloud.kms.v1.CreateImportJobRequest", filename=None, file=DESCRIPTOR, containing_type=None, fields=[ _descriptor.FieldDescriptor( name="parent", - full_name="google.cloud.kms.v1.CreateCryptoKeyVersionRequest.parent", + full_name="google.cloud.kms.v1.CreateImportJobRequest.parent", index=0, number=1, type=9, @@ -861,10 +1369,28 @@ file=DESCRIPTOR, ), _descriptor.FieldDescriptor( - name="crypto_key_version", - full_name="google.cloud.kms.v1.CreateCryptoKeyVersionRequest.crypto_key_version", + name="import_job_id", + full_name="google.cloud.kms.v1.CreateImportJobRequest.import_job_id", index=1, number=2, + type=9, + cpp_type=9, + label=1, + has_default_value=False, + default_value=_b("").decode("utf-8"), + message_type=None, + enum_type=None, + containing_type=None, + is_extension=False, + extension_scope=None, + serialized_options=None, + file=DESCRIPTOR, + ), + _descriptor.FieldDescriptor( + name="import_job", + full_name="google.cloud.kms.v1.CreateImportJobRequest.import_job", + index=2, + number=3, type=11, cpp_type=10, label=1, @@ -887,8 +1413,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1404, - serialized_end=1518, + serialized_start=2109, + serialized_end=2224, ) @@ -944,8 +1470,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1520, - serialized_end=1645, + serialized_start=2226, + serialized_end=2351, ) @@ -1001,8 +1527,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1648, - serialized_end=1795, + serialized_start=2354, + serialized_end=2501, ) @@ -1076,8 +1602,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1797, - serialized_end=1885, + serialized_start=2503, + serialized_end=2591, ) @@ -1151,8 +1677,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1887, - serialized_end=1976, + serialized_start=2593, + serialized_end=2682, ) @@ -1208,8 +1734,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=1978, - serialized_end=2060, + serialized_start=2684, + serialized_end=2766, ) @@ -1265,8 +1791,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2062, - serialized_end=2122, + serialized_start=2768, + serialized_end=2828, ) @@ -1304,8 +1830,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2124, - serialized_end=2160, + serialized_start=2830, + serialized_end=2866, ) @@ -1361,8 +1887,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2162, - serialized_end=2213, + serialized_start=2868, + serialized_end=2919, ) @@ -1400,8 +1926,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2215, - serialized_end=2258, + serialized_start=2921, + serialized_end=2964, ) @@ -1439,8 +1965,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2260, - serialized_end=2306, + serialized_start=2966, + serialized_end=3012, ) @@ -1496,8 +2022,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2308, - serialized_end=2391, + serialized_start=3014, + serialized_end=3097, ) @@ -1535,8 +2061,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2393, - serialized_end=2439, + serialized_start=3099, + serialized_end=3145, ) @@ -1574,8 +2100,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2441, - serialized_end=2487, + serialized_start=3147, + serialized_end=3193, ) @@ -1657,8 +2183,8 @@ fields=[], ) ], - serialized_start=2489, - serialized_end=2561, + serialized_start=3195, + serialized_end=3267, ) @@ -1696,8 +2222,8 @@ syntax="proto3", extension_ranges=[], oneofs=[], - serialized_start=2563, - serialized_end=2604, + serialized_start=3269, + serialized_end=3310, ) _LISTCRYPTOKEYSREQUEST.fields_by_name[ @@ -1721,6 +2247,9 @@ ].message_type = ( google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEYVERSION ) +_LISTIMPORTJOBSRESPONSE.fields_by_name[ + "import_jobs" +].message_type = google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._IMPORTJOB _CREATEKEYRINGREQUEST.fields_by_name[ "key_ring" ].message_type = google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._KEYRING @@ -1732,6 +2261,22 @@ ].message_type = ( google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEYVERSION ) +_IMPORTCRYPTOKEYVERSIONREQUEST.fields_by_name[ + "algorithm" +].enum_type = ( + google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEYVERSION_CRYPTOKEYVERSIONALGORITHM +) +_IMPORTCRYPTOKEYVERSIONREQUEST.oneofs_by_name["wrapped_key_material"].fields.append( + _IMPORTCRYPTOKEYVERSIONREQUEST.fields_by_name["rsa_aes_wrapped_key"] +) +_IMPORTCRYPTOKEYVERSIONREQUEST.fields_by_name[ + "rsa_aes_wrapped_key" +].containing_oneof = _IMPORTCRYPTOKEYVERSIONREQUEST.oneofs_by_name[ + "wrapped_key_material" +] +_CREATEIMPORTJOBREQUEST.fields_by_name[ + "import_job" +].message_type = google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._IMPORTJOB _UPDATECRYPTOKEYREQUEST.fields_by_name[ "crypto_key" ].message_type = google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEY @@ -1758,22 +2303,29 @@ DESCRIPTOR.message_types_by_name[ "ListCryptoKeyVersionsRequest" ] = _LISTCRYPTOKEYVERSIONSREQUEST +DESCRIPTOR.message_types_by_name["ListImportJobsRequest"] = _LISTIMPORTJOBSREQUEST DESCRIPTOR.message_types_by_name["ListKeyRingsResponse"] = _LISTKEYRINGSRESPONSE DESCRIPTOR.message_types_by_name["ListCryptoKeysResponse"] = _LISTCRYPTOKEYSRESPONSE DESCRIPTOR.message_types_by_name[ "ListCryptoKeyVersionsResponse" ] = _LISTCRYPTOKEYVERSIONSRESPONSE +DESCRIPTOR.message_types_by_name["ListImportJobsResponse"] = _LISTIMPORTJOBSRESPONSE DESCRIPTOR.message_types_by_name["GetKeyRingRequest"] = _GETKEYRINGREQUEST DESCRIPTOR.message_types_by_name["GetCryptoKeyRequest"] = _GETCRYPTOKEYREQUEST DESCRIPTOR.message_types_by_name[ "GetCryptoKeyVersionRequest" ] = _GETCRYPTOKEYVERSIONREQUEST DESCRIPTOR.message_types_by_name["GetPublicKeyRequest"] = _GETPUBLICKEYREQUEST +DESCRIPTOR.message_types_by_name["GetImportJobRequest"] = _GETIMPORTJOBREQUEST DESCRIPTOR.message_types_by_name["CreateKeyRingRequest"] = _CREATEKEYRINGREQUEST DESCRIPTOR.message_types_by_name["CreateCryptoKeyRequest"] = _CREATECRYPTOKEYREQUEST DESCRIPTOR.message_types_by_name[ "CreateCryptoKeyVersionRequest" ] = _CREATECRYPTOKEYVERSIONREQUEST +DESCRIPTOR.message_types_by_name[ + "ImportCryptoKeyVersionRequest" +] = _IMPORTCRYPTOKEYVERSIONREQUEST +DESCRIPTOR.message_types_by_name["CreateImportJobRequest"] = _CREATEIMPORTJOBREQUEST DESCRIPTOR.message_types_by_name["UpdateCryptoKeyRequest"] = _UPDATECRYPTOKEYREQUEST DESCRIPTOR.message_types_by_name[ "UpdateCryptoKeyVersionRequest" @@ -1828,6 +2380,12 @@ Optional pagination token, returned earlier via [ListKeyRingsR esponse.next\_page\_token][google.cloud.kms.v1.ListKeyRingsRes ponse.next\_page\_token]. + filter: + Optional. Only include resources that match the filter in the + response. + order_by: + Optional. Specify how the results should be sorted. If not + specified, the results will be sorted in the default order. """, # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.ListKeyRingsRequest) ), @@ -1863,6 +2421,12 @@ sResponse.next\_page\_token]. version_view: The fields of the primary version to include in the response. + filter: + Optional. Only include resources that match the filter in the + response. + order_by: + Optional. Specify how the results should be sorted. If not + specified, the results will be sorted in the default order. """, # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.ListCryptoKeysRequest) ), @@ -1899,12 +2463,57 @@ yptoKeyVersionsResponse.next\_page\_token]. view: The fields to include in the response. + filter: + Optional. Only include resources that match the filter in the + response. + order_by: + Optional. Specify how the results should be sorted. If not + specified, the results will be sorted in the default order. """, # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.ListCryptoKeyVersionsRequest) ), ) _sym_db.RegisterMessage(ListCryptoKeyVersionsRequest) +ListImportJobsRequest = _reflection.GeneratedProtocolMessageType( + "ListImportJobsRequest", + (_message.Message,), + dict( + DESCRIPTOR=_LISTIMPORTJOBSREQUEST, + __module__="google.cloud.kms_v1.proto.service_pb2", + __doc__="""Request message for + [KeyManagementService.ListImportJobs][google.cloud.kms.v1.KeyManagementService.ListImportJobs]. + + + Attributes: + parent: + Required. The resource name of the + [KeyRing][google.cloud.kms.v1.KeyRing] to list, in the format + ``projects/*/locations/*/keyRings/*``. + page_size: + Optional limit on the number of + [ImportJobs][google.cloud.kms.v1.ImportJob] to include in the + response. Further [ImportJobs][google.cloud.kms.v1.ImportJob] + can subsequently be obtained by including the [ListImportJobsR + esponse.next\_page\_token][google.cloud.kms.v1.ListImportJobsR + esponse.next\_page\_token] in a subsequent request. If + unspecified, the server will pick an appropriate default. + page_token: + Optional pagination token, returned earlier via [ListImportJob + sResponse.next\_page\_token][google.cloud.kms.v1.ListImportJob + sResponse.next\_page\_token]. + filter: + Optional. Only include resources that match the filter in the + response. + order_by: + Optional. Specify how the results should be sorted. If not + specified, the results will be sorted in the default order. + """, + # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.ListImportJobsRequest) + ), +) +_sym_db.RegisterMessage(ListImportJobsRequest) + ListKeyRingsResponse = _reflection.GeneratedProtocolMessageType( "ListKeyRingsResponse", (_message.Message,), @@ -1988,6 +2597,34 @@ ) _sym_db.RegisterMessage(ListCryptoKeyVersionsResponse) +ListImportJobsResponse = _reflection.GeneratedProtocolMessageType( + "ListImportJobsResponse", + (_message.Message,), + dict( + DESCRIPTOR=_LISTIMPORTJOBSRESPONSE, + __module__="google.cloud.kms_v1.proto.service_pb2", + __doc__="""Response message for + [KeyManagementService.ListImportJobs][google.cloud.kms.v1.KeyManagementService.ListImportJobs]. + + + Attributes: + import_jobs: + The list of [ImportJobs][google.cloud.kms.v1.ImportJob]. + next_page_token: + A token to retrieve next page of results. Pass this value in [ + ListImportJobsRequest.page\_token][google.cloud.kms.v1.ListImp + ortJobsRequest.page\_token] to retrieve the next page of + results. + total_size: + The total number of + [ImportJobs][google.cloud.kms.v1.ImportJob] that matched the + query. + """, + # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.ListImportJobsResponse) + ), +) +_sym_db.RegisterMessage(ListImportJobsResponse) + GetKeyRingRequest = _reflection.GeneratedProtocolMessageType( "GetKeyRingRequest", (_message.Message,), @@ -2070,6 +2707,26 @@ ) _sym_db.RegisterMessage(GetPublicKeyRequest) +GetImportJobRequest = _reflection.GeneratedProtocolMessageType( + "GetImportJobRequest", + (_message.Message,), + dict( + DESCRIPTOR=_GETIMPORTJOBREQUEST, + __module__="google.cloud.kms_v1.proto.service_pb2", + __doc__="""Request message for + [KeyManagementService.GetImportJob][google.cloud.kms.v1.KeyManagementService.GetImportJob]. + + + Attributes: + name: + The [name][google.cloud.kms.v1.ImportJob.name] of the + [ImportJob][google.cloud.kms.v1.ImportJob] to get. + """, + # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.GetImportJobRequest) + ), +) +_sym_db.RegisterMessage(GetImportJobRequest) + CreateKeyRingRequest = _reflection.GeneratedProtocolMessageType( "CreateKeyRingRequest", (_message.Message,), @@ -2118,6 +2775,15 @@ crypto_key: A [CryptoKey][google.cloud.kms.v1.CryptoKey] with initial field values. + skip_initial_version_creation: + If set to true, the request will create a + [CryptoKey][google.cloud.kms.v1.CryptoKey] without any + [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]. You + must manually call [CreateCryptoKeyVersion][google.cloud.kms.v + 1.KeyManagementService.CreateCryptoKeyVersion] or [ImportCrypt + oKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCr + yptoKeyVersion] before you can use this + [CryptoKey][google.cloud.kms.v1.CryptoKey]. """, # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.CreateCryptoKeyRequest) ), @@ -2148,6 +2814,83 @@ ) _sym_db.RegisterMessage(CreateCryptoKeyVersionRequest) +ImportCryptoKeyVersionRequest = _reflection.GeneratedProtocolMessageType( + "ImportCryptoKeyVersionRequest", + (_message.Message,), + dict( + DESCRIPTOR=_IMPORTCRYPTOKEYVERSIONREQUEST, + __module__="google.cloud.kms_v1.proto.service_pb2", + __doc__="""Request message for + [KeyManagementService.ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]. + + + Attributes: + parent: + Required. The [name][google.cloud.kms.v1.CryptoKey.name] of + the [CryptoKey][google.cloud.kms.v1.CryptoKey] to be imported + into. + algorithm: + Required. The [algorithm][google.cloud.kms.v1.CryptoKeyVersion + .CryptoKeyVersionAlgorithm] of the key being imported. This + does not need to match the [version\_template][google.cloud.km + s.v1.CryptoKey.version\_template] of the + [CryptoKey][google.cloud.kms.v1.CryptoKey] this version + imports into. + import_job: + Required. The [name][google.cloud.kms.v1.ImportJob.name] of + the [ImportJob][google.cloud.kms.v1.ImportJob] that was used + to wrap this key material. + wrapped_key_material: + Required. The incoming wrapped key material that is to be + imported. + rsa_aes_wrapped_key: + Wrapped key material produced with [RSA\_OAEP\_3072\_SHA1\_AES + \_256][google.cloud.kms.v1.ImportJob.ImportMethod.RSA\_OAEP\_3 + 072\_SHA1\_AES\_256] or [RSA\_OAEP\_4096\_SHA1\_AES\_256][goog + le.cloud.kms.v1.ImportJob.ImportMethod.RSA\_OAEP\_4096\_SHA1\_ + AES\_256]. This field contains the concatenation of two + wrapped keys: .. raw:: html
    .. raw:: html
  1. + An ephemeral AES-256 wrapping key wrapped with the + [public\_key][google.cloud.kms.v1.ImportJob.public\_key] using + RSAES-OAEP with SHA-1, MGF1 with SHA-1, and an empty label. + .. raw:: html
    2. .. raw:: html
  2. The key to be + imported, wrapped with the ephemeral AES-256 key using AES-KWP + (RFC 5649). .. raw:: html
    3. .. raw:: html
+ This format is the same as the format produced by PKCS#11 + mechanism CKM\_RSA\_AES\_KEY\_WRAP. + """, + # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.ImportCryptoKeyVersionRequest) + ), +) +_sym_db.RegisterMessage(ImportCryptoKeyVersionRequest) + +CreateImportJobRequest = _reflection.GeneratedProtocolMessageType( + "CreateImportJobRequest", + (_message.Message,), + dict( + DESCRIPTOR=_CREATEIMPORTJOBREQUEST, + __module__="google.cloud.kms_v1.proto.service_pb2", + __doc__="""Request message for + [KeyManagementService.CreateImportJob][google.cloud.kms.v1.KeyManagementService.CreateImportJob]. + + + Attributes: + parent: + Required. The [name][google.cloud.kms.v1.KeyRing.name] of the + [KeyRing][google.cloud.kms.v1.KeyRing] associated with the + [ImportJobs][google.cloud.kms.v1.ImportJob]. + import_job_id: + Required. It must be unique within a KeyRing and match the + regular expression ``[a-zA-Z0-9_-]{1,63}`` + import_job: + Required. An [ImportJob][google.cloud.kms.v1.ImportJob] with + initial field values. + """, + # @@protoc_insertion_point(class_scope:google.cloud.kms.v1.CreateImportJobRequest) + ), +) +_sym_db.RegisterMessage(CreateImportJobRequest) + UpdateCryptoKeyRequest = _reflection.GeneratedProtocolMessageType( "UpdateCryptoKeyRequest", (_message.Message,), @@ -2525,9 +3268,11 @@ full_name="google.cloud.kms.v1.KeyManagementService", file=DESCRIPTOR, index=0, - serialized_options=None, - serialized_start=2607, - serialized_end=6268, + serialized_options=_b( + "\312A\027cloudkms.googleapis.com\322AWhttps://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/cloudkms" + ), + serialized_start=3313, + serialized_end=7816, methods=[ _descriptor.MethodDescriptor( name="ListKeyRings", @@ -2562,10 +3307,21 @@ "\202\323\344\223\002O\022M/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions" ), ), + _descriptor.MethodDescriptor( + name="ListImportJobs", + full_name="google.cloud.kms.v1.KeyManagementService.ListImportJobs", + index=3, + containing_service=None, + input_type=_LISTIMPORTJOBSREQUEST, + output_type=_LISTIMPORTJOBSRESPONSE, + serialized_options=_b( + "\202\323\344\223\002;\0229/v1/{parent=projects/*/locations/*/keyRings/*}/importJobs" + ), + ), _descriptor.MethodDescriptor( name="GetKeyRing", full_name="google.cloud.kms.v1.KeyManagementService.GetKeyRing", - index=3, + index=4, containing_service=None, input_type=_GETKEYRINGREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._KEYRING, @@ -2576,7 +3332,7 @@ _descriptor.MethodDescriptor( name="GetCryptoKey", full_name="google.cloud.kms.v1.KeyManagementService.GetCryptoKey", - index=4, + index=5, containing_service=None, input_type=_GETCRYPTOKEYREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEY, @@ -2587,7 +3343,7 @@ _descriptor.MethodDescriptor( name="GetCryptoKeyVersion", full_name="google.cloud.kms.v1.KeyManagementService.GetCryptoKeyVersion", - index=5, + index=6, containing_service=None, input_type=_GETCRYPTOKEYVERSIONREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEYVERSION, @@ -2598,7 +3354,7 @@ _descriptor.MethodDescriptor( name="GetPublicKey", full_name="google.cloud.kms.v1.KeyManagementService.GetPublicKey", - index=6, + index=7, containing_service=None, input_type=_GETPUBLICKEYREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._PUBLICKEY, @@ -2606,10 +3362,21 @@ "\202\323\344\223\002Y\022W/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}/publicKey" ), ), + _descriptor.MethodDescriptor( + name="GetImportJob", + full_name="google.cloud.kms.v1.KeyManagementService.GetImportJob", + index=8, + containing_service=None, + input_type=_GETIMPORTJOBREQUEST, + output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._IMPORTJOB, + serialized_options=_b( + "\202\323\344\223\002;\0229/v1/{name=projects/*/locations/*/keyRings/*/importJobs/*}" + ), + ), _descriptor.MethodDescriptor( name="CreateKeyRing", full_name="google.cloud.kms.v1.KeyManagementService.CreateKeyRing", - index=7, + index=9, containing_service=None, input_type=_CREATEKEYRINGREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._KEYRING, @@ -2620,7 +3387,7 @@ _descriptor.MethodDescriptor( name="CreateCryptoKey", full_name="google.cloud.kms.v1.KeyManagementService.CreateCryptoKey", - index=8, + index=10, containing_service=None, input_type=_CREATECRYPTOKEYREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEY, @@ -2631,7 +3398,7 @@ _descriptor.MethodDescriptor( name="CreateCryptoKeyVersion", full_name="google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion", - index=9, + index=11, containing_service=None, input_type=_CREATECRYPTOKEYVERSIONREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEYVERSION, @@ -2639,10 +3406,32 @@ '\202\323\344\223\002c"M/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions:\022crypto_key_version' ), ), + _descriptor.MethodDescriptor( + name="ImportCryptoKeyVersion", + full_name="google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion", + index=12, + containing_service=None, + input_type=_IMPORTCRYPTOKEYVERSIONREQUEST, + output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEYVERSION, + serialized_options=_b( + '\202\323\344\223\002Y"T/v1/{parent=projects/*/locations/*/keyRings/*/cryptoKeys/*}/cryptoKeyVersions:import:\001*' + ), + ), + _descriptor.MethodDescriptor( + name="CreateImportJob", + full_name="google.cloud.kms.v1.KeyManagementService.CreateImportJob", + index=13, + containing_service=None, + input_type=_CREATEIMPORTJOBREQUEST, + output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._IMPORTJOB, + serialized_options=_b( + '\202\323\344\223\002G"9/v1/{parent=projects/*/locations/*/keyRings/*}/importJobs:\nimport_job' + ), + ), _descriptor.MethodDescriptor( name="UpdateCryptoKey", full_name="google.cloud.kms.v1.KeyManagementService.UpdateCryptoKey", - index=10, + index=14, containing_service=None, input_type=_UPDATECRYPTOKEYREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEY, @@ -2653,7 +3442,7 @@ _descriptor.MethodDescriptor( name="UpdateCryptoKeyVersion", full_name="google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyVersion", - index=11, + index=15, containing_service=None, input_type=_UPDATECRYPTOKEYVERSIONREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEYVERSION, @@ -2664,7 +3453,7 @@ _descriptor.MethodDescriptor( name="Encrypt", full_name="google.cloud.kms.v1.KeyManagementService.Encrypt", - index=12, + index=16, containing_service=None, input_type=_ENCRYPTREQUEST, output_type=_ENCRYPTRESPONSE, @@ -2675,7 +3464,7 @@ _descriptor.MethodDescriptor( name="Decrypt", full_name="google.cloud.kms.v1.KeyManagementService.Decrypt", - index=13, + index=17, containing_service=None, input_type=_DECRYPTREQUEST, output_type=_DECRYPTRESPONSE, @@ -2686,7 +3475,7 @@ _descriptor.MethodDescriptor( name="AsymmetricSign", full_name="google.cloud.kms.v1.KeyManagementService.AsymmetricSign", - index=14, + index=18, containing_service=None, input_type=_ASYMMETRICSIGNREQUEST, output_type=_ASYMMETRICSIGNRESPONSE, @@ -2697,7 +3486,7 @@ _descriptor.MethodDescriptor( name="AsymmetricDecrypt", full_name="google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt", - index=15, + index=19, containing_service=None, input_type=_ASYMMETRICDECRYPTREQUEST, output_type=_ASYMMETRICDECRYPTRESPONSE, @@ -2708,7 +3497,7 @@ _descriptor.MethodDescriptor( name="UpdateCryptoKeyPrimaryVersion", full_name="google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion", - index=16, + index=20, containing_service=None, input_type=_UPDATECRYPTOKEYPRIMARYVERSIONREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEY, @@ -2719,7 +3508,7 @@ _descriptor.MethodDescriptor( name="DestroyCryptoKeyVersion", full_name="google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion", - index=17, + index=21, containing_service=None, input_type=_DESTROYCRYPTOKEYVERSIONREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEYVERSION, @@ -2730,7 +3519,7 @@ _descriptor.MethodDescriptor( name="RestoreCryptoKeyVersion", full_name="google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion", - index=18, + index=22, containing_service=None, input_type=_RESTORECRYPTOKEYVERSIONREQUEST, output_type=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2._CRYPTOKEYVERSION, diff --git a/kms/google/cloud/kms_v1/proto/service_pb2_grpc.py b/kms/google/cloud/kms_v1/proto/service_pb2_grpc.py index 4c6db588f6a4..aa0d02262e48 100644 --- a/kms/google/cloud/kms_v1/proto/service_pb2_grpc.py +++ b/kms/google/cloud/kms_v1/proto/service_pb2_grpc.py @@ -44,6 +44,11 @@ def __init__(self, channel): request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ListCryptoKeyVersionsRequest.SerializeToString, response_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ListCryptoKeyVersionsResponse.FromString, ) + self.ListImportJobs = channel.unary_unary( + "/google.cloud.kms.v1.KeyManagementService/ListImportJobs", + request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ListImportJobsRequest.SerializeToString, + response_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ListImportJobsResponse.FromString, + ) self.GetKeyRing = channel.unary_unary( "/google.cloud.kms.v1.KeyManagementService/GetKeyRing", request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.GetKeyRingRequest.SerializeToString, @@ -64,6 +69,11 @@ def __init__(self, channel): request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.GetPublicKeyRequest.SerializeToString, response_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.PublicKey.FromString, ) + self.GetImportJob = channel.unary_unary( + "/google.cloud.kms.v1.KeyManagementService/GetImportJob", + request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.GetImportJobRequest.SerializeToString, + response_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.ImportJob.FromString, + ) self.CreateKeyRing = channel.unary_unary( "/google.cloud.kms.v1.KeyManagementService/CreateKeyRing", request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.CreateKeyRingRequest.SerializeToString, @@ -79,6 +89,16 @@ def __init__(self, channel): request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.CreateCryptoKeyVersionRequest.SerializeToString, response_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.CryptoKeyVersion.FromString, ) + self.ImportCryptoKeyVersion = channel.unary_unary( + "/google.cloud.kms.v1.KeyManagementService/ImportCryptoKeyVersion", + request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ImportCryptoKeyVersionRequest.SerializeToString, + response_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.CryptoKeyVersion.FromString, + ) + self.CreateImportJob = channel.unary_unary( + "/google.cloud.kms.v1.KeyManagementService/CreateImportJob", + request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.CreateImportJobRequest.SerializeToString, + response_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.ImportJob.FromString, + ) self.UpdateCryptoKey = channel.unary_unary( "/google.cloud.kms.v1.KeyManagementService/UpdateCryptoKey", request_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.UpdateCryptoKeyRequest.SerializeToString, @@ -161,6 +181,13 @@ def ListCryptoKeyVersions(self, request, context): context.set_details("Method not implemented!") raise NotImplementedError("Method not implemented!") + def ListImportJobs(self, request, context): + """Lists [ImportJobs][google.cloud.kms.v1.ImportJob]. + """ + context.set_code(grpc.StatusCode.UNIMPLEMENTED) + context.set_details("Method not implemented!") + raise NotImplementedError("Method not implemented!") + def GetKeyRing(self, request, context): """Returns metadata for a given [KeyRing][google.cloud.kms.v1.KeyRing]. """ @@ -169,45 +196,46 @@ def GetKeyRing(self, request, context): raise NotImplementedError("Method not implemented!") def GetCryptoKey(self, request, context): - """Returns metadata for a given [CryptoKey][google.cloud.kms.v1.CryptoKey], as - well as its [primary][google.cloud.kms.v1.CryptoKey.primary] - [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. + """Returns metadata for a given [CryptoKey][google.cloud.kms.v1.CryptoKey], as well as its + [primary][google.cloud.kms.v1.CryptoKey.primary] [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") raise NotImplementedError("Method not implemented!") def GetCryptoKeyVersion(self, request, context): - """Returns metadata for a given - [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. + """Returns metadata for a given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") raise NotImplementedError("Method not implemented!") def GetPublicKey(self, request, context): - """Returns the public key for the given - [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. The + """Returns the public key for the given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be - [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN] - or + [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN] or [ASYMMETRIC_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT]. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") raise NotImplementedError("Method not implemented!") + def GetImportJob(self, request, context): + """Returns metadata for a given [ImportJob][google.cloud.kms.v1.ImportJob]. + """ + context.set_code(grpc.StatusCode.UNIMPLEMENTED) + context.set_details("Method not implemented!") + raise NotImplementedError("Method not implemented!") + def CreateKeyRing(self, request, context): - """Create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and - Location. + """Create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and Location. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") raise NotImplementedError("Method not implemented!") def CreateCryptoKey(self, request, context): - """Create a new [CryptoKey][google.cloud.kms.v1.CryptoKey] within a - [KeyRing][google.cloud.kms.v1.KeyRing]. + """Create a new [CryptoKey][google.cloud.kms.v1.CryptoKey] within a [KeyRing][google.cloud.kms.v1.KeyRing]. [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] and [CryptoKey.version_template.algorithm][google.cloud.kms.v1.CryptoKeyVersionTemplate.algorithm] @@ -218,8 +246,7 @@ def CreateCryptoKey(self, request, context): raise NotImplementedError("Method not implemented!") def CreateCryptoKeyVersion(self, request, context): - """Create a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in a - [CryptoKey][google.cloud.kms.v1.CryptoKey]. + """Create a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in a [CryptoKey][google.cloud.kms.v1.CryptoKey]. The server will assign the next sequential id. If unset, [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to @@ -229,6 +256,26 @@ def CreateCryptoKeyVersion(self, request, context): context.set_details("Method not implemented!") raise NotImplementedError("Method not implemented!") + def ImportCryptoKeyVersion(self, request, context): + """Imports a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] into an existing [CryptoKey][google.cloud.kms.v1.CryptoKey] using the + wrapped key material provided in the request. + + The version ID will be assigned the next sequential id within the + [CryptoKey][google.cloud.kms.v1.CryptoKey]. + """ + context.set_code(grpc.StatusCode.UNIMPLEMENTED) + context.set_details("Method not implemented!") + raise NotImplementedError("Method not implemented!") + + def CreateImportJob(self, request, context): + """Create a new [ImportJob][google.cloud.kms.v1.ImportJob] within a [KeyRing][google.cloud.kms.v1.KeyRing]. + + [ImportJob.import_method][google.cloud.kms.v1.ImportJob.import_method] is required. + """ + context.set_code(grpc.StatusCode.UNIMPLEMENTED) + context.set_details("Method not implemented!") + raise NotImplementedError("Method not implemented!") + def UpdateCryptoKey(self, request, context): """Update a [CryptoKey][google.cloud.kms.v1.CryptoKey]. """ @@ -237,27 +284,21 @@ def UpdateCryptoKey(self, request, context): raise NotImplementedError("Method not implemented!") def UpdateCryptoKeyVersion(self, request, context): - """Update a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s - metadata. + """Update a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s metadata. [state][google.cloud.kms.v1.CryptoKeyVersion.state] may be changed between - [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] - and - [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] - using this method. See - [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion] - and - [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] - to move between other states. + [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] and + [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] using this + method. See [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion] and [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] to + move between other states. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") raise NotImplementedError("Method not implemented!") def Encrypt(self, request, context): - """Encrypts data, so that it can only be recovered by a call to - [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. The - [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be + """Encrypts data, so that it can only be recovered by a call to [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. + The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) @@ -265,21 +306,17 @@ def Encrypt(self, request, context): raise NotImplementedError("Method not implemented!") def Decrypt(self, request, context): - """Decrypts data that was protected by - [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. The - [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be - [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. + """Decrypts data that was protected by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] + must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") raise NotImplementedError("Method not implemented!") def AsymmetricSign(self, request, context): - """Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] - with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] + """Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_SIGN, producing a signature that can be verified with the public - key retrieved from - [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. + key retrieved from [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") @@ -287,19 +324,15 @@ def AsymmetricSign(self, request, context): def AsymmetricDecrypt(self, request, context): """Decrypts data that was encrypted with a public key retrieved from - [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] - corresponding to a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] - with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] - ASYMMETRIC_DECRYPT. + [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] corresponding to a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with + [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_DECRYPT. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") raise NotImplementedError("Method not implemented!") def UpdateCryptoKeyPrimaryVersion(self, request, context): - """Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that - will be used in - [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. + """Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. Returns an error if called on an asymmetric key. """ @@ -308,24 +341,18 @@ def UpdateCryptoKeyPrimaryVersion(self, request, context): raise NotImplementedError("Method not implemented!") def DestroyCryptoKeyVersion(self, request, context): - """Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for - destruction. + """Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction. - Upon calling this method, - [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will - be set to + Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED] - and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will - be set to a time 24 hours in the future, at which point the - [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be changed to - [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], - and the key material will be irrevocably destroyed. - - Before the - [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is - reached, - [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] - may be called to reverse the process. + and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24 + hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state] + will be changed to + [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key + material will be irrevocably destroyed. + + Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached, + [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") @@ -336,11 +363,9 @@ def RestoreCryptoKeyVersion(self, request, context): [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED] state. - Upon restoration of the CryptoKeyVersion, - [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to - [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], - and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will - be cleared. + Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state] + will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], + and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared. """ context.set_code(grpc.StatusCode.UNIMPLEMENTED) context.set_details("Method not implemented!") @@ -364,6 +389,11 @@ def add_KeyManagementServiceServicer_to_server(servicer, server): request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ListCryptoKeyVersionsRequest.FromString, response_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ListCryptoKeyVersionsResponse.SerializeToString, ), + "ListImportJobs": grpc.unary_unary_rpc_method_handler( + servicer.ListImportJobs, + request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ListImportJobsRequest.FromString, + response_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ListImportJobsResponse.SerializeToString, + ), "GetKeyRing": grpc.unary_unary_rpc_method_handler( servicer.GetKeyRing, request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.GetKeyRingRequest.FromString, @@ -384,6 +414,11 @@ def add_KeyManagementServiceServicer_to_server(servicer, server): request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.GetPublicKeyRequest.FromString, response_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.PublicKey.SerializeToString, ), + "GetImportJob": grpc.unary_unary_rpc_method_handler( + servicer.GetImportJob, + request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.GetImportJobRequest.FromString, + response_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.ImportJob.SerializeToString, + ), "CreateKeyRing": grpc.unary_unary_rpc_method_handler( servicer.CreateKeyRing, request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.CreateKeyRingRequest.FromString, @@ -399,6 +434,16 @@ def add_KeyManagementServiceServicer_to_server(servicer, server): request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.CreateCryptoKeyVersionRequest.FromString, response_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.CryptoKeyVersion.SerializeToString, ), + "ImportCryptoKeyVersion": grpc.unary_unary_rpc_method_handler( + servicer.ImportCryptoKeyVersion, + request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.ImportCryptoKeyVersionRequest.FromString, + response_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.CryptoKeyVersion.SerializeToString, + ), + "CreateImportJob": grpc.unary_unary_rpc_method_handler( + servicer.CreateImportJob, + request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.CreateImportJobRequest.FromString, + response_serializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_resources__pb2.ImportJob.SerializeToString, + ), "UpdateCryptoKey": grpc.unary_unary_rpc_method_handler( servicer.UpdateCryptoKey, request_deserializer=google_dot_cloud_dot_kms__v1_dot_proto_dot_service__pb2.UpdateCryptoKeyRequest.FromString, diff --git a/kms/synth.metadata b/kms/synth.metadata index c67fe634d5c2..a53b538da3ff 100644 --- a/kms/synth.metadata +++ b/kms/synth.metadata @@ -1,19 +1,19 @@ { - "updateTime": "2019-06-14T12:22:23.334226Z", + "updateTime": "2019-06-15T12:22:09.991585Z", "sources": [ { "generator": { "name": "artman", - "version": "0.25.0", - "dockerImage": "googleapis/artman@sha256:ef1a98ab1e2b8f05f4d9a56f27d63347aefe14020e5f2d585172b14ca76f1d90" + "version": "0.26.0", + "dockerImage": "googleapis/artman@sha256:6db0735b0d3beec5b887153a2a7c7411fc7bb53f73f6f389a822096bd14a3a15" } }, { "git": { "name": "googleapis", "remote": "https://github.com/googleapis/googleapis.git", - "sha": "c23b68eecb00c4d285a730a49b1d7d943cd56183", - "internalRef": "253113405" + "sha": "7b58b37559f6a5337c4c564518e9573d742df225", + "internalRef": "253322136" } }, { diff --git a/kms/tests/unit/gapic/v1/test_key_management_service_client_v1.py b/kms/tests/unit/gapic/v1/test_key_management_service_client_v1.py index efdaf6effd8c..dd73311fdb1c 100644 --- a/kms/tests/unit/gapic/v1/test_key_management_service_client_v1.py +++ b/kms/tests/unit/gapic/v1/test_key_management_service_client_v1.py @@ -115,6 +115,54 @@ def test_list_key_rings_exception(self): with pytest.raises(CustomException): list(paged_list_response) + def test_list_import_jobs(self): + # Setup Expected Response + next_page_token = "" + total_size = 705419236 + import_jobs_element = {} + import_jobs = [import_jobs_element] + expected_response = { + "next_page_token": next_page_token, + "total_size": total_size, + "import_jobs": import_jobs, + } + expected_response = service_pb2.ListImportJobsResponse(**expected_response) + + # Mock the API response + channel = ChannelStub(responses=[expected_response]) + patch = mock.patch("google.api_core.grpc_helpers.create_channel") + with patch as create_channel: + create_channel.return_value = channel + client = kms_v1.KeyManagementServiceClient() + + # Setup Request + parent = client.key_ring_path("[PROJECT]", "[LOCATION]", "[KEY_RING]") + + paged_list_response = client.list_import_jobs(parent) + resources = list(paged_list_response) + assert len(resources) == 1 + + assert expected_response.import_jobs[0] == resources[0] + + assert len(channel.requests) == 1 + expected_request = service_pb2.ListImportJobsRequest(parent=parent) + actual_request = channel.requests[0][1] + assert expected_request == actual_request + + def test_list_import_jobs_exception(self): + channel = ChannelStub(responses=[CustomException()]) + patch = mock.patch("google.api_core.grpc_helpers.create_channel") + with patch as create_channel: + create_channel.return_value = channel + client = kms_v1.KeyManagementServiceClient() + + # Setup request + parent = client.key_ring_path("[PROJECT]", "[LOCATION]", "[KEY_RING]") + + paged_list_response = client.list_import_jobs(parent) + with pytest.raises(CustomException): + list(paged_list_response) + def test_list_crypto_keys(self): # Setup Expected Response next_page_token = "" @@ -255,6 +303,48 @@ def test_get_key_ring_exception(self): with pytest.raises(CustomException): client.get_key_ring(name) + def test_get_import_job(self): + # Setup Expected Response + name_2 = "name2-1052831874" + expected_response = {"name": name_2} + expected_response = resources_pb2.ImportJob(**expected_response) + + # Mock the API response + channel = ChannelStub(responses=[expected_response]) + patch = mock.patch("google.api_core.grpc_helpers.create_channel") + with patch as create_channel: + create_channel.return_value = channel + client = kms_v1.KeyManagementServiceClient() + + # Setup Request + name = client.import_job_path( + "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[IMPORT_JOB]" + ) + + response = client.get_import_job(name) + assert expected_response == response + + assert len(channel.requests) == 1 + expected_request = service_pb2.GetImportJobRequest(name=name) + actual_request = channel.requests[0][1] + assert expected_request == actual_request + + def test_get_import_job_exception(self): + # Mock the API response + channel = ChannelStub(responses=[CustomException()]) + patch = mock.patch("google.api_core.grpc_helpers.create_channel") + with patch as create_channel: + create_channel.return_value = channel + client = kms_v1.KeyManagementServiceClient() + + # Setup request + name = client.import_job_path( + "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[IMPORT_JOB]" + ) + + with pytest.raises(CustomException): + client.get_import_job(name) + def test_get_crypto_key(self): # Setup Expected Response name_2 = "name2-1052831874" @@ -300,7 +390,13 @@ def test_get_crypto_key_exception(self): def test_get_crypto_key_version(self): # Setup Expected Response name_2 = "name2-1052831874" - expected_response = {"name": name_2} + import_job = "importJob2125587491" + import_failure_reason = "importFailureReason-494073229" + expected_response = { + "name": name_2, + "import_job": import_job, + "import_failure_reason": import_failure_reason, + } expected_response = resources_pb2.CryptoKeyVersion(**expected_response) # Mock the API response @@ -391,6 +487,60 @@ def test_create_key_ring_exception(self): with pytest.raises(CustomException): client.create_key_ring(parent, key_ring_id, key_ring) + def test_create_import_job(self): + # Setup Expected Response + name = "name3373707" + expected_response = {"name": name} + expected_response = resources_pb2.ImportJob(**expected_response) + + # Mock the API response + channel = ChannelStub(responses=[expected_response]) + patch = mock.patch("google.api_core.grpc_helpers.create_channel") + with patch as create_channel: + create_channel.return_value = channel + client = kms_v1.KeyManagementServiceClient() + + # Setup Request + parent = client.key_ring_path("[PROJECT]", "[LOCATION]", "[KEY_RING]") + import_job_id = "my-import-job" + import_method = enums.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256 + protection_level = enums.ProtectionLevel.HSM + import_job = { + "import_method": import_method, + "protection_level": protection_level, + } + + response = client.create_import_job(parent, import_job_id, import_job) + assert expected_response == response + + assert len(channel.requests) == 1 + expected_request = service_pb2.CreateImportJobRequest( + parent=parent, import_job_id=import_job_id, import_job=import_job + ) + actual_request = channel.requests[0][1] + assert expected_request == actual_request + + def test_create_import_job_exception(self): + # Mock the API response + channel = ChannelStub(responses=[CustomException()]) + patch = mock.patch("google.api_core.grpc_helpers.create_channel") + with patch as create_channel: + create_channel.return_value = channel + client = kms_v1.KeyManagementServiceClient() + + # Setup request + parent = client.key_ring_path("[PROJECT]", "[LOCATION]", "[KEY_RING]") + import_job_id = "my-import-job" + import_method = enums.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256 + protection_level = enums.ProtectionLevel.HSM + import_job = { + "import_method": import_method, + "protection_level": protection_level, + } + + with pytest.raises(CustomException): + client.create_import_job(parent, import_job_id, import_job) + def test_create_crypto_key(self): # Setup Expected Response name = "name3373707" @@ -456,7 +606,13 @@ def test_create_crypto_key_exception(self): def test_create_crypto_key_version(self): # Setup Expected Response name = "name3373707" - expected_response = {"name": name} + import_job = "importJob2125587491" + import_failure_reason = "importFailureReason-494073229" + expected_response = { + "name": name, + "import_job": import_job, + "import_failure_reason": import_failure_reason, + } expected_response = resources_pb2.CryptoKeyVersion(**expected_response) # Mock the API response @@ -499,6 +655,64 @@ def test_create_crypto_key_version_exception(self): with pytest.raises(CustomException): client.create_crypto_key_version(parent, crypto_key_version) + def test_import_crypto_key_version(self): + # Setup Expected Response + name = "name3373707" + import_job_2 = "importJob2-1714851050" + import_failure_reason = "importFailureReason-494073229" + expected_response = { + "name": name, + "import_job": import_job_2, + "import_failure_reason": import_failure_reason, + } + expected_response = resources_pb2.CryptoKeyVersion(**expected_response) + + # Mock the API response + channel = ChannelStub(responses=[expected_response]) + patch = mock.patch("google.api_core.grpc_helpers.create_channel") + with patch as create_channel: + create_channel.return_value = channel + client = kms_v1.KeyManagementServiceClient() + + # Setup Request + parent = client.crypto_key_path( + "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]" + ) + algorithm = ( + enums.CryptoKeyVersion.CryptoKeyVersionAlgorithm.CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED + ) + import_job = "importJob2125587491" + + response = client.import_crypto_key_version(parent, algorithm, import_job) + assert expected_response == response + + assert len(channel.requests) == 1 + expected_request = service_pb2.ImportCryptoKeyVersionRequest( + parent=parent, algorithm=algorithm, import_job=import_job + ) + actual_request = channel.requests[0][1] + assert expected_request == actual_request + + def test_import_crypto_key_version_exception(self): + # Mock the API response + channel = ChannelStub(responses=[CustomException()]) + patch = mock.patch("google.api_core.grpc_helpers.create_channel") + with patch as create_channel: + create_channel.return_value = channel + client = kms_v1.KeyManagementServiceClient() + + # Setup request + parent = client.crypto_key_path( + "[PROJECT]", "[LOCATION]", "[KEY_RING]", "[CRYPTO_KEY]" + ) + algorithm = ( + enums.CryptoKeyVersion.CryptoKeyVersionAlgorithm.CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED + ) + import_job = "importJob2125587491" + + with pytest.raises(CustomException): + client.import_crypto_key_version(parent, algorithm, import_job) + def test_update_crypto_key(self): # Setup Expected Response name = "name3373707" @@ -544,7 +758,13 @@ def test_update_crypto_key_exception(self): def test_update_crypto_key_version(self): # Setup Expected Response name = "name3373707" - expected_response = {"name": name} + import_job = "importJob2125587491" + import_failure_reason = "importFailureReason-494073229" + expected_response = { + "name": name, + "import_job": import_job, + "import_failure_reason": import_failure_reason, + } expected_response = resources_pb2.CryptoKeyVersion(**expected_response) # Mock the API response @@ -721,7 +941,13 @@ def test_update_crypto_key_primary_version_exception(self): def test_destroy_crypto_key_version(self): # Setup Expected Response name_2 = "name2-1052831874" - expected_response = {"name": name_2} + import_job = "importJob2125587491" + import_failure_reason = "importFailureReason-494073229" + expected_response = { + "name": name_2, + "import_job": import_job, + "import_failure_reason": import_failure_reason, + } expected_response = resources_pb2.CryptoKeyVersion(**expected_response) # Mock the API response @@ -771,7 +997,13 @@ def test_destroy_crypto_key_version_exception(self): def test_restore_crypto_key_version(self): # Setup Expected Response name_2 = "name2-1052831874" - expected_response = {"name": name_2} + import_job = "importJob2125587491" + import_failure_reason = "importFailureReason-494073229" + expected_response = { + "name": name_2, + "import_job": import_job, + "import_failure_reason": import_failure_reason, + } expected_response = resources_pb2.CryptoKeyVersion(**expected_response) # Mock the API response