KeyManagementService¶

async create_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.CreateCryptoKeyVersionRequest, dict]] = None, *, parent: Optional[str] = None, crypto_key_version: Optional[google.cloud.kms_v1.types.resources.CryptoKeyVersion] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Create a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in a [CryptoKey][google.cloud.kms.v1.CryptoKey].

The server will assign the next sequential id. If unset, [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_create_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.CreateCryptoKeyVersionRequest(
        parent="parent_value",
    )

    # Make the request
    response = await client.create_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.CreateCryptoKeyVersionRequest, dict]]) – The request object. Request message for [KeyManagementService.CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion].
parent (str) –
Required. The [name][google.cloud.kms.v1.CryptoKey.name] of the [CryptoKey][google.cloud.kms.v1.CryptoKey] associated with the [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion].

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
crypto_key_version (google.cloud.kms_v1.types.CryptoKeyVersion) –
Required. A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with initial field values.

This corresponds to the crypto_key_version field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

async create_import_job(request: Optional[Union[google.cloud.kms_v1.types.service.CreateImportJobRequest, dict]] = None, *, parent: Optional[str] = None, import_job_id: Optional[str] = None, import_job: Optional[google.cloud.kms_v1.types.resources.ImportJob] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.ImportJob[source]¶

Create a new [ImportJob][google.cloud.kms.v1.ImportJob] within a [KeyRing][google.cloud.kms.v1.KeyRing].

[ImportJob.import_method][google.cloud.kms.v1.ImportJob.import_method] is required.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_create_import_job():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    import_job = kms_v1.ImportJob()
    import_job.import_method = "RSA_OAEP_4096_SHA256"
    import_job.protection_level = "EXTERNAL_VPC"

    request = kms_v1.CreateImportJobRequest(
        parent="parent_value",
        import_job_id="import_job_id_value",
        import_job=import_job,
    )

    # Make the request
    response = await client.create_import_job(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.CreateImportJobRequest, dict]]) – The request object. Request message for [KeyManagementService.CreateImportJob][google.cloud.kms.v1.KeyManagementService.CreateImportJob].
parent (str) –
Required. The [name][google.cloud.kms.v1.KeyRing.name] of the [KeyRing][google.cloud.kms.v1.KeyRing] associated with the [ImportJobs][google.cloud.kms.v1.ImportJob].

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
import_job_id (str) –
Required. It must be unique within a KeyRing and match the regular expression [a-zA-Z0-9_-]{1,63}

This corresponds to the import_job_id field on the request instance; if request is provided, this should not be set.
import_job (google.cloud.kms_v1.types.ImportJob) –
Required. An [ImportJob][google.cloud.kms.v1.ImportJob] with initial field values.

This corresponds to the import_job field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

An [ImportJob][google.cloud.kms.v1.ImportJob] can be used to create

[CryptoKeys][google.cloud.kms.v1.CryptoKey] and [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] using pre-existing key material, generated outside of Cloud KMS.

When an [ImportJob][google.cloud.kms.v1.ImportJob] is created, Cloud KMS will generate a “wrapping key”, which is a public/private key pair. You use the wrapping key to encrypt (also known as wrap) the pre-existing key material to protect it during the import process. The nature of the wrapping key depends on the choice of [import_method][google.cloud.kms.v1.ImportJob.import_method]. When the wrapping key generation is complete, the [state][google.cloud.kms.v1.ImportJob.state] will be set to [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE] and the [public_key][google.cloud.kms.v1.ImportJob.public_key] can be fetched. The fetched public key can then be used to wrap your pre-existing key material.

Once the key material is wrapped, it can be imported into a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in an existing [CryptoKey][google.cloud.kms.v1.CryptoKey] by calling [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]. Multiple [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] can be imported with a single [ImportJob][google.cloud.kms.v1.ImportJob]. Cloud KMS uses the private key portion of the wrapping key to unwrap the key material. Only Cloud KMS has access to the private key.

An [ImportJob][google.cloud.kms.v1.ImportJob] expires 3 days after it is created. Once expired, Cloud KMS will no longer be able to import or unwrap any key material that was wrapped with the [ImportJob][google.cloud.kms.v1.ImportJob]’s public key.

For more information, see [Importing a key](https://cloud.google.com/kms/docs/importing-a-key).

Return type

async create_key_ring(request: Optional[Union[google.cloud.kms_v1.types.service.CreateKeyRingRequest, dict]] = None, *, parent: Optional[str] = None, key_ring_id: Optional[str] = None, key_ring: Optional[google.cloud.kms_v1.types.resources.KeyRing] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.KeyRing[source]¶

Create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and Location.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_create_key_ring():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.CreateKeyRingRequest(
        parent="parent_value",
        key_ring_id="key_ring_id_value",
    )

    # Make the request
    response = await client.create_key_ring(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.CreateKeyRingRequest, dict]]) – The request object. Request message for [KeyManagementService.CreateKeyRing][google.cloud.kms.v1.KeyManagementService.CreateKeyRing].
parent (str) –
Required. The resource name of the location associated with the [KeyRings][google.cloud.kms.v1.KeyRing], in the format projects/*/locations/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
key_ring_id (str) –
Required. It must be unique within a location and match the regular expression [a-zA-Z0-9_-]{1,63}

This corresponds to the key_ring_id field on the request instance; if request is provided, this should not be set.
key_ring (google.cloud.kms_v1.types.KeyRing) –
Required. A [KeyRing][google.cloud.kms.v1.KeyRing] with initial field values.

This corresponds to the key_ring field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of: [CryptoKeys][google.cloud.kms.v1.CryptoKey].

Return type

google.cloud.kms_v1.types.DecryptResponse

static crypto_key_path(project: str, location: str, key_ring: str, crypto_key: str) → str¶: Returns a fully-qualified crypto_key string.

static crypto_key_version_path(project: str, location: str, key_ring: str, crypto_key: str, crypto_key_version: str) → str¶: Returns a fully-qualified crypto_key_version string.

async decrypt(request: Optional[Union[google.cloud.kms_v1.types.service.DecryptRequest, dict]] = None, *, name: Optional[str] = None, ciphertext: Optional[bytes] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.DecryptResponse[source]¶

Decrypts data that was protected by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_decrypt():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.DecryptRequest(
        name="name_value",
        ciphertext=b'ciphertext_blob',
    )

    # Make the request
    response = await client.decrypt(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.DecryptRequest, dict]]) – The request object. Request message for [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].
name (str) –
Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to use for decryption. The server will choose the appropriate version.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
ciphertext (bytes) –
Required. The encrypted data originally returned in [EncryptResponse.ciphertext][google.cloud.kms.v1.EncryptResponse.ciphertext].

This corresponds to the ciphertext field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].

Return type

async destroy_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.DestroyCryptoKeyVersionRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.

Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED], and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to the time [destroy_scheduled_duration][google.cloud.kms.v1.CryptoKey.destroy_scheduled_duration] in the future. At that time, the [state][google.cloud.kms.v1.CryptoKeyVersion.state] will automatically change to [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key material will be irrevocably destroyed.

Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached, [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_destroy_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.DestroyCryptoKeyVersionRequest(
        name="name_value",
    )

    # Make the request
    response = await client.destroy_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.DestroyCryptoKeyVersionRequest, dict]]) – The request object. Request message for [KeyManagementService.DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

google.cloud.kms_v1.types.EncryptResponse

async encrypt(request: Optional[Union[google.cloud.kms_v1.types.service.EncryptRequest, dict]] = None, *, name: Optional[str] = None, plaintext: Optional[bytes] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.EncryptResponse[source]¶

Encrypts data, so that it can only be recovered by a call to [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_encrypt():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.EncryptRequest(
        name="name_value",
        plaintext=b'plaintext_blob',
    )

    # Make the request
    response = await client.encrypt(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.EncryptRequest, dict]]) – The request object. Request message for [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
name (str) –
Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] or [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for encryption.

If a [CryptoKey][google.cloud.kms.v1.CryptoKey] is specified, the server will use its [primary version][google.cloud.kms.v1.CryptoKey.primary].

This corresponds to the name field on the request instance; if request is provided, this should not be set.
plaintext (bytes) –
Required. The data to encrypt. Must be no larger than 64KiB.

The maximum size depends on the key version’s [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]. For [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE], [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL], and [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC] keys, the plaintext must be no larger than 64KiB. For [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] keys, the combined length of the plaintext and additional_authenticated_data fields must be no larger than 8KiB.

This corresponds to the plaintext field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].

Return type

classmethod from_service_account_file(filename: str, *args, **kwargs)[source]¶

Creates an instance of this client using the provided credentials: file.

Parameters

filename (str) – The path to the service account private key json file.
args – Additional arguments to pass to the constructor.
kwargs – Additional arguments to pass to the constructor.

Returns

The constructed client.

Return type

KeyManagementServiceAsyncClient

classmethod from_service_account_info(info: dict, *args, **kwargs)[source]¶

Creates an instance of this client using the provided credentials: info.

Parameters

info (dict) – The service account private key info.
args – Additional arguments to pass to the constructor.
kwargs – Additional arguments to pass to the constructor.

Returns

The constructed client.

Return type

KeyManagementServiceAsyncClient

classmethod from_service_account_json(filename: str, *args, **kwargs)¶

Creates an instance of this client using the provided credentials: file.

Parameters

filename (str) – The path to the service account private key json file.
args – Additional arguments to pass to the constructor.
kwargs – Additional arguments to pass to the constructor.

Returns

The constructed client.

Return type

KeyManagementServiceAsyncClient

async generate_random_bytes(request: Optional[Union[google.cloud.kms_v1.types.service.GenerateRandomBytesRequest, dict]] = None, *, location: Optional[str] = None, length_bytes: Optional[int] = None, protection_level: Optional[google.cloud.kms_v1.types.resources.ProtectionLevel] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.GenerateRandomBytesResponse[source]¶

Generate random bytes using the Cloud KMS randomness source in the provided location.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_generate_random_bytes():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.GenerateRandomBytesRequest(
    )

    # Make the request
    response = await client.generate_random_bytes(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.GenerateRandomBytesRequest, dict]]) – The request object. Request message for [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].
location (str) –
The project-specific location in which to generate random bytes. For example, “projects/my-project/locations/us-central1”.

This corresponds to the location field on the request instance; if request is provided, this should not be set.
length_bytes (int) –
The length in bytes of the amount of randomness to retrieve. Minimum 8 bytes, maximum 1024 bytes.

This corresponds to the length_bytes field on the request instance; if request is provided, this should not be set.
protection_level (google.cloud.kms_v1.types.ProtectionLevel) –
The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Currently, only [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] protection level is supported.

This corresponds to the protection_level field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].

Return type

google.cloud.kms_v1.types.GenerateRandomBytesResponse

async get_crypto_key(request: Optional[Union[google.cloud.kms_v1.types.service.GetCryptoKeyRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKey[source]¶

Returns metadata for a given [CryptoKey][google.cloud.kms.v1.CryptoKey], as well as its [primary][google.cloud.kms.v1.CryptoKey.primary] [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_get_crypto_key():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.GetCryptoKeyRequest(
        name="name_value",
    )

    # Make the request
    response = await client.get_crypto_key(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.GetCryptoKeyRequest, dict]]) – The request object. Request message for [KeyManagementService.GetCryptoKey][google.cloud.kms.v1.KeyManagementService.GetCryptoKey].
name (str) –
Required. The [name][google.cloud.kms.v1.CryptoKey.name] of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that

can be used for cryptographic operations.

A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of zero or more [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual key material used in cryptographic operations.

Return type

async get_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.GetCryptoKeyVersionRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Returns metadata for a given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_get_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.GetCryptoKeyVersionRequest(
        name="name_value",
    )

    # Make the request
    response = await client.get_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.GetCryptoKeyVersionRequest, dict]]) – The request object. Request message for [KeyManagementService.GetCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.GetCryptoKeyVersion].
name (str) –
Required. The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

async get_iam_policy(request: Optional[google.iam.v1.iam_policy_pb2.GetIamPolicyRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.iam.v1.policy_pb2.Policy[source]¶

Gets the IAM access control policy for a function.

Returns an empty policy if the function exists and does not have a policy set.

Parameters

request (GetIamPolicyRequest) – The request object. Request message for GetIamPolicy method.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions (defined by IAM or configured by users). A binding can optionally specify a condition, which is a logic expression that further constrains the role binding based on attributes about the request and/or target resource.

JSON Example

{
  "bindings": [
    {
      "role": "roles/resourcemanager.organizationAdmin",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-project-id@appspot.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/resourcemanager.organizationViewer",
      "members": ["user:eve@example.com"],
      "condition": {
        "title": "expirable access",
        "description": "Does not grant access after Sep 2020",
        "expression": "request.time <
        timestamp('2020-10-01T00:00:00.000Z')",
      }
    }
  ]
}

YAML Example

bindings:
- members:
  - user:mike@example.com
  - group:admins@example.com
  - domain:google.com
  - serviceAccount:my-project-id@appspot.gserviceaccount.com
  role: roles/resourcemanager.organizationAdmin
- members:
  - user:eve@example.com
  role: roles/resourcemanager.organizationViewer
  condition:
    title: expirable access
    description: Does not grant access after Sep 2020
    expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

For a description of IAM and its features, see the IAM developer’s guide.

Return type

Policy

async get_import_job(request: Optional[Union[google.cloud.kms_v1.types.service.GetImportJobRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.ImportJob[source]¶

Returns metadata for a given [ImportJob][google.cloud.kms.v1.ImportJob].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_get_import_job():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.GetImportJobRequest(
        name="name_value",
    )

    # Make the request
    response = await client.get_import_job(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.GetImportJobRequest, dict]]) – The request object. Request message for [KeyManagementService.GetImportJob][google.cloud.kms.v1.KeyManagementService.GetImportJob].
name (str) –
Required. The [name][google.cloud.kms.v1.ImportJob.name] of the [ImportJob][google.cloud.kms.v1.ImportJob] to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

An [ImportJob][google.cloud.kms.v1.ImportJob] can be used to create

[CryptoKeys][google.cloud.kms.v1.CryptoKey] and [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] using pre-existing key material, generated outside of Cloud KMS.

When an [ImportJob][google.cloud.kms.v1.ImportJob] is created, Cloud KMS will generate a “wrapping key”, which is a public/private key pair. You use the wrapping key to encrypt (also known as wrap) the pre-existing key material to protect it during the import process. The nature of the wrapping key depends on the choice of [import_method][google.cloud.kms.v1.ImportJob.import_method]. When the wrapping key generation is complete, the [state][google.cloud.kms.v1.ImportJob.state] will be set to [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE] and the [public_key][google.cloud.kms.v1.ImportJob.public_key] can be fetched. The fetched public key can then be used to wrap your pre-existing key material.

Once the key material is wrapped, it can be imported into a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in an existing [CryptoKey][google.cloud.kms.v1.CryptoKey] by calling [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]. Multiple [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] can be imported with a single [ImportJob][google.cloud.kms.v1.ImportJob]. Cloud KMS uses the private key portion of the wrapping key to unwrap the key material. Only Cloud KMS has access to the private key.

An [ImportJob][google.cloud.kms.v1.ImportJob] expires 3 days after it is created. Once expired, Cloud KMS will no longer be able to import or unwrap any key material that was wrapped with the [ImportJob][google.cloud.kms.v1.ImportJob]’s public key.

For more information, see [Importing a key](https://cloud.google.com/kms/docs/importing-a-key).

Return type

async get_key_ring(request: Optional[Union[google.cloud.kms_v1.types.service.GetKeyRingRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.KeyRing[source]¶

Returns metadata for a given [KeyRing][google.cloud.kms.v1.KeyRing].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_get_key_ring():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.GetKeyRingRequest(
        name="name_value",
    )

    # Make the request
    response = await client.get_key_ring(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.GetKeyRingRequest, dict]]) – The request object. Request message for [KeyManagementService.GetKeyRing][google.cloud.kms.v1.KeyManagementService.GetKeyRing].
name (str) –
Required. The [name][google.cloud.kms.v1.KeyRing.name] of the [KeyRing][google.cloud.kms.v1.KeyRing] to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of: [CryptoKeys][google.cloud.kms.v1.CryptoKey].

Return type

google.cloud.kms_v1.types.PublicKey

async get_location(request: Optional[google.cloud.location.locations_pb2.GetLocationRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.location.locations_pb2.Location[source]¶

Gets information about a location.

Parameters

request (GetLocationRequest) – The request object. Request message for GetLocation method.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Location object.

Return type

Location

classmethod get_mtls_endpoint_and_cert_source(client_options: Optional[google.api_core.client_options.ClientOptions] = None)[source]¶

Return the API endpoint and client cert source for mutual TLS.

The client cert source is determined in the following order: (1) if GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is not “true”, the client cert source is None. (2) if client_options.client_cert_source is provided, use the provided one; if the default client cert source exists, use the default one; otherwise the client cert source is None.

The API endpoint is determined in the following order: (1) if client_options.api_endpoint if provided, use the provided one. (2) if GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is “always”, use the default mTLS endpoint; if the environment variable is “never”, use the default API endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise use the default API endpoint.

More details can be found at https://google.aip.dev/auth/4114.

Parameters

client_options (google.api_core.client_options.ClientOptions) – Custom options for the client. Only the api_endpoint and client_cert_source properties may be used in this method.

Returns

returns the API endpoint and the: client cert source to use.

Return type

Tuple[str, Callable[[], Tuple[bytes, bytes]]]

Raises

google.auth.exceptions.MutualTLSChannelError – If any errors happen.

async get_operation(request: Optional[google.longrunning.operations_pb2.GetOperationRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.longrunning.operations_pb2.Operation[source]¶

Gets the latest state of a long-running operation.

Parameters

request (GetOperationRequest) – The request object. Request message for GetOperation method.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

An Operation object.

Return type

Operation

async get_public_key(request: Optional[Union[google.cloud.kms_v1.types.service.GetPublicKeyRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.PublicKey[source]¶

Returns the public key for the given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN] or [ASYMMETRIC_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_get_public_key():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.GetPublicKeyRequest(
        name="name_value",
    )

    # Make the request
    response = await client.get_public_key(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.GetPublicKeyRequest, dict]]) – The request object. Request message for [KeyManagementService.GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
name (str) –
Required. The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

The public keys for a given: [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained via [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].

Return type

classmethod get_transport_class(label: Optional[str] = None) → Type[google.cloud.kms_v1.services.key_management_service.transports.base.KeyManagementServiceTransport]¶

Returns an appropriate transport class.

Parameters: label – The name of the desired transport. If none is provided, then the first transport in the registry is used.
Returns: The transport class to use.

async import_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.ImportCryptoKeyVersionRequest, dict]] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Import wrapped key material into a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].

All requests must specify a [CryptoKey][google.cloud.kms.v1.CryptoKey]. If a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] is additionally specified in the request, key material will be reimported into that version. Otherwise, a new version will be created, and will be assigned the next sequential id within the [CryptoKey][google.cloud.kms.v1.CryptoKey].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_import_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.ImportCryptoKeyVersionRequest(
        rsa_aes_wrapped_key=b'rsa_aes_wrapped_key_blob',
        parent="parent_value",
        algorithm="EXTERNAL_SYMMETRIC_ENCRYPTION",
        import_job="import_job_value",
    )

    # Make the request
    response = await client.import_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.ImportCryptoKeyVersionRequest, dict]]) – The request object. Request message for [KeyManagementService.ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion].
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

google.cloud.kms_v1.services.key_management_service.pagers.ListCryptoKeyVersionsAsyncPager

static import_job_path(project: str, location: str, key_ring: str, import_job: str) → str¶: Returns a fully-qualified import_job string.

static key_ring_path(project: str, location: str, key_ring: str) → str¶: Returns a fully-qualified key_ring string.

async list_crypto_key_versions(request: Optional[Union[google.cloud.kms_v1.types.service.ListCryptoKeyVersionsRequest, dict]] = None, *, parent: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.services.key_management_service.pagers.ListCryptoKeyVersionsAsyncPager[source]¶

Lists [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_list_crypto_key_versions():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.ListCryptoKeyVersionsRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_crypto_key_versions(request=request)

    # Handle the response
    async for response in page_result:
        print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.ListCryptoKeyVersionsRequest, dict]]) – The request object. Request message for [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions].
parent (str) –
Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to list, in the format projects/*/locations/*/keyRings/*/cryptoKeys/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions].

Iterating over this object will yield results and resolve additional pages automatically.

Return type

async list_crypto_keys(request: Optional[Union[google.cloud.kms_v1.types.service.ListCryptoKeysRequest, dict]] = None, *, parent: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.services.key_management_service.pagers.ListCryptoKeysAsyncPager[source]¶

Lists [CryptoKeys][google.cloud.kms.v1.CryptoKey].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_list_crypto_keys():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.ListCryptoKeysRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_crypto_keys(request=request)

    # Handle the response
    async for response in page_result:
        print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.ListCryptoKeysRequest, dict]]) – The request object. Request message for [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys].
parent (str) –
Required. The resource name of the [KeyRing][google.cloud.kms.v1.KeyRing] to list, in the format projects/*/locations/*/keyRings/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys].

Iterating over this object will yield results and resolve additional pages automatically.

Return type

google.cloud.kms_v1.services.key_management_service.pagers.ListCryptoKeysAsyncPager

async list_import_jobs(request: Optional[Union[google.cloud.kms_v1.types.service.ListImportJobsRequest, dict]] = None, *, parent: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.services.key_management_service.pagers.ListImportJobsAsyncPager[source]¶

Lists [ImportJobs][google.cloud.kms.v1.ImportJob].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_list_import_jobs():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.ListImportJobsRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_import_jobs(request=request)

    # Handle the response
    async for response in page_result:
        print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.ListImportJobsRequest, dict]]) – The request object. Request message for [KeyManagementService.ListImportJobs][google.cloud.kms.v1.KeyManagementService.ListImportJobs].
parent (str) –
Required. The resource name of the [KeyRing][google.cloud.kms.v1.KeyRing] to list, in the format projects/*/locations/*/keyRings/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.ListImportJobs][google.cloud.kms.v1.KeyManagementService.ListImportJobs].

Iterating over this object will yield results and resolve additional pages automatically.

Return type

google.cloud.kms_v1.services.key_management_service.pagers.ListImportJobsAsyncPager

async list_key_rings(request: Optional[Union[google.cloud.kms_v1.types.service.ListKeyRingsRequest, dict]] = None, *, parent: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.services.key_management_service.pagers.ListKeyRingsAsyncPager[source]¶

Lists [KeyRings][google.cloud.kms.v1.KeyRing].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_list_key_rings():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.ListKeyRingsRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_key_rings(request=request)

    # Handle the response
    async for response in page_result:
        print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.ListKeyRingsRequest, dict]]) – The request object. Request message for [KeyManagementService.ListKeyRings][google.cloud.kms.v1.KeyManagementService.ListKeyRings].
parent (str) –
Required. The resource name of the location associated with the [KeyRings][google.cloud.kms.v1.KeyRing], in the format projects/*/locations/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.ListKeyRings][google.cloud.kms.v1.KeyManagementService.ListKeyRings].

Iterating over this object will yield results and resolve additional pages automatically.

Return type

google.cloud.kms_v1.services.key_management_service.pagers.ListKeyRingsAsyncPager

async list_locations(request: Optional[google.cloud.location.locations_pb2.ListLocationsRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.location.locations_pb2.ListLocationsResponse[source]¶

Lists information about the supported locations for this service.

Parameters

request (ListLocationsRequest) – The request object. Request message for ListLocations method.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for ListLocations method.

Return type

ListLocationsResponse

async mac_sign(request: Optional[Union[google.cloud.kms_v1.types.service.MacSignRequest, dict]] = None, *, name: Optional[str] = None, data: Optional[bytes] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.MacSignResponse[source]¶

Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, producing a tag that can be verified by another source with the same key.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_mac_sign():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.MacSignRequest(
        name="name_value",
        data=b'data_blob',
    )

    # Make the request
    response = await client.mac_sign(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.MacSignRequest, dict]]) – The request object. Request message for [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
data (bytes) –
Required. The data to sign. The MAC tag is computed over this data field based on the specific algorithm.

This corresponds to the data field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].

Return type

google.cloud.kms_v1.types.MacSignResponse

async mac_verify(request: Optional[Union[google.cloud.kms_v1.types.service.MacVerifyRequest, dict]] = None, *, name: Optional[str] = None, data: Optional[bytes] = None, mac: Optional[bytes] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.MacVerifyResponse[source]¶

Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, and returns a response that indicates whether or not the verification was successful.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_mac_verify():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.MacVerifyRequest(
        name="name_value",
        data=b'data_blob',
        mac=b'mac_blob',
    )

    # Make the request
    response = await client.mac_verify(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.MacVerifyRequest, dict]]) – The request object. Request message for [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
data (bytes) –
Required. The data used previously as a [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC tag.

This corresponds to the data field on the request instance; if request is provided, this should not be set.
mac (bytes) – Required. The signature to verify. This corresponds to the mac field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].

Return type

google.cloud.kms_v1.types.MacVerifyResponse

static parse_common_billing_account_path(path: str) → Dict[str, str]¶: Parse a billing_account path into its component segments.

static parse_common_folder_path(path: str) → Dict[str, str]¶: Parse a folder path into its component segments.

static parse_common_location_path(path: str) → Dict[str, str]¶: Parse a location path into its component segments.

static parse_common_organization_path(path: str) → Dict[str, str]¶: Parse a organization path into its component segments.

static parse_common_project_path(path: str) → Dict[str, str]¶: Parse a project path into its component segments.

static parse_crypto_key_path(path: str) → Dict[str, str]¶: Parses a crypto_key path into its component segments.

static parse_crypto_key_version_path(path: str) → Dict[str, str]¶: Parses a crypto_key_version path into its component segments.

static parse_import_job_path(path: str) → Dict[str, str]¶: Parses a import_job path into its component segments.

static parse_key_ring_path(path: str) → Dict[str, str]¶: Parses a key_ring path into its component segments.

static parse_public_key_path(path: str) → Dict[str, str]¶: Parses a public_key path into its component segments.

static public_key_path(project: str, location: str, key_ring: str, crypto_key: str, crypto_key_version: str) → str¶: Returns a fully-qualified public_key string.

async raw_decrypt(request: Optional[Union[google.cloud.kms_v1.types.service.RawDecryptRequest, dict]] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.RawDecryptResponse[source]¶

Decrypts data that was originally encrypted using a raw cryptographic mechanism. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [RAW_ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.RAW_ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_raw_decrypt():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.RawDecryptRequest(
        name="name_value",
        ciphertext=b'ciphertext_blob',
        initialization_vector=b'initialization_vector_blob',
    )

    # Make the request
    response = await client.raw_decrypt(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.RawDecryptRequest, dict]]) – The request object. Request message for [KeyManagementService.RawDecrypt][google.cloud.kms.v1.KeyManagementService.RawDecrypt].
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.RawDecrypt][google.cloud.kms.v1.KeyManagementService.RawDecrypt].

Return type

google.cloud.kms_v1.types.RawDecryptResponse

async raw_encrypt(request: Optional[Union[google.cloud.kms_v1.types.service.RawEncryptRequest, dict]] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.RawEncryptResponse[source]¶

Encrypts data using portable cryptographic primitives. Most users should choose [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] and [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt] rather than their raw counterparts. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [RAW_ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.RAW_ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_raw_encrypt():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.RawEncryptRequest(
        name="name_value",
        plaintext=b'plaintext_blob',
    )

    # Make the request
    response = await client.raw_encrypt(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.RawEncryptRequest, dict]]) – The request object. Request message for [KeyManagementService.RawEncrypt][google.cloud.kms.v1.KeyManagementService.RawEncrypt].
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.RawEncrypt][google.cloud.kms.v1.KeyManagementService.RawEncrypt].

Return type

google.cloud.kms_v1.types.RawEncryptResponse

async restore_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.RestoreCryptoKeyVersionRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED] state.

Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_restore_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.RestoreCryptoKeyVersionRequest(
        name="name_value",
    )

    # Make the request
    response = await client.restore_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.RestoreCryptoKeyVersionRequest, dict]]) – The request object. Request message for [KeyManagementService.RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

async set_iam_policy(request: Optional[google.iam.v1.iam_policy_pb2.SetIamPolicyRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.iam.v1.policy_pb2.Policy[source]¶

Sets the IAM access control policy on the specified function.

Replaces any existing policy.

Parameters

request (SetIamPolicyRequest) – The request object. Request message for SetIamPolicy method.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions (defined by IAM or configured by users). A binding can optionally specify a condition, which is a logic expression that further constrains the role binding based on attributes about the request and/or target resource.

JSON Example

{
  "bindings": [
    {
      "role": "roles/resourcemanager.organizationAdmin",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-project-id@appspot.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/resourcemanager.organizationViewer",
      "members": ["user:eve@example.com"],
      "condition": {
        "title": "expirable access",
        "description": "Does not grant access after Sep 2020",
        "expression": "request.time <
        timestamp('2020-10-01T00:00:00.000Z')",
      }
    }
  ]
}

YAML Example

bindings:
- members:
  - user:mike@example.com
  - group:admins@example.com
  - domain:google.com
  - serviceAccount:my-project-id@appspot.gserviceaccount.com
  role: roles/resourcemanager.organizationAdmin
- members:
  - user:eve@example.com
  role: roles/resourcemanager.organizationViewer
  condition:
    title: expirable access
    description: Does not grant access after Sep 2020
    expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

For a description of IAM and its features, see the IAM developer’s guide.

Return type

Policy

async test_iam_permissions(request: Optional[google.iam.v1.iam_policy_pb2.TestIamPermissionsRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.iam.v1.iam_policy_pb2.TestIamPermissionsResponse[source]¶

Tests the specified permissions against the IAM access control: policy for a function.

If the function does not exist, this will return an empty set of permissions, not a NOT_FOUND error.

Parameters

request (TestIamPermissionsRequest) – The request object. Request message for TestIamPermissions method.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for TestIamPermissions method.

Return type

PolicyTestIamPermissionsResponse

property transport: google.cloud.kms_v1.services.key_management_service.transports.base.KeyManagementServiceTransport¶

Returns the transport used by the client instance.

Returns: The transport used by the client instance.
Return type: KeyManagementServiceTransport

property universe_domain: str¶

Return the universe domain used by the client instance.

Returns

The universe domain used: by the client instance.

Return type

str

async update_crypto_key(request: Optional[Union[google.cloud.kms_v1.types.service.UpdateCryptoKeyRequest, dict]] = None, *, crypto_key: Optional[google.cloud.kms_v1.types.resources.CryptoKey] = None, update_mask: Optional[google.protobuf.field_mask_pb2.FieldMask] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKey[source]¶

Update a [CryptoKey][google.cloud.kms.v1.CryptoKey].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_update_crypto_key():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.UpdateCryptoKeyRequest(
    )

    # Make the request
    response = await client.update_crypto_key(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.UpdateCryptoKeyRequest, dict]]) – The request object. Request message for [KeyManagementService.UpdateCryptoKey][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKey].
crypto_key (google.cloud.kms_v1.types.CryptoKey) –
Required. [CryptoKey][google.cloud.kms.v1.CryptoKey] with updated values.

This corresponds to the crypto_key field on the request instance; if request is provided, this should not be set.
update_mask (google.protobuf.field_mask_pb2.FieldMask) –
Required. List of fields to be updated in this request.

This corresponds to the update_mask field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that

can be used for cryptographic operations.

A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of zero or more [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual key material used in cryptographic operations.

Return type

async update_crypto_key_primary_version(request: Optional[Union[google.cloud.kms_v1.types.service.UpdateCryptoKeyPrimaryVersionRequest, dict]] = None, *, name: Optional[str] = None, crypto_key_version_id: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKey[source]¶

Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].

Returns an error if called on a key whose purpose is not [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_update_crypto_key_primary_version():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.UpdateCryptoKeyPrimaryVersionRequest(
        name="name_value",
        crypto_key_version_id="crypto_key_version_id_value",
    )

    # Make the request
    response = await client.update_crypto_key_primary_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.UpdateCryptoKeyPrimaryVersionRequest, dict]]) – The request object. Request message for [KeyManagementService.UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion].
name (str) –
Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to update.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
crypto_key_version_id (str) –
Required. The id of the child [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary.

This corresponds to the crypto_key_version_id field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that

can be used for cryptographic operations.

A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of zero or more [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual key material used in cryptographic operations.

Return type

async update_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.UpdateCryptoKeyVersionRequest, dict]] = None, *, crypto_key_version: Optional[google.cloud.kms_v1.types.resources.CryptoKeyVersion] = None, update_mask: Optional[google.protobuf.field_mask_pb2.FieldMask] = None, retry: Optional[Union[google.api_core.retry.retry_unary_async.AsyncRetry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Update a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]’s metadata.

[state][google.cloud.kms.v1.CryptoKeyVersion.state] may be changed between [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] and [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] using this method. See [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion] and [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] to move between other states.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

async def sample_update_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceAsyncClient()

    # Initialize request argument(s)
    request = kms_v1.UpdateCryptoKeyVersionRequest(
    )

    # Make the request
    response = await client.update_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Optional[Union[google.cloud.kms_v1.types.UpdateCryptoKeyVersionRequest, dict]]) – The request object. Request message for [KeyManagementService.UpdateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyVersion].
crypto_key_version (google.cloud.kms_v1.types.CryptoKeyVersion) –
Required. [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with updated values.

This corresponds to the crypto_key_version field on the request instance; if request is provided, this should not be set.
update_mask (google.protobuf.field_mask_pb2.FieldMask) –
Required. List of fields to be updated in this request.

This corresponds to the update_mask field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry_async.AsyncRetry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

google.cloud.kms_v1.types.AsymmetricDecryptResponse

class google.cloud.kms_v1.services.key_management_service.KeyManagementServiceClient(*, credentials: typing.Optional[google.auth.credentials.Credentials] = None, transport: typing.Optional[typing.Union[str, google.cloud.kms_v1.services.key_management_service.transports.base.KeyManagementServiceTransport, typing.Callable[[...], google.cloud.kms_v1.services.key_management_service.transports.base.KeyManagementServiceTransport]]] = None, client_options: typing.Optional[typing.Union[google.api_core.client_options.ClientOptions, dict]] = None, client_info: google.api_core.gapic_v1.client_info.ClientInfo = <google.api_core.gapic_v1.client_info.ClientInfo object>)[source]¶

Google Cloud Key Management Service

Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

[KeyRing][google.cloud.kms.v1.KeyRing]
[CryptoKey][google.cloud.kms.v1.CryptoKey]
[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
[ImportJob][google.cloud.kms.v1.ImportJob]

If you are using manual gRPC libraries, see Using gRPC with Cloud KMS.

Instantiates the key management service client.

Parameters

credentials (Optional[google.auth.credentials.Credentials]) – The authorization credentials to attach to requests. These credentials identify the application to the service; if none are specified, the client will attempt to ascertain the credentials from the environment.
transport (Optional[Union[str,KeyManagementServiceTransport,Callable[..., KeyManagementServiceTransport]]]) – The transport to use, or a Callable that constructs and returns a new transport. If a Callable is given, it will be called with the same set of initialization arguments as used in the KeyManagementServiceTransport constructor. If set to None, a transport is chosen automatically.
client_options (Optional[Union[google.api_core.client_options.ClientOptions, dict]]) –
Custom options for the client.

1. The api_endpoint property can be used to override the default endpoint provided by the client when transport is not explicitly provided. Only if this property is not set and transport was not explicitly provided, the endpoint is determined by the GOOGLE_API_USE_MTLS_ENDPOINT environment variable, which have one of the following values: “always” (always use the default mTLS endpoint), “never” (always use the default regular endpoint) and “auto” (auto-switch to the default mTLS endpoint if client certificate is present; this is the default value).

2. If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is “true”, then the client_cert_source property can be used to provide a client certificate for mTLS transport. If not provided, the default SSL client certificate will be used if present. If GOOGLE_API_USE_CLIENT_CERTIFICATE is “false” or not set, no client certificate will be used.

3. The universe_domain property can be used to override the default “googleapis.com” universe. Note that the api_endpoint property still takes precedence; and universe_domain is currently not supported for mTLS.
client_info (google.api_core.gapic_v1.client_info.ClientInfo) – The client info used to send a user-agent string along with API requests. If None, then default info will be used. Generally, you only need to set this if you’re developing your own client library.

Raises

google.auth.exceptions.MutualTLSChannelError – If mutual TLS transport creation failed for any reason.

__exit__(type, value, traceback)[source]¶: Releases underlying transport’s resources.

Warning

ONLY use as a context manager if the transport is NOT shared with other clients! Exiting the with block will CLOSE the transport and may cause errors in other clients!

property api_endpoint¶

Return the API endpoint used by the client instance.

Returns: The API endpoint used by the client instance.
Return type: str

asymmetric_decrypt(request: Optional[Union[google.cloud.kms_v1.types.service.AsymmetricDecryptRequest, dict]] = None, *, name: Optional[str] = None, ciphertext: Optional[bytes] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.AsymmetricDecryptResponse[source]¶

Decrypts data that was encrypted with a public key retrieved from [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] corresponding to a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_DECRYPT.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_asymmetric_decrypt():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.AsymmetricDecryptRequest(
        name="name_value",
        ciphertext=b'ciphertext_blob',
    )

    # Make the request
    response = client.asymmetric_decrypt(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.AsymmetricDecryptRequest, dict]) – The request object. Request message for [KeyManagementService.AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for decryption.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
ciphertext (bytes) –
Required. The data encrypted with the named [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]’s public key using OAEP.

This corresponds to the ciphertext field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt].

Return type

asymmetric_sign(request: Optional[Union[google.cloud.kms_v1.types.service.AsymmetricSignRequest, dict]] = None, *, name: Optional[str] = None, digest: Optional[google.cloud.kms_v1.types.service.Digest] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.AsymmetricSignResponse[source]¶

Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_SIGN, producing a signature that can be verified with the public key retrieved from [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_asymmetric_sign():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.AsymmetricSignRequest(
        name="name_value",
    )

    # Make the request
    response = client.asymmetric_sign(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.AsymmetricSignRequest, dict]) – The request object. Request message for [KeyManagementService.AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
digest (google.cloud.kms_v1.types.Digest) –
Optional. The digest of the data to sign. The digest must be produced with the same digest algorithm as specified by the key version’s [algorithm][google.cloud.kms.v1.CryptoKeyVersion.algorithm].

This field may not be supplied if [AsymmetricSignRequest.data][google.cloud.kms.v1.AsymmetricSignRequest.data] is supplied.

This corresponds to the digest field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign].

Return type

google.cloud.kms_v1.types.AsymmetricSignResponse

static common_billing_account_path(billing_account: str) → str[source]¶: Returns a fully-qualified billing_account string.

static common_folder_path(folder: str) → str[source]¶: Returns a fully-qualified folder string.

static common_location_path(project: str, location: str) → str[source]¶: Returns a fully-qualified location string.

static common_organization_path(organization: str) → str[source]¶: Returns a fully-qualified organization string.

static common_project_path(project: str) → str[source]¶: Returns a fully-qualified project string.

create_crypto_key(request: Optional[Union[google.cloud.kms_v1.types.service.CreateCryptoKeyRequest, dict]] = None, *, parent: Optional[str] = None, crypto_key_id: Optional[str] = None, crypto_key: Optional[google.cloud.kms_v1.types.resources.CryptoKey] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKey[source]¶

Create a new [CryptoKey][google.cloud.kms.v1.CryptoKey] within a [KeyRing][google.cloud.kms.v1.KeyRing].

[CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] and [CryptoKey.version_template.algorithm][google.cloud.kms.v1.CryptoKeyVersionTemplate.algorithm] are required.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_create_crypto_key():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.CreateCryptoKeyRequest(
        parent="parent_value",
        crypto_key_id="crypto_key_id_value",
    )

    # Make the request
    response = client.create_crypto_key(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.CreateCryptoKeyRequest, dict]) – The request object. Request message for [KeyManagementService.CreateCryptoKey][google.cloud.kms.v1.KeyManagementService.CreateCryptoKey].
parent (str) –
Required. The [name][google.cloud.kms.v1.KeyRing.name] of the KeyRing associated with the [CryptoKeys][google.cloud.kms.v1.CryptoKey].

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
crypto_key_id (str) –
Required. It must be unique within a KeyRing and match the regular expression [a-zA-Z0-9_-]{1,63}

This corresponds to the crypto_key_id field on the request instance; if request is provided, this should not be set.
crypto_key (google.cloud.kms_v1.types.CryptoKey) –
Required. A [CryptoKey][google.cloud.kms.v1.CryptoKey] with initial field values.

This corresponds to the crypto_key field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that

can be used for cryptographic operations.

A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of zero or more [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual key material used in cryptographic operations.

Return type

create_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.CreateCryptoKeyVersionRequest, dict]] = None, *, parent: Optional[str] = None, crypto_key_version: Optional[google.cloud.kms_v1.types.resources.CryptoKeyVersion] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Create a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in a [CryptoKey][google.cloud.kms.v1.CryptoKey].

The server will assign the next sequential id. If unset, [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_create_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.CreateCryptoKeyVersionRequest(
        parent="parent_value",
    )

    # Make the request
    response = client.create_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.CreateCryptoKeyVersionRequest, dict]) – The request object. Request message for [KeyManagementService.CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion].
parent (str) –
Required. The [name][google.cloud.kms.v1.CryptoKey.name] of the [CryptoKey][google.cloud.kms.v1.CryptoKey] associated with the [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion].

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
crypto_key_version (google.cloud.kms_v1.types.CryptoKeyVersion) –
Required. A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with initial field values.

This corresponds to the crypto_key_version field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

create_import_job(request: Optional[Union[google.cloud.kms_v1.types.service.CreateImportJobRequest, dict]] = None, *, parent: Optional[str] = None, import_job_id: Optional[str] = None, import_job: Optional[google.cloud.kms_v1.types.resources.ImportJob] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.ImportJob[source]¶

Create a new [ImportJob][google.cloud.kms.v1.ImportJob] within a [KeyRing][google.cloud.kms.v1.KeyRing].

[ImportJob.import_method][google.cloud.kms.v1.ImportJob.import_method] is required.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_create_import_job():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    import_job = kms_v1.ImportJob()
    import_job.import_method = "RSA_OAEP_4096_SHA256"
    import_job.protection_level = "EXTERNAL_VPC"

    request = kms_v1.CreateImportJobRequest(
        parent="parent_value",
        import_job_id="import_job_id_value",
        import_job=import_job,
    )

    # Make the request
    response = client.create_import_job(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.CreateImportJobRequest, dict]) – The request object. Request message for [KeyManagementService.CreateImportJob][google.cloud.kms.v1.KeyManagementService.CreateImportJob].
parent (str) –
Required. The [name][google.cloud.kms.v1.KeyRing.name] of the [KeyRing][google.cloud.kms.v1.KeyRing] associated with the [ImportJobs][google.cloud.kms.v1.ImportJob].

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
import_job_id (str) –
Required. It must be unique within a KeyRing and match the regular expression [a-zA-Z0-9_-]{1,63}

This corresponds to the import_job_id field on the request instance; if request is provided, this should not be set.
import_job (google.cloud.kms_v1.types.ImportJob) –
Required. An [ImportJob][google.cloud.kms.v1.ImportJob] with initial field values.

This corresponds to the import_job field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

An [ImportJob][google.cloud.kms.v1.ImportJob] can be used to create

[CryptoKeys][google.cloud.kms.v1.CryptoKey] and [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] using pre-existing key material, generated outside of Cloud KMS.

When an [ImportJob][google.cloud.kms.v1.ImportJob] is created, Cloud KMS will generate a “wrapping key”, which is a public/private key pair. You use the wrapping key to encrypt (also known as wrap) the pre-existing key material to protect it during the import process. The nature of the wrapping key depends on the choice of [import_method][google.cloud.kms.v1.ImportJob.import_method]. When the wrapping key generation is complete, the [state][google.cloud.kms.v1.ImportJob.state] will be set to [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE] and the [public_key][google.cloud.kms.v1.ImportJob.public_key] can be fetched. The fetched public key can then be used to wrap your pre-existing key material.

Once the key material is wrapped, it can be imported into a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in an existing [CryptoKey][google.cloud.kms.v1.CryptoKey] by calling [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]. Multiple [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] can be imported with a single [ImportJob][google.cloud.kms.v1.ImportJob]. Cloud KMS uses the private key portion of the wrapping key to unwrap the key material. Only Cloud KMS has access to the private key.

An [ImportJob][google.cloud.kms.v1.ImportJob] expires 3 days after it is created. Once expired, Cloud KMS will no longer be able to import or unwrap any key material that was wrapped with the [ImportJob][google.cloud.kms.v1.ImportJob]’s public key.

For more information, see [Importing a key](https://cloud.google.com/kms/docs/importing-a-key).

Return type

create_key_ring(request: Optional[Union[google.cloud.kms_v1.types.service.CreateKeyRingRequest, dict]] = None, *, parent: Optional[str] = None, key_ring_id: Optional[str] = None, key_ring: Optional[google.cloud.kms_v1.types.resources.KeyRing] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.KeyRing[source]¶

Create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and Location.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_create_key_ring():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.CreateKeyRingRequest(
        parent="parent_value",
        key_ring_id="key_ring_id_value",
    )

    # Make the request
    response = client.create_key_ring(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.CreateKeyRingRequest, dict]) – The request object. Request message for [KeyManagementService.CreateKeyRing][google.cloud.kms.v1.KeyManagementService.CreateKeyRing].
parent (str) –
Required. The resource name of the location associated with the [KeyRings][google.cloud.kms.v1.KeyRing], in the format projects/*/locations/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
key_ring_id (str) –
Required. It must be unique within a location and match the regular expression [a-zA-Z0-9_-]{1,63}

This corresponds to the key_ring_id field on the request instance; if request is provided, this should not be set.
key_ring (google.cloud.kms_v1.types.KeyRing) –
Required. A [KeyRing][google.cloud.kms.v1.KeyRing] with initial field values.

This corresponds to the key_ring field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of: [CryptoKeys][google.cloud.kms.v1.CryptoKey].

Return type

google.cloud.kms_v1.types.DecryptResponse

static crypto_key_path(project: str, location: str, key_ring: str, crypto_key: str) → str[source]¶: Returns a fully-qualified crypto_key string.

static crypto_key_version_path(project: str, location: str, key_ring: str, crypto_key: str, crypto_key_version: str) → str[source]¶: Returns a fully-qualified crypto_key_version string.

decrypt(request: Optional[Union[google.cloud.kms_v1.types.service.DecryptRequest, dict]] = None, *, name: Optional[str] = None, ciphertext: Optional[bytes] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.DecryptResponse[source]¶

Decrypts data that was protected by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_decrypt():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.DecryptRequest(
        name="name_value",
        ciphertext=b'ciphertext_blob',
    )

    # Make the request
    response = client.decrypt(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.DecryptRequest, dict]) – The request object. Request message for [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].
name (str) –
Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to use for decryption. The server will choose the appropriate version.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
ciphertext (bytes) –
Required. The encrypted data originally returned in [EncryptResponse.ciphertext][google.cloud.kms.v1.EncryptResponse.ciphertext].

This corresponds to the ciphertext field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].

Return type

destroy_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.DestroyCryptoKeyVersionRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.

Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED], and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to the time [destroy_scheduled_duration][google.cloud.kms.v1.CryptoKey.destroy_scheduled_duration] in the future. At that time, the [state][google.cloud.kms.v1.CryptoKeyVersion.state] will automatically change to [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key material will be irrevocably destroyed.

Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached, [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_destroy_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.DestroyCryptoKeyVersionRequest(
        name="name_value",
    )

    # Make the request
    response = client.destroy_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.DestroyCryptoKeyVersionRequest, dict]) – The request object. Request message for [KeyManagementService.DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to destroy.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

google.cloud.kms_v1.types.EncryptResponse

encrypt(request: Optional[Union[google.cloud.kms_v1.types.service.EncryptRequest, dict]] = None, *, name: Optional[str] = None, plaintext: Optional[bytes] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.EncryptResponse[source]¶

Encrypts data, so that it can only be recovered by a call to [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_encrypt():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.EncryptRequest(
        name="name_value",
        plaintext=b'plaintext_blob',
    )

    # Make the request
    response = client.encrypt(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.EncryptRequest, dict]) – The request object. Request message for [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
name (str) –
Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] or [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for encryption.

If a [CryptoKey][google.cloud.kms.v1.CryptoKey] is specified, the server will use its [primary version][google.cloud.kms.v1.CryptoKey.primary].

This corresponds to the name field on the request instance; if request is provided, this should not be set.
plaintext (bytes) –
Required. The data to encrypt. Must be no larger than 64KiB.

The maximum size depends on the key version’s [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]. For [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE], [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL], and [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC] keys, the plaintext must be no larger than 64KiB. For [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] keys, the combined length of the plaintext and additional_authenticated_data fields must be no larger than 8KiB.

This corresponds to the plaintext field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].

Return type

classmethod from_service_account_file(filename: str, *args, **kwargs)[source]¶

Creates an instance of this client using the provided credentials: file.

Parameters

filename (str) – The path to the service account private key json file.
args – Additional arguments to pass to the constructor.
kwargs – Additional arguments to pass to the constructor.

Returns

The constructed client.

Return type

KeyManagementServiceClient

classmethod from_service_account_info(info: dict, *args, **kwargs)[source]¶

Creates an instance of this client using the provided credentials: info.

Parameters

info (dict) – The service account private key info.
args – Additional arguments to pass to the constructor.
kwargs – Additional arguments to pass to the constructor.

Returns

The constructed client.

Return type

KeyManagementServiceClient

classmethod from_service_account_json(filename: str, *args, **kwargs)¶

Creates an instance of this client using the provided credentials: file.

Parameters

filename (str) – The path to the service account private key json file.
args – Additional arguments to pass to the constructor.
kwargs – Additional arguments to pass to the constructor.

Returns

The constructed client.

Return type

KeyManagementServiceClient

generate_random_bytes(request: Optional[Union[google.cloud.kms_v1.types.service.GenerateRandomBytesRequest, dict]] = None, *, location: Optional[str] = None, length_bytes: Optional[int] = None, protection_level: Optional[google.cloud.kms_v1.types.resources.ProtectionLevel] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.GenerateRandomBytesResponse[source]¶

Generate random bytes using the Cloud KMS randomness source in the provided location.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_generate_random_bytes():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.GenerateRandomBytesRequest(
    )

    # Make the request
    response = client.generate_random_bytes(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.GenerateRandomBytesRequest, dict]) – The request object. Request message for [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].
location (str) –
The project-specific location in which to generate random bytes. For example, “projects/my-project/locations/us-central1”.

This corresponds to the location field on the request instance; if request is provided, this should not be set.
length_bytes (int) –
The length in bytes of the amount of randomness to retrieve. Minimum 8 bytes, maximum 1024 bytes.

This corresponds to the length_bytes field on the request instance; if request is provided, this should not be set.
protection_level (google.cloud.kms_v1.types.ProtectionLevel) –
The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when generating the random data. Currently, only [HSM][google.cloud.kms.v1.ProtectionLevel.HSM] protection level is supported.

This corresponds to the protection_level field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.GenerateRandomBytes][google.cloud.kms.v1.KeyManagementService.GenerateRandomBytes].

Return type

google.cloud.kms_v1.types.GenerateRandomBytesResponse

get_crypto_key(request: Optional[Union[google.cloud.kms_v1.types.service.GetCryptoKeyRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKey[source]¶

Returns metadata for a given [CryptoKey][google.cloud.kms.v1.CryptoKey], as well as its [primary][google.cloud.kms.v1.CryptoKey.primary] [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_get_crypto_key():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.GetCryptoKeyRequest(
        name="name_value",
    )

    # Make the request
    response = client.get_crypto_key(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.GetCryptoKeyRequest, dict]) – The request object. Request message for [KeyManagementService.GetCryptoKey][google.cloud.kms.v1.KeyManagementService.GetCryptoKey].
name (str) –
Required. The [name][google.cloud.kms.v1.CryptoKey.name] of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that

can be used for cryptographic operations.

A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of zero or more [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual key material used in cryptographic operations.

Return type

get_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.GetCryptoKeyVersionRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Returns metadata for a given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_get_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.GetCryptoKeyVersionRequest(
        name="name_value",
    )

    # Make the request
    response = client.get_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.GetCryptoKeyVersionRequest, dict]) – The request object. Request message for [KeyManagementService.GetCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.GetCryptoKeyVersion].
name (str) –
Required. The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

get_iam_policy(request: Optional[google.iam.v1.iam_policy_pb2.GetIamPolicyRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.iam.v1.policy_pb2.Policy[source]¶

Gets the IAM access control policy for a function.

Returns an empty policy if the function exists and does not have a policy set.

Parameters

request (GetIamPolicyRequest) – The request object. Request message for GetIamPolicy method.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions (defined by IAM or configured by users). A binding can optionally specify a condition, which is a logic expression that further constrains the role binding based on attributes about the request and/or target resource.

JSON Example

{
  "bindings": [
    {
      "role": "roles/resourcemanager.organizationAdmin",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-project-id@appspot.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/resourcemanager.organizationViewer",
      "members": ["user:eve@example.com"],
      "condition": {
        "title": "expirable access",
        "description": "Does not grant access after Sep 2020",
        "expression": "request.time <
        timestamp('2020-10-01T00:00:00.000Z')",
      }
    }
  ]
}

YAML Example

bindings:
- members:
  - user:mike@example.com
  - group:admins@example.com
  - domain:google.com
  - serviceAccount:my-project-id@appspot.gserviceaccount.com
  role: roles/resourcemanager.organizationAdmin
- members:
  - user:eve@example.com
  role: roles/resourcemanager.organizationViewer
  condition:
    title: expirable access
    description: Does not grant access after Sep 2020
    expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

For a description of IAM and its features, see the IAM developer’s guide.

Return type

Policy

get_import_job(request: Optional[Union[google.cloud.kms_v1.types.service.GetImportJobRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.ImportJob[source]¶

Returns metadata for a given [ImportJob][google.cloud.kms.v1.ImportJob].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_get_import_job():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.GetImportJobRequest(
        name="name_value",
    )

    # Make the request
    response = client.get_import_job(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.GetImportJobRequest, dict]) – The request object. Request message for [KeyManagementService.GetImportJob][google.cloud.kms.v1.KeyManagementService.GetImportJob].
name (str) –
Required. The [name][google.cloud.kms.v1.ImportJob.name] of the [ImportJob][google.cloud.kms.v1.ImportJob] to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

An [ImportJob][google.cloud.kms.v1.ImportJob] can be used to create

[CryptoKeys][google.cloud.kms.v1.CryptoKey] and [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] using pre-existing key material, generated outside of Cloud KMS.

When an [ImportJob][google.cloud.kms.v1.ImportJob] is created, Cloud KMS will generate a “wrapping key”, which is a public/private key pair. You use the wrapping key to encrypt (also known as wrap) the pre-existing key material to protect it during the import process. The nature of the wrapping key depends on the choice of [import_method][google.cloud.kms.v1.ImportJob.import_method]. When the wrapping key generation is complete, the [state][google.cloud.kms.v1.ImportJob.state] will be set to [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE] and the [public_key][google.cloud.kms.v1.ImportJob.public_key] can be fetched. The fetched public key can then be used to wrap your pre-existing key material.

Once the key material is wrapped, it can be imported into a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in an existing [CryptoKey][google.cloud.kms.v1.CryptoKey] by calling [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion]. Multiple [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] can be imported with a single [ImportJob][google.cloud.kms.v1.ImportJob]. Cloud KMS uses the private key portion of the wrapping key to unwrap the key material. Only Cloud KMS has access to the private key.

An [ImportJob][google.cloud.kms.v1.ImportJob] expires 3 days after it is created. Once expired, Cloud KMS will no longer be able to import or unwrap any key material that was wrapped with the [ImportJob][google.cloud.kms.v1.ImportJob]’s public key.

For more information, see [Importing a key](https://cloud.google.com/kms/docs/importing-a-key).

Return type

get_key_ring(request: Optional[Union[google.cloud.kms_v1.types.service.GetKeyRingRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.KeyRing[source]¶

Returns metadata for a given [KeyRing][google.cloud.kms.v1.KeyRing].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_get_key_ring():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.GetKeyRingRequest(
        name="name_value",
    )

    # Make the request
    response = client.get_key_ring(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.GetKeyRingRequest, dict]) – The request object. Request message for [KeyManagementService.GetKeyRing][google.cloud.kms.v1.KeyManagementService.GetKeyRing].
name (str) –
Required. The [name][google.cloud.kms.v1.KeyRing.name] of the [KeyRing][google.cloud.kms.v1.KeyRing] to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of: [CryptoKeys][google.cloud.kms.v1.CryptoKey].

Return type

google.cloud.kms_v1.types.PublicKey

get_location(request: Optional[google.cloud.location.locations_pb2.GetLocationRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.location.locations_pb2.Location[source]¶

Gets information about a location.

Parameters

request (GetLocationRequest) – The request object. Request message for GetLocation method.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Location object.

Return type

Location

classmethod get_mtls_endpoint_and_cert_source(client_options: Optional[google.api_core.client_options.ClientOptions] = None)[source]¶

Deprecated. Return the API endpoint and client cert source for mutual TLS.

The client cert source is determined in the following order: (1) if GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is not “true”, the client cert source is None. (2) if client_options.client_cert_source is provided, use the provided one; if the default client cert source exists, use the default one; otherwise the client cert source is None.

The API endpoint is determined in the following order: (1) if client_options.api_endpoint if provided, use the provided one. (2) if GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is “always”, use the default mTLS endpoint; if the environment variable is “never”, use the default API endpoint; otherwise if client cert source exists, use the default mTLS endpoint, otherwise use the default API endpoint.

More details can be found at https://google.aip.dev/auth/4114.

Parameters

client_options (google.api_core.client_options.ClientOptions) – Custom options for the client. Only the api_endpoint and client_cert_source properties may be used in this method.

Returns

returns the API endpoint and the: client cert source to use.

Return type

Tuple[str, Callable[[], Tuple[bytes, bytes]]]

Raises

google.auth.exceptions.MutualTLSChannelError – If any errors happen.

get_operation(request: Optional[google.longrunning.operations_pb2.GetOperationRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.longrunning.operations_pb2.Operation[source]¶

Gets the latest state of a long-running operation.

Parameters

request (GetOperationRequest) – The request object. Request message for GetOperation method.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

An Operation object.

Return type

Operation

get_public_key(request: Optional[Union[google.cloud.kms_v1.types.service.GetPublicKeyRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.PublicKey[source]¶

Returns the public key for the given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN] or [ASYMMETRIC_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_get_public_key():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.GetPublicKeyRequest(
        name="name_value",
    )

    # Make the request
    response = client.get_public_key(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.GetPublicKeyRequest, dict]) – The request object. Request message for [KeyManagementService.GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
name (str) –
Required. The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key to get.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

The public keys for a given: [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained via [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].

Return type

import_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.ImportCryptoKeyVersionRequest, dict]] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Import wrapped key material into a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].

All requests must specify a [CryptoKey][google.cloud.kms.v1.CryptoKey]. If a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] is additionally specified in the request, key material will be reimported into that version. Otherwise, a new version will be created, and will be assigned the next sequential id within the [CryptoKey][google.cloud.kms.v1.CryptoKey].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_import_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.ImportCryptoKeyVersionRequest(
        rsa_aes_wrapped_key=b'rsa_aes_wrapped_key_blob',
        parent="parent_value",
        algorithm="EXTERNAL_SYMMETRIC_ENCRYPTION",
        import_job="import_job_value",
    )

    # Make the request
    response = client.import_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.ImportCryptoKeyVersionRequest, dict]) – The request object. Request message for [KeyManagementService.ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion].
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

google.cloud.kms_v1.services.key_management_service.pagers.ListCryptoKeyVersionsPager

static import_job_path(project: str, location: str, key_ring: str, import_job: str) → str[source]¶: Returns a fully-qualified import_job string.

static key_ring_path(project: str, location: str, key_ring: str) → str[source]¶: Returns a fully-qualified key_ring string.

list_crypto_key_versions(request: Optional[Union[google.cloud.kms_v1.types.service.ListCryptoKeyVersionsRequest, dict]] = None, *, parent: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.services.key_management_service.pagers.ListCryptoKeyVersionsPager[source]¶

Lists [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_list_crypto_key_versions():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.ListCryptoKeyVersionsRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_crypto_key_versions(request=request)

    # Handle the response
    for response in page_result:
        print(response)

Parameters

request (Union[google.cloud.kms_v1.types.ListCryptoKeyVersionsRequest, dict]) – The request object. Request message for [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions].
parent (str) –
Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to list, in the format projects/*/locations/*/keyRings/*/cryptoKeys/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions].

Iterating over this object will yield results and resolve additional pages automatically.

Return type

list_crypto_keys(request: Optional[Union[google.cloud.kms_v1.types.service.ListCryptoKeysRequest, dict]] = None, *, parent: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.services.key_management_service.pagers.ListCryptoKeysPager[source]¶

Lists [CryptoKeys][google.cloud.kms.v1.CryptoKey].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_list_crypto_keys():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.ListCryptoKeysRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_crypto_keys(request=request)

    # Handle the response
    for response in page_result:
        print(response)

Parameters

request (Union[google.cloud.kms_v1.types.ListCryptoKeysRequest, dict]) – The request object. Request message for [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys].
parent (str) –
Required. The resource name of the [KeyRing][google.cloud.kms.v1.KeyRing] to list, in the format projects/*/locations/*/keyRings/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys].

Iterating over this object will yield results and resolve additional pages automatically.

Return type

google.cloud.kms_v1.services.key_management_service.pagers.ListCryptoKeysPager

list_import_jobs(request: Optional[Union[google.cloud.kms_v1.types.service.ListImportJobsRequest, dict]] = None, *, parent: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.services.key_management_service.pagers.ListImportJobsPager[source]¶

Lists [ImportJobs][google.cloud.kms.v1.ImportJob].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_list_import_jobs():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.ListImportJobsRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_import_jobs(request=request)

    # Handle the response
    for response in page_result:
        print(response)

Parameters

request (Union[google.cloud.kms_v1.types.ListImportJobsRequest, dict]) – The request object. Request message for [KeyManagementService.ListImportJobs][google.cloud.kms.v1.KeyManagementService.ListImportJobs].
parent (str) –
Required. The resource name of the [KeyRing][google.cloud.kms.v1.KeyRing] to list, in the format projects/*/locations/*/keyRings/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.ListImportJobs][google.cloud.kms.v1.KeyManagementService.ListImportJobs].

Iterating over this object will yield results and resolve additional pages automatically.

Return type

google.cloud.kms_v1.services.key_management_service.pagers.ListImportJobsPager

list_key_rings(request: Optional[Union[google.cloud.kms_v1.types.service.ListKeyRingsRequest, dict]] = None, *, parent: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.services.key_management_service.pagers.ListKeyRingsPager[source]¶

Lists [KeyRings][google.cloud.kms.v1.KeyRing].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_list_key_rings():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.ListKeyRingsRequest(
        parent="parent_value",
    )

    # Make the request
    page_result = client.list_key_rings(request=request)

    # Handle the response
    for response in page_result:
        print(response)

Parameters

request (Union[google.cloud.kms_v1.types.ListKeyRingsRequest, dict]) – The request object. Request message for [KeyManagementService.ListKeyRings][google.cloud.kms.v1.KeyManagementService.ListKeyRings].
parent (str) –
Required. The resource name of the location associated with the [KeyRings][google.cloud.kms.v1.KeyRing], in the format projects/*/locations/*.

This corresponds to the parent field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.ListKeyRings][google.cloud.kms.v1.KeyManagementService.ListKeyRings].

Iterating over this object will yield results and resolve additional pages automatically.

Return type

google.cloud.kms_v1.services.key_management_service.pagers.ListKeyRingsPager

list_locations(request: Optional[google.cloud.location.locations_pb2.ListLocationsRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.location.locations_pb2.ListLocationsResponse[source]¶

Lists information about the supported locations for this service.

Parameters

request (ListLocationsRequest) – The request object. Request message for ListLocations method.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for ListLocations method.

Return type

ListLocationsResponse

mac_sign(request: Optional[Union[google.cloud.kms_v1.types.service.MacSignRequest, dict]] = None, *, name: Optional[str] = None, data: Optional[bytes] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.MacSignResponse[source]¶

Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, producing a tag that can be verified by another source with the same key.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_mac_sign():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.MacSignRequest(
        name="name_value",
        data=b'data_blob',
    )

    # Make the request
    response = client.mac_sign(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.MacSignRequest, dict]) – The request object. Request message for [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for signing.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
data (bytes) –
Required. The data to sign. The MAC tag is computed over this data field based on the specific algorithm.

This corresponds to the data field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.MacSign][google.cloud.kms.v1.KeyManagementService.MacSign].

Return type

google.cloud.kms_v1.types.MacSignResponse

mac_verify(request: Optional[Union[google.cloud.kms_v1.types.service.MacVerifyRequest, dict]] = None, *, name: Optional[str] = None, data: Optional[bytes] = None, mac: Optional[bytes] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.MacVerifyResponse[source]¶

Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, and returns a response that indicates whether or not the verification was successful.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_mac_verify():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.MacVerifyRequest(
        name="name_value",
        data=b'data_blob',
        mac=b'mac_blob',
    )

    # Make the request
    response = client.mac_verify(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.MacVerifyRequest, dict]) – The request object. Request message for [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use for verification.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
data (bytes) –
Required. The data used previously as a [MacSignRequest.data][google.cloud.kms.v1.MacSignRequest.data] to generate the MAC tag.

This corresponds to the data field on the request instance; if request is provided, this should not be set.
mac (bytes) – Required. The signature to verify. This corresponds to the mac field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.MacVerify][google.cloud.kms.v1.KeyManagementService.MacVerify].

Return type

google.cloud.kms_v1.types.MacVerifyResponse

static parse_common_billing_account_path(path: str) → Dict[str, str][source]¶: Parse a billing_account path into its component segments.

static parse_common_folder_path(path: str) → Dict[str, str][source]¶: Parse a folder path into its component segments.

static parse_common_location_path(path: str) → Dict[str, str][source]¶: Parse a location path into its component segments.

static parse_common_organization_path(path: str) → Dict[str, str][source]¶: Parse a organization path into its component segments.

static parse_common_project_path(path: str) → Dict[str, str][source]¶: Parse a project path into its component segments.

static parse_crypto_key_path(path: str) → Dict[str, str][source]¶: Parses a crypto_key path into its component segments.

static parse_crypto_key_version_path(path: str) → Dict[str, str][source]¶: Parses a crypto_key_version path into its component segments.

static parse_import_job_path(path: str) → Dict[str, str][source]¶: Parses a import_job path into its component segments.

static parse_key_ring_path(path: str) → Dict[str, str][source]¶: Parses a key_ring path into its component segments.

static parse_public_key_path(path: str) → Dict[str, str][source]¶: Parses a public_key path into its component segments.

static public_key_path(project: str, location: str, key_ring: str, crypto_key: str, crypto_key_version: str) → str[source]¶: Returns a fully-qualified public_key string.

raw_decrypt(request: Optional[Union[google.cloud.kms_v1.types.service.RawDecryptRequest, dict]] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.RawDecryptResponse[source]¶

Decrypts data that was originally encrypted using a raw cryptographic mechanism. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [RAW_ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.RAW_ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_raw_decrypt():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.RawDecryptRequest(
        name="name_value",
        ciphertext=b'ciphertext_blob',
        initialization_vector=b'initialization_vector_blob',
    )

    # Make the request
    response = client.raw_decrypt(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.RawDecryptRequest, dict]) – The request object. Request message for [KeyManagementService.RawDecrypt][google.cloud.kms.v1.KeyManagementService.RawDecrypt].
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.RawDecrypt][google.cloud.kms.v1.KeyManagementService.RawDecrypt].

Return type

google.cloud.kms_v1.types.RawDecryptResponse

raw_encrypt(request: Optional[Union[google.cloud.kms_v1.types.service.RawEncryptRequest, dict]] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.service.RawEncryptResponse[source]¶

Encrypts data using portable cryptographic primitives. Most users should choose [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] and [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt] rather than their raw counterparts. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [RAW_ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.RAW_ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_raw_encrypt():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.RawEncryptRequest(
        name="name_value",
        plaintext=b'plaintext_blob',
    )

    # Make the request
    response = client.raw_encrypt(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.RawEncryptRequest, dict]) – The request object. Request message for [KeyManagementService.RawEncrypt][google.cloud.kms.v1.KeyManagementService.RawEncrypt].
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for: [KeyManagementService.RawEncrypt][google.cloud.kms.v1.KeyManagementService.RawEncrypt].

Return type

google.cloud.kms_v1.types.RawEncryptResponse

restore_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.RestoreCryptoKeyVersionRequest, dict]] = None, *, name: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED] state.

Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_restore_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.RestoreCryptoKeyVersionRequest(
        name="name_value",
    )

    # Make the request
    response = client.restore_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.RestoreCryptoKeyVersionRequest, dict]) – The request object. Request message for [KeyManagementService.RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion].
name (str) –
Required. The resource name of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to restore.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type

set_iam_policy(request: Optional[google.iam.v1.iam_policy_pb2.SetIamPolicyRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.iam.v1.policy_pb2.Policy[source]¶

Sets the IAM access control policy on the specified function.

Replaces any existing policy.

Parameters

request (SetIamPolicyRequest) – The request object. Request message for SetIamPolicy method.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Defines an Identity and Access Management (IAM) policy. It is used to specify access control policies for Cloud Platform resources. A Policy is a collection of bindings. A binding binds one or more members to a single role. Members can be user accounts, service accounts, Google groups, and domains (such as G Suite). A role is a named list of permissions (defined by IAM or configured by users). A binding can optionally specify a condition, which is a logic expression that further constrains the role binding based on attributes about the request and/or target resource.

JSON Example

{
  "bindings": [
    {
      "role": "roles/resourcemanager.organizationAdmin",
      "members": [
        "user:mike@example.com",
        "group:admins@example.com",
        "domain:google.com",
        "serviceAccount:my-project-id@appspot.gserviceaccount.com"
      ]
    },
    {
      "role": "roles/resourcemanager.organizationViewer",
      "members": ["user:eve@example.com"],
      "condition": {
        "title": "expirable access",
        "description": "Does not grant access after Sep 2020",
        "expression": "request.time <
        timestamp('2020-10-01T00:00:00.000Z')",
      }
    }
  ]
}

YAML Example

bindings:
- members:
  - user:mike@example.com
  - group:admins@example.com
  - domain:google.com
  - serviceAccount:my-project-id@appspot.gserviceaccount.com
  role: roles/resourcemanager.organizationAdmin
- members:
  - user:eve@example.com
  role: roles/resourcemanager.organizationViewer
  condition:
    title: expirable access
    description: Does not grant access after Sep 2020
    expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

For a description of IAM and its features, see the IAM developer’s guide.

Return type

Policy

test_iam_permissions(request: Optional[google.iam.v1.iam_policy_pb2.TestIamPermissionsRequest] = None, *, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.iam.v1.iam_policy_pb2.TestIamPermissionsResponse[source]¶

Tests the specified IAM permissions against the IAM access control: policy for a function.

If the function does not exist, this will return an empty set of permissions, not a NOT_FOUND error.

Parameters

request (TestIamPermissionsRequest) – The request object. Request message for TestIamPermissions method.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

Response message for TestIamPermissions method.

Return type

TestIamPermissionsResponse

property transport: google.cloud.kms_v1.services.key_management_service.transports.base.KeyManagementServiceTransport¶

Returns the transport used by the client instance.

Returns

The transport used by the client: instance.

Return type

KeyManagementServiceTransport

property universe_domain: str¶

Return the universe domain used by the client instance.

Returns: The universe domain used by the client instance.
Return type: str

update_crypto_key(request: Optional[Union[google.cloud.kms_v1.types.service.UpdateCryptoKeyRequest, dict]] = None, *, crypto_key: Optional[google.cloud.kms_v1.types.resources.CryptoKey] = None, update_mask: Optional[google.protobuf.field_mask_pb2.FieldMask] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKey[source]¶

Update a [CryptoKey][google.cloud.kms.v1.CryptoKey].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_update_crypto_key():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.UpdateCryptoKeyRequest(
    )

    # Make the request
    response = client.update_crypto_key(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.UpdateCryptoKeyRequest, dict]) – The request object. Request message for [KeyManagementService.UpdateCryptoKey][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKey].
crypto_key (google.cloud.kms_v1.types.CryptoKey) –
Required. [CryptoKey][google.cloud.kms.v1.CryptoKey] with updated values.

This corresponds to the crypto_key field on the request instance; if request is provided, this should not be set.
update_mask (google.protobuf.field_mask_pb2.FieldMask) –
Required. List of fields to be updated in this request.

This corresponds to the update_mask field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that

can be used for cryptographic operations.

A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of zero or more [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual key material used in cryptographic operations.

Return type

update_crypto_key_primary_version(request: Optional[Union[google.cloud.kms_v1.types.service.UpdateCryptoKeyPrimaryVersionRequest, dict]] = None, *, name: Optional[str] = None, crypto_key_version_id: Optional[str] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKey[source]¶

Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].

Returns an error if called on a key whose purpose is not [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_update_crypto_key_primary_version():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.UpdateCryptoKeyPrimaryVersionRequest(
        name="name_value",
        crypto_key_version_id="crypto_key_version_id_value",
    )

    # Make the request
    response = client.update_crypto_key_primary_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.UpdateCryptoKeyPrimaryVersionRequest, dict]) – The request object. Request message for [KeyManagementService.UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion].
name (str) –
Required. The resource name of the [CryptoKey][google.cloud.kms.v1.CryptoKey] to update.

This corresponds to the name field on the request instance; if request is provided, this should not be set.
crypto_key_version_id (str) –
Required. The id of the child [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as primary.

This corresponds to the crypto_key_version_id field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that

can be used for cryptographic operations.

A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of zero or more [versions][google.cloud.kms.v1.CryptoKeyVersion], which represent the actual key material used in cryptographic operations.

Return type

update_crypto_key_version(request: Optional[Union[google.cloud.kms_v1.types.service.UpdateCryptoKeyVersionRequest, dict]] = None, *, crypto_key_version: Optional[google.cloud.kms_v1.types.resources.CryptoKeyVersion] = None, update_mask: Optional[google.protobuf.field_mask_pb2.FieldMask] = None, retry: Optional[Union[google.api_core.retry.retry_unary.Retry, google.api_core.gapic_v1.method._MethodDefault]] = _MethodDefault._DEFAULT_VALUE, timeout: Union[float, object] = _MethodDefault._DEFAULT_VALUE, metadata: Sequence[Tuple[str, str]] = ()) → google.cloud.kms_v1.types.resources.CryptoKeyVersion[source]¶

Update a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]’s metadata.

[state][google.cloud.kms.v1.CryptoKeyVersion.state] may be changed between [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] and [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] using this method. See [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion] and [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] to move between other states.

# This snippet has been automatically generated and should be regarded as a
# code template only.
# It will require modifications to work:
# - It may require correct/in-range values for request initialization.
# - It may require specifying regional endpoints when creating the service
#   client as shown in:
#   https://googleapis.dev/python/google-api-core/latest/client_options.html
from google.cloud import kms_v1

def sample_update_crypto_key_version():
    # Create a client
    client = kms_v1.KeyManagementServiceClient()

    # Initialize request argument(s)
    request = kms_v1.UpdateCryptoKeyVersionRequest(
    )

    # Make the request
    response = client.update_crypto_key_version(request=request)

    # Handle the response
    print(response)

Parameters

request (Union[google.cloud.kms_v1.types.UpdateCryptoKeyVersionRequest, dict]) – The request object. Request message for [KeyManagementService.UpdateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyVersion].
crypto_key_version (google.cloud.kms_v1.types.CryptoKeyVersion) –
Required. [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with updated values.

This corresponds to the crypto_key_version field on the request instance; if request is provided, this should not be set.
update_mask (google.protobuf.field_mask_pb2.FieldMask) –
Required. List of fields to be updated in this request.

This corresponds to the update_mask field on the request instance; if request is provided, this should not be set.
retry (google.api_core.retry.Retry) – Designation of what errors, if any, should be retried.
timeout (float) – The timeout for this request.
metadata (Sequence[Tuple[str, str]]) – Strings which should be sent along with the request as metadata.

Returns

A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an

individual cryptographic key, and the associated key material.

An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be used for cryptographic operations.

For security reasons, the raw cryptographic key material represented by a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

Return type