Skip to content

Commit de50ec6

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add support for Coordinated External Keys
PiperOrigin-RevId: 514450927
1 parent 1e379f2 commit de50ec6

2 files changed

Lines changed: 153 additions & 0 deletions

File tree

‎google/cloud/kms/v1/ekm_service.proto‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,25 @@ service EkmService {
8383
};
8484
option (google.api.method_signature) = "ekm_connection,update_mask";
8585
}
86+
87+
// Returns the [EkmConfig][google.cloud.kms.v1.EkmConfig] singleton resource
88+
// for a given project and location.
89+
rpc GetEkmConfig(GetEkmConfigRequest) returns (EkmConfig) {
90+
option (google.api.http) = {
91+
get: "/v1/{name=projects/*/locations/*/ekmConfig}"
92+
};
93+
option (google.api.method_signature) = "name";
94+
}
95+
96+
// Updates the [EkmConfig][google.cloud.kms.v1.EkmConfig] singleton resource
97+
// for a given project and location.
98+
rpc UpdateEkmConfig(UpdateEkmConfigRequest) returns (EkmConfig) {
99+
option (google.api.http) = {
100+
patch: "/v1/{ekm_config.name=projects/*/locations/*/ekmConfig}"
101+
body: "ekm_config"
102+
};
103+
option (google.api.method_signature) = "ekm_config,update_mask";
104+
}
86105
}
87106

88107
// Request message for
@@ -187,6 +206,30 @@ message UpdateEkmConnectionRequest {
187206
[(google.api.field_behavior) = REQUIRED];
188207
}
189208

209+
// Request message for
210+
// [EkmService.GetEkmConfig][google.cloud.kms.v1.EkmService.GetEkmConfig].
211+
message GetEkmConfigRequest {
212+
// Required. The [name][google.cloud.kms.v1.EkmConfig.name] of the
213+
// [EkmConfig][google.cloud.kms.v1.EkmConfig] to get.
214+
string name = 1 [
215+
(google.api.field_behavior) = REQUIRED,
216+
(google.api.resource_reference) = {
217+
type: "cloudkms.googleapis.com/EkmConfig"
218+
}
219+
];
220+
}
221+
222+
// Request message for
223+
// [EkmService.UpdateEkmConfig][google.cloud.kms.v1.EkmService.UpdateEkmConfig].
224+
message UpdateEkmConfigRequest {
225+
// Required. [EkmConfig][google.cloud.kms.v1.EkmConfig] with updated values.
226+
EkmConfig ekm_config = 1 [(google.api.field_behavior) = REQUIRED];
227+
228+
// Required. List of fields to be updated in this request.
229+
google.protobuf.FieldMask update_mask = 2
230+
[(google.api.field_behavior) = REQUIRED];
231+
}
232+
190233
// A [Certificate][google.cloud.kms.v1.Certificate] represents an X.509
191234
// certificate used to authenticate HTTPS connections to EKM replicas.
192235
message Certificate {
@@ -274,6 +317,44 @@ message EkmConnection {
274317
[(google.api.field_behavior) = REQUIRED];
275318
}
276319

320+
// [KeyManagementMode][google.cloud.kms.v1.EkmConnection.KeyManagementMode]
321+
// describes who can perform control plane cryptographic operations using this
322+
// [EkmConnection][google.cloud.kms.v1.EkmConnection].
323+
enum KeyManagementMode {
324+
// Not specified.
325+
KEY_MANAGEMENT_MODE_UNSPECIFIED = 0;
326+
327+
// EKM-side key management operations on
328+
// [CryptoKeys][google.cloud.kms.v1.CryptoKey] created with this
329+
// [EkmConnection][google.cloud.kms.v1.EkmConnection] must be initiated from
330+
// the EKM directly and cannot be performed from Cloud KMS. This means that:
331+
// * When creating a
332+
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] associated with
333+
// this
334+
// [EkmConnection][google.cloud.kms.v1.EkmConnection], the caller must
335+
// supply the key path of pre-existing external key material that will be
336+
// linked to the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
337+
// * Destruction of external key material cannot be requested via the
338+
// Cloud KMS API and must be performed directly in the EKM.
339+
// * Automatic rotation of key material is not supported.
340+
MANUAL = 1;
341+
342+
// All [CryptoKeys][google.cloud.kms.v1.CryptoKey] created with this
343+
// [EkmConnection][google.cloud.kms.v1.EkmConnection] use EKM-side key
344+
// management operations initiated from Cloud KMS. This means that:
345+
// * When a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
346+
// associated with this [EkmConnection][google.cloud.kms.v1.EkmConnection]
347+
// is
348+
// created, the EKM automatically generates new key material and a new
349+
// key path. The caller cannot supply the key path of pre-existing
350+
// external key material.
351+
// * Destruction of external key material associated with this
352+
// [EkmConnection][google.cloud.kms.v1.EkmConnection] can be requested by
353+
// calling [DestroyCryptoKeyVersion][EkmService.DestroyCryptoKeyVersion].
354+
// * Automatic rotation of key material is supported.
355+
CLOUD_KMS = 2;
356+
}
357+
277358
// Output only. The resource name for the
278359
// [EkmConnection][google.cloud.kms.v1.EkmConnection] in the format
279360
// `projects/*/locations/*/ekmConnections/*`.
@@ -295,4 +376,46 @@ message EkmConnection {
295376
// Optional. Etag of the currently stored
296377
// [EkmConnection][google.cloud.kms.v1.EkmConnection].
297378
string etag = 5 [(google.api.field_behavior) = OPTIONAL];
379+
380+
// Optional. Describes who can perform control plane operations on the EKM. If
381+
// unset, this defaults to
382+
// [MANUAL][google.cloud.kms.v1.EkmConnection.KeyManagementMode.MANUAL].
383+
KeyManagementMode key_management_mode = 6
384+
[(google.api.field_behavior) = OPTIONAL];
385+
386+
// Optional. Identifies the EKM Crypto Space that this
387+
// [EkmConnection][google.cloud.kms.v1.EkmConnection] maps to. Note: This
388+
// field is required if
389+
// [KeyManagementMode][google.cloud.kms.v1.EkmConnection.KeyManagementMode] is
390+
// [CLOUD_KMS][google.cloud.kms.v1.EkmConnection.KeyManagementMode.CLOUD_KMS].
391+
string crypto_space_path = 7 [(google.api.field_behavior) = OPTIONAL];
392+
}
393+
394+
// An [EkmConfig][google.cloud.kms.v1.EkmConfig] is a singleton resource that
395+
// represents configuration parameters that apply to all
396+
// [CryptoKeys][google.cloud.kms.v1.CryptoKey] and
397+
// [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] with a
398+
// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
399+
// [EXTERNAL_VPC][CryptoKeyVersion.ProtectionLevel.EXTERNAL_VPC] in a given
400+
// project and location.
401+
message EkmConfig {
402+
option (google.api.resource) = {
403+
type: "cloudkms.googleapis.com/EkmConfig"
404+
pattern: "projects/{project}/locations/{location}/ekmConfig"
405+
};
406+
407+
// Output only. The resource name for the
408+
// [EkmConfig][google.cloud.kms.v1.EkmConfig] in the format
409+
// `projects/*/locations/*/ekmConfig`.
410+
string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
411+
412+
// Optional. Resource name of the default
413+
// [EkmConnection][google.cloud.kms.v1.EkmConnection]. Setting this field to
414+
// the empty string removes the default.
415+
string default_ekm_connection = 2 [
416+
(google.api.field_behavior) = OPTIONAL,
417+
(google.api.resource_reference) = {
418+
type: "cloudkms.googleapis.com/EkmConnection"
419+
}
420+
];
298421
}

‎google/cloud/kms/v1/resources.proto‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -473,6 +473,23 @@ message CryptoKeyVersion {
473473
// Additional details can be found in
474474
// [CryptoKeyVersion.import_failure_reason][google.cloud.kms.v1.CryptoKeyVersion.import_failure_reason].
475475
IMPORT_FAILED = 7;
476+
477+
// This version was not generated successfully. It may not be used, enabled,
478+
// disabled, or destroyed. Additional details can be found in
479+
// [CryptoKeyVersion.generation_failure_reason][google.cloud.kms.v1.CryptoKeyVersion.generation_failure_reason].
480+
GENERATION_FAILED = 8;
481+
482+
// This version was destroyed, and it may not be used or enabled again.
483+
// Cloud KMS is waiting for the corresponding key material residing in an
484+
// external key manager to be destroyed.
485+
PENDING_EXTERNAL_DESTRUCTION = 9;
486+
487+
// This version was destroyed, and it may not be used or enabled again.
488+
// However, Cloud KMS could not confirm that the corresponding key material
489+
// residing in an external key manager was destroyed. Additional details can
490+
// be found in
491+
// [CryptoKeyVersion.external_destruction_failure_reason][google.cloud.kms.v1.CryptoKeyVersion.external_destruction_failure_reason].
492+
EXTERNAL_DESTRUCTION_FAILED = 10;
476493
}
477494

478495
// A view for [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]s.
@@ -567,6 +584,19 @@ message CryptoKeyVersion {
567584
// [IMPORT_FAILED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.IMPORT_FAILED].
568585
string import_failure_reason = 16 [(google.api.field_behavior) = OUTPUT_ONLY];
569586

587+
// Output only. The root cause of the most recent generation failure. Only
588+
// present if [state][google.cloud.kms.v1.CryptoKeyVersion.state] is
589+
// [GENERATION_FAILED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.GENERATION_FAILED].
590+
string generation_failure_reason = 19
591+
[(google.api.field_behavior) = OUTPUT_ONLY];
592+
593+
// Output only. The root cause of the most recent external destruction
594+
// failure. Only present if
595+
// [state][google.cloud.kms.v1.CryptoKeyVersion.state] is
596+
// [EXTERNAL_DESTRUCTION_FAILED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.EXTERNAL_DESTRUCTION_FAILED].
597+
string external_destruction_failure_reason = 20
598+
[(google.api.field_behavior) = OUTPUT_ONLY];
599+
570600
// ExternalProtectionLevelOptions stores a group of additional fields for
571601
// configuring a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that
572602
// are specific to the

0 commit comments

Comments
 (0)