category: Network Security provider: Google commonfields: id: Google Key Management Service version: -1 configuration: - display: User's Service Account JSON name: service_account type: 4 hidden: true required: false - displaypassword: User's Service Account JSON name: credentials_service_account hiddenusername: true type: 9 required: false - display: Project in Google Cloud KMS name: project required: true type: 0 - defaultvalue: global display: Default Location name: location options: - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true type: 15 - display: Default Key Ring name: key_ring type: 0 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: Use the Google Key Management Service API for CryptoKey management and encrypt/decrypt functionality. display: Google Key Management Service name: Google Key Management Service script: commands: - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the created crypto-key. It must be unique within a KeyRing and match the regular expression [a-zA-Z0-9_-]{1,63}. name: crypto_key required: true - description: Labels with user-defined metadata. isArray: true name: labels - description: |- Date of the next scheduled rotation time. The Key Management Service automatically creates a new version of this CryptoKey and marks the new version as primary at the next rotation time. Key rotations performed manually through cryptoKeyVersions.create and cryptoKeys.updatePrimaryVersion do not affect nextRotationTime. Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted. A timestamp or a date in RFC3339 UTC "Zulu" format, accurate to nanoseconds. For example, "2014-10-02T15:01:23.045123456Z". If left empty, it is set in 90 days. name: next_rotation_time - description: The statement that was generated and signed by the HSM at the key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protectionLevel HSM. isArray: true name: attestation - auto: PREDEFINED defaultValue: ENABLED description: 'The state of a CryptoKeyVersion, indicating if it can be used. Can be: "CRYPTO_KEY_VERSION_STATE_UNSPECIFIED, "PENDING_GENERATION", "ENABLED", "DISABLED", "DESTROYED", "DESTROY_SCHEDULED" , "PENDING_IMPORT", " IMPORT_FAILED".' name: state predefined: - CRYPTO_KEY_VERSION_STATE_UNSPECIFIED - PENDING_GENERATION - ENABLED - DISABLED - DESTROYED - DESTROY_SCHEDULED - PENDING_IMPORT - IMPORT_FAILED - auto: PREDEFINED defaultValue: ENCRYPT_DECRYPT description: 'The cryptographic capabilities of a CryptoKey. A given key can only be used for the operations allowed by its purpose. Can be: "CRYPTO_KEY_PURPOSE_UNSPECIFIED", "ENCRYPT_DECRYPT", "ASYMMETRIC_SIGN", "ASYMMETRIC_DECRYPT".' name: purpose predefined: - CRYPTO_KEY_PURPOSE_UNSPECIFIED - ENCRYPT_DECRYPT - ASYMMETRIC_SIGN - ASYMMETRIC_DECRYPT required: true - defaultValue: '7776000' description: The time between when new key versions are generated automatically. Must be between 24 hours and 876,000 hours. Keys with ENCRYPT_DECRYPT purpose support automatic rotation. For other keys, this field must be omitted. A duration in seconds. name: rotation_period required: true - auto: PREDEFINED defaultValue: GOOGLE_SYMMETRIC_ENCRYPTION description: Algorithm to use when creating a CryptoKeyVersion based on this template. name: algorithm predefined: - CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED - GOOGLE_SYMMETRIC_ENCRYPTION - RSA_SIGN_PSS_2048_SHA256 - RSA_SIGN_PSS_3072_SHA256 - RSA_SIGN_PSS_4096_SHA256 - RSA_SIGN_PSS_4096_SHA512 - RSA_SIGN_PKCS1_2048_SHA256 - RSA_SIGN_PKCS1_3072_SHA256 - RSA_SIGN_PKCS1_4096_SHA256 - RSA_SIGN_PKCS1_4096_SHA512 - RSA_DECRYPT_OAEP_2048_SHA256 - RSA_DECRYPT_OAEP_3072_SHA256 - RSA_DECRYPT_OAEP_4096_SHA256 - RSA_DECRYPT_OAEP_4096_SHA512 - EC_SIGN_P256_SHA256 - EC_SIGN_P384_SHA384 - auto: PREDEFINED defaultValue: SOFTWARE description: 'Protections levels for cryptographic operations when creating a CryptoKeyVersion. Can be: Can be: "PROECTECTION_LEVEL_UNSPECIFIED", "SOFTWARE", "HSM". Default is "SOFTWARE".' name: protection_level predefined: - PROTECTION_LEVEL_UNSPECIFIED - SOFTWARE - HSM - auto: PREDEFINED defaultValue: 'false' description: Whether to create a CryptoKey without any CryptoKeyVersions. You have to create the CryptoKeyVersion to use this key. name: skip_initial_version_creation predefined: - 'true' - 'false' description: Creates a new CryptoKey within a KeyRing. name: google-kms-create-key outputs: - contextPath: GoogleKMS.CryptoKey.Name description: The resource name for this CryptoKey. type: String - contextPath: GoogleKMS.CryptoKey.Purpose description: The immutable purpose of this CryptoKey. type: String - contextPath: GoogleKMS.CryptoKey.CreationTime description: The time when this CryptoKey was created. type: String - contextPath: GoogleKMS.CryptoKey.NextRotationTime description: |- The date when the next scheduled rotation is due to run. At nextRotationTime, the Key Management Service automatically creates a new version of this CryptoKey and marks the new version as primary. type: Date - contextPath: GoogleKMS.CryptoKey.RotationPeriod description: The period for which the nextRotationTime is advanced, when the service automatically rotates a key. type: String - contextPath: GoogleKMS.CryptoKey.Labels description: Labels with user-defined metadata. type: String - contextPath: GoogleKMS.CryptoKey.VersionTemplate.ProtectionLevel description: The protection level describing how cryptographic operations are performed with this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.VersionTemplate.Algorithm description: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.Name description: The resource name for this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.State description: The current state of the CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.CreationTime description: The time when this CryptoKeyVersion was created. type: Date - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.ProtectionLevel description: The ProtectionLevel describing how cryptographic operations are performed with this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.Algorithm description: The algorithm in use in the primary CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.GenerateTime description: The time this CryptoKeyVersion's key material was generated. type: Date - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical region where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the crypto-key to use. name: crypto_key required: true - description: The ciphertext to decrypt to simple plain text. name: simple_ciphertext - description: |- A base64-encoded string passed to Cloud KMS as part of an encrypt or decrypt request. The optional data that must match the data originally supplied in the EncryptRequest.additional_authenticated_data. name: additional_authenticated_data - description: The ciphertext to decrypt to base64 plain text. name: base64_ciphertext - description: The entry ID for the file to decrypt. name: entry_id description: Decrypts data that was protected by Encrypt. name: google-kms-symmetric-decrypt outputs: - contextPath: GoogleKMS.SymmetricDecrypt.CryptoKey description: The CryptoKey in use. type: String - contextPath: GoogleKMS.SymmetricDecrypt.IsBase64 description: Whether the original plain text is in base64. type: Boolean - contextPath: GoogleKMS.SymmetricDecrypt.Plaintext description: The decrypted plaintext. type: String - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For example, https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the crypto-key to use. name: crypto_key required: true - description: Simple plain text to encrypt. Must be no larger than 64KiB. name: simple_plaintext - description: |- A base64-encoded string passed to Cloud KMS as part of an encrypt or decrypt request. Must also be provided during decryption through DecryptRequest.additional_authenticated_data. The maximum size depends on the key version's protection level. For SOFTWARE keys, the AAD must be no larger than 64KiB. For HSM keys, the combined length of the plain text and additionalAuthenticatedData fields must be no larger than 8KiB. name: additional_authenticated_data - description: The Base64 plain text to encrypt. name: base64_plaintext - description: The entry ID for the file to encrypt. name: entry_id description: Encrypts data, so it can only be recovered by a call to Decrypt. name: google-kms-symmetric-encrypt outputs: - contextPath: GoogleKMS.SymmetricEncrypt.CryptoKey description: The CryptoKey used. type: String - contextPath: GoogleKMS.SymmetricEncrypt.IsBase64 description: Whether the original plain text is in base 64. type: Boolean - contextPath: GoogleKMS.SymmetricEncrypt.Ciphertext description: The encrypted ciphertext. type: String - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For example, https://cloud.google.com/kms/docs/locations. Keyword 'default' sets the location to the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the fetched crypto-key. name: crypto_key required: true description: Returns metadata for a given CryptoKey, and its primary CryptoKeyVersion. name: google-kms-get-key outputs: - contextPath: GoogleKMS.CryptoKey.Name description: The resource name for this CryptoKey. type: String - contextPath: GoogleKMS.CryptoKey.Purpose description: The immutable purpose of this CryptoKey. type: String - contextPath: GoogleKMS.CryptoKey.CreationTime description: The time at which this CryptoKey was created. type: Date - contextPath: GoogleKMS.CryptoKey.NextRotationTime description: |- The date when the next scheduled rotation is due to run. At nextRotationTime, the Key Management Service automatically creates a new version of this CryptoKey and marks the new version as primary. type: Date - contextPath: GoogleKMS.CryptoKey.RotationPeriod description: The period for which the nextRotationTime is advanced, when the service automatically rotates a key. hours. type: String - contextPath: GoogleKMS.CryptoKey.Labels description: Labels with user-defined metadata. type: String - contextPath: GoogleKMS.CryptoKey.VersionTemplate.ProtectionLevel description: The ProtectionLevel describing how cryptographic operations are performed with this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.VersionTemplate.Algorithm description: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.Name description: The resource name for this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.State description: The current state of the CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.CreationTime description: The time at which this CryptoKeyVersion was created. type: Date - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.ProtectionLevel description: The ProtectionLevel describing how cryptographic operations are performed with this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.Algorithm description: The algorithm used in the primary CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.GenerateTime description: The time this CryptoKeyVersion's key material was generated. type: Date - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the updated crypto-key. name: crypto_key required: true - description: |- The date when the next scheduled rotation is due to run. At nextRotationTime, the Key Management Service automatically creates a new version of this CryptoKey and marks the new version as primary. Key rotations performed manually via cryptoKeyVersions.create and cryptoKeys.updatePrimaryVersion do not affect nextRotationTime. Keys with purpose ENCRYPT_DECRYPT, support automatic rotation. For other keys, this field must be omitted. A timestamp or a date in RFC3339 UTC "Zulu" format, accurate to nanoseconds. For example, "2014-10-02T15:01:23.045123456Z". name: next_rotation_time - description: Statement that was generated and signed by the HSM at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only provided for key versions with protectionLevel HSM. isArray: true name: attestation - auto: PREDEFINED description: 'The state of a CryptoKeyVersion, indicating if it can be used. Can be: "CRYPTO_KEY_VERSION_STATE_UNSPECIFIED, "PENDING_GENERATION", "ENABLED", "DISABLED", "DESTROYED", "DESTROY_SCHEDULED" , "PENDING_IMPORT", " IMPORT_FAILED".' name: state predefined: - CRYPTO_KEY_VERSION_STATE_UNSPECIFIED - PENDING_GENERATION - ENABLED - DISABLED - DESTROYED - DESTROY_SCHEDULED - PENDING_IMPORT - IMPORT_FAILED - auto: PREDEFINED description: 'CryptoKeyPurpose describes the cryptographic capabilities of a CryptoKey. A given key can only be used for the operations allowed by its purpose. Can be: "CRYPTO_KEY_PURPOSE_UNSPECIFIED", "ENCRYPT_DECRYPT", "ASYMMETRIC_SIGN", "ASYMMETRIC_DECRYPT".' name: purpose predefined: - CRYPTO_KEY_PURPOSE_UNSPECIFIED - ENCRYPT_DECRYPT - ASYMMETRIC_SIGN - ASYMMETRIC_DECRYPT - description: Time between when new key versions are generated automatically. Must between 24 hours and 876,000 hours. If rotation_period is set, next_rotation_time must also be set. Keys with purpose ENCRYPT_DECRYPT support automatic rotation. For other keys, this field must be omitted. A duration in seconds. name: rotation_period - auto: PREDEFINED description: Algorithm to use when creating a CryptoKeyVersion based on this template. name: algorithm predefined: - CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED - GOOGLE_SYMMETRIC_ENCRYPTION - RSA_SIGN_PSS_2048_SHA256 - RSA_SIGN_PSS_3072_SHA256 - RSA_SIGN_PSS_4096_SHA256 - RSA_SIGN_PSS_4096_SHA512 - RSA_SIGN_PKCS1_2048_SHA256 - RSA_SIGN_PKCS1_3072_SHA256 - RSA_SIGN_PKCS1_4096_SHA256 - RSA_SIGN_PKCS1_4096_SHA512 - RSA_DECRYPT_OAEP_2048_SHA256 - RSA_DECRYPT_OAEP_3072_SHA256 - RSA_DECRYPT_OAEP_4096_SHA256 - RSA_DECRYPT_OAEP_4096_SHA512 - EC_SIGN_P256_SHA256 - EC_SIGN_P384_SHA384 - auto: PREDEFINED description: 'The protection_level to use when creating a CryptoKeyVersion based on this template. Can be: "PROTECTION_LEVEL_UNSPECIFIED", "SOFTWARE", "HSM".' name: protection_level predefined: - PROTECTION_LEVEL_UNSPECIFIED - SOFTWARE - HSM - description: Labels with user-defined metadata. name: labels description: Updates a CryptoKey. name: google-kms-update-key outputs: - contextPath: GoogleKMS.CryptoKey.Name description: The resource name for this CryptoKey. type: String - contextPath: GoogleKMS.CryptoKey.Purpose description: The immutable purpose of this CryptoKey. type: String - contextPath: GoogleKMS.CryptoKey.CreationTime description: The time at which this CryptoKey was created. type: String - contextPath: GoogleKMS.CryptoKey.NextRotationTime description: |- The date when the next scheduled rotation is due to run. At nextRotationTime, the Key Management Service automatically creates a new version of this CryptoKey and marks the new version as primary. type: Date - contextPath: GoogleKMS.CryptoKey.RotationPeriod description: The period for which the nextRotationTime is advanced, when the service automatically rotates a key. type: String - contextPath: GoogleKMS.CryptoKey.Labels description: Labels with user-defined metadata. type: String - contextPath: GoogleKMS.CryptoKey.VersionTemplate.ProtectionLevel description: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.VersionTemplate.Algorithm description: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.Name description: The resource name for this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.State description: The current state of the CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.CreationTime description: The time at which this CryptoKeyVersion was created. type: Date - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.ProtectionLevel description: The ProtectionLevel describing how cryptographic operations are performed with this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.Algorithm description: The algorithm in use in the primary CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.GenerateTime description: The time this CryptoKeyVersion's key material was generated. type: Date - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For example, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the crypto-key to destroy. name: crypto_key required: true - defaultValue: default description: The CryptoKeyVersion ID to destroy. Use keyword 'default' to use the primary CryptoKeyVersion of the given CryptoKey. name: crypto_key_version required: true description: Schedules a CryptoKeyVersion for destruction. name: google-kms-destroy-key - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For example, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the crypto-key to restore. name: crypto_key required: true - defaultValue: default description: The CryptoKeyVersion ID to restore. Use keyword 'default' to use the primary CryptoKeyVersion of the given CryptoKey. name: crypto_key_version required: true description: Restores a CryptoKeyVersion in the DESTROY_SCHEDULED state. name: google-kms-restore-key - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the crypto-key to disable. name: crypto_key required: true - defaultValue: default description: The CryptoKeyVersion ID to disable. Use keyword 'default' to use the primary CryptoKeyVersion of the given CryptoKey. name: crypto_key_version required: true description: Disables a CryptoKeyVersion of a given CryptoKey. name: google-kms-disable-key - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the crypto-key to enable. name: crypto_key required: true - defaultValue: default description: The CryptoKeyVersion ID to enable. Use keyword 'default' to use the primary CryptoKeyVersion of the given CryptoKey. name: crypto_key_version required: true description: Enables a CryptoKeyVersion of a given CryptoKey. name: google-kms-enable-key - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - auto: PREDEFINED description: 'Shows only keys with this primary CryptoKeyVersion state. Leave empty to show all. Can be: "CRYPTO_KEY_VERSION_STATE_UNSPECIFIED", "PENDING_GENERATION", "ENABLED", "DISABLED", "DESTROYED", "DESTROY_SCHEDULED", "PENDING_IMPORT", "IMPORT_FAILED".' name: key_state predefined: - CRYPTO_KEY_VERSION_STATE_UNSPECIFIED - PENDING_GENERATION - ENABLED - DISABLED - DESTROYED - DESTROY_SCHEDULED - PENDING_IMPORT - IMPORT_FAILED description: Lists all keys in key ring. name: google-kms-list-keys - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the location to the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the crypto-key to use. name: crypto_key required: true - description: The CryptoKeyVersion to use. name: crypto_key_version required: true - description: Simple plain text to encrypt. Must be no larger than 64KiB. name: simple_plaintext - description: Base64 plain text to encrypt. name: base64_plaintext - description: The entry ID of the file to encrypt. name: entry_id description: Encrypts data using a asymmetric CryptoKey. name: google-kms-asymmetric-encrypt outputs: - contextPath: GoogleKMS.AsymmetricEncrypt.CryptoKey description: The CryptoKey used. type: String - contextPath: GoogleKMS.AsymmetricEncrypt.IsBase64 description: Is the original plaintext in base 64. type: Boolean - contextPath: GoogleKMS.AsymmetricEncrypt.Ciphertext description: The encrypted ciphertext. type: String - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the crypto-key to use. name: crypto_key required: true - description: The CryptoKeyVersion to use. name: crypto_key_version required: true - description: Ciphertext to decrypt to simple plain text. name: simple_ciphertext - description: Ciphertext to decrypt to base64 plain text. name: base64_ciphertext - description: The entry ID of the file to decrypt. name: entry_id description: Decrypts data using an asymmetric CryptoKey. name: google-kms-asymmetric-decrypt outputs: - contextPath: GoogleKMS.AsymmetricDecrypt.CryptoKey description: The CryptoKey in use. type: String - contextPath: GoogleKMS.AsymmetricDecrypt.IsBase64 description: Whether the original plain text is in base64. type: Boolean - contextPath: GoogleKMS.AsymmetricDecrypt.Plaintext description: The decrypted plain text. type: String - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - auto: PREDEFINED defaultValue: 'no' description: Returns all KeyRings from all locations. Default is no. name: all predefined: - 'yes' - 'no' description: Lists all KeyRings in a given location. name: google-kms-list-key-rings outputs: - contextPath: GoogleKMS.KeyRing.Name description: The name of the KeyRing. type: String - contextPath: GoogleKMS.KeyRing.CreateTime description: The creation time of the KeyRing. type: Date - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - auto: PREDEFINED defaultValue: 'no' description: Whether to return all CryptoKeys from all KeyRings across all locations. name: all predefined: - 'yes' - 'no' - auto: PREDEFINED description: Shows only keys with this primary CryptoKeyVersion state. Leave empty to show all. name: key_state predefined: - CRYPTO_KEY_VERSION_STATE_UNSPECIFIED - PENDING_GENERATION - ENABLED - DISABLED - DESTROYED - DESTROY_SCHEDULED - PENDING_IMPORT - IMPORT_FAILED description: Lists all CryptoKeys across all KeyRings in a given location. name: google-kms-list-all-keys outputs: - contextPath: GoogleKMS.CryptoKey.Name description: The resource name for this CryptoKey. type: String - contextPath: GoogleKMS.CryptoKey.Purpose description: The immutable purpose of this CryptoKey. type: String - contextPath: GoogleKMS.CryptoKey.CreationTime description: The time at which this CryptoKey was created. type: Date - contextPath: GoogleKMS.CryptoKey.NextRotationTime description: |- The date when the next scheduled rotation is due to run. At nextRotationTime, the Key Management Service automatically creates a new version of this CryptoKey and marks the new version as primary. type: Date - contextPath: GoogleKMS.CryptoKey.RotationPeriod description: The period for which the nextRotationTime is advanced, when the service automatically rotates a key. type: String - contextPath: GoogleKMS.CryptoKey.Labels description: Labels with user-defined metadata. type: String - contextPath: GoogleKMS.CryptoKey.VersionTemplate.ProtectionLevel description: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.VersionTemplate.Algorithm description: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.Name description: The resource name for this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.State description: The current state of the CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.CreationTime description: The time at which this CryptoKeyVersion was created. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.ProtectionLevel description: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.Algorithm description: The algorithm in use in the primary CryptoKeyVersion. type: String - contextPath: GoogleKMS.CryptoKey.PrimaryCryptoKeyVersion.GenerateTime description: The time this CryptoKeyVersion's key material was generated. type: Date - arguments: - auto: PREDEFINED defaultValue: default description: |- The geographical regions where requests to Cloud KMS for a given resource are handled, and where the corresponding cryptographic keys are stored. For more information, see https://cloud.google.com/kms/docs/locations. Keyword 'default' uses the default location. name: location predefined: - default - global - asia-east1 - asia-east2 - asia-northeast1 - asia-northeast2 - asia-south1 - asia-southeast1 - australia-southeast1 - europe-north1 - europe-west1 - europe-west2 - europe-west3 - europe-west4 - europe-west6 - northamerica-northeast1 - us-central1 - us-east1 - us-east4 - us-west1 - us-west2 - southamerica-east1 - eur4 - nam4 - asia - europe - us required: true - defaultValue: default description: |- A grouping of keys for organizational purposes. Keyword 'default' uses the default KeyRing. name: key_ring required: true - description: The ID for the crypto-key to use. name: crypto_key required: true - description: The CryptoKeyVersion to use. name: crypto_key_version required: true description: Returns the public key from a given CryptoKey. name: google-kms-get-public-key outputs: - contextPath: GoogleKMS.PublicKey.CryptoKey description: The CryptoKey to which the public key is connected. type: String - contextPath: GoogleKMS.PublicKey.PEM description: The PEM of the public key. type: String - contextPath: GoogleKMS.PublicKey.Algorithm description: The algorithm used in the CryptoKey. type: String dockerimage: demisto/google-kms:1.0.0.10182333 runonce: false script: '-' type: python subtype: python3 tests: - Google-KMS-test fromversion: 5.0.0