Blame - docs/dyn/cloudkms_v1.projects.locations.keyRings.cryptoKeys.html - platform/external/python/google-api-python-client

2017-03-13 12:12:03 -0400

[diff] [blame]

76

<h2>Instance Methods</h2>

77

78

<code><a href="cloudkms_v1.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.html">cryptoKeyVersions()</a></code>

79

</p>

80

<p class="firstline">Returns the cryptoKeyVersions Resource.</p>

81

82

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

83

<code><a href="#create">create(parent, body=None, cryptoKeyId=None, skipInitialVersionCreation=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

84

<p class="firstline">Create a new CryptoKey within a KeyRing.</p>

85

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

86

<code><a href="#decrypt">decrypt(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

87

<p class="firstline">Decrypts data that was protected by Encrypt. The CryptoKey.purpose</p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

88

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

89

<code><a href="#encrypt">encrypt(name, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

4ba8c23

2017-06-06 18:46:08 -0400

[diff] [blame]

90

<p class="firstline">Encrypts data, so that it can only be recovered by a call to Decrypt.</p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

91

92

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

93

<p class="firstline">Returns metadata for a given CryptoKey, as well as its</p>

94

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

95

<code><a href="#getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

96

<p class="firstline">Gets the access control policy for a resource.</p>

97

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

98

<code><a href="#list">list(parent, orderBy=None, pageToken=None, pageSize=None, versionView=None, filter=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

99

<p class="firstline">Lists CryptoKeys.</p>

100

101

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

102

<p class="firstline">Retrieves the next page of results.</p>

103

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

104

<code><a href="#patch">patch(name, body=None, updateMask=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

105

<p class="firstline">Update a CryptoKey.</p>

106

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

107

<code><a href="#setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

108

<p class="firstline">Sets the access control policy on the specified resource. Replaces any</p>

109

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

110

<code><a href="#testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</a></code></p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

111

<p class="firstline">Returns permissions that a caller has on the specified resource.</p>

112

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

113

<code><a href="#updatePrimaryVersion">updatePrimaryVersion(name, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

114

<p class="firstline">Update the version of a CryptoKey that will be used in Encrypt.</p>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

115

<h3>Method Details</h3>

116

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

117

<code class="details" id="create">create(parent, body=None, cryptoKeyId=None, skipInitialVersionCreation=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

118

<pre>Create a new CryptoKey within a KeyRing.

119

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

120

CryptoKey.purpose and

121

CryptoKey.version_template.algorithm

122

are required.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

123

124

Args:

125

parent: string, Required. The name of the KeyRing associated with the

126

CryptoKeys. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

127

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

128

The object takes the form of:

129

130

{ # A CryptoKey represents a logical key that can be used for cryptographic

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

131

# operations.

132

#

133

# A CryptoKey is made up of zero or more versions,

134

# which represent the actual key material used in cryptographic operations.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

135

"labels": { # Labels with user-defined metadata. For more information, see

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

136

# [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

137

"a_key": "A String",

138

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

139

"purpose": "A String", # Immutable. The immutable purpose of this CryptoKey.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

140

"createTime": "A String", # Output only. The time at which this CryptoKey was created.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

141

"name": "A String", # Output only. The resource name for this CryptoKey in the format

142

# `projects/*/locations/*/keyRings/*/cryptoKeys/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

143

"primary": { # A CryptoKeyVersion represents an individual cryptographic key, and the # Output only. A copy of the "primary" CryptoKeyVersion that will be used

144

# by Encrypt when this CryptoKey is given

145

# in EncryptRequest.name.

146

#

147

# The CryptoKey's primary version can be updated via

148

# UpdateCryptoKeyPrimaryVersion.

149

#

150

# Keys with purpose

151

# ENCRYPT_DECRYPT may have a

152

# primary. For other keys, this field will be omitted.

153

# associated key material.

154

#

155

# An ENABLED version can be

156

# used for cryptographic operations.

157

#

158

# For security reasons, the raw cryptographic key material represented by a

159

# CryptoKeyVersion can never be viewed or exported. It can only be used to

160

# encrypt, decrypt, or sign data when an authorized user or application invokes

161

# Cloud KMS.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

162

"generateTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

163

# generated.

164

"name": "A String", # Output only. The resource name for this CryptoKeyVersion in the format

165

# `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

166

"importTime": "A String", # Output only. The time at which this CryptoKeyVersion's key material

167

# was imported.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

168

"importFailureReason": "A String", # Output only. The root cause of an import failure. Only present if

169

# state is

170

# IMPORT_FAILED.

171

"state": "A String", # The current state of the CryptoKeyVersion.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

172

"attestation": { # Contains an HSM-generated attestation about a key operation. For more # Output only. Statement that was generated and signed by the HSM at key

173

# creation time. Use this statement to verify attributes of the key as stored

174

# on the HSM, independently of Google. Only provided for key versions with

175

# protection_level HSM.

176

# information, see [Verifying attestations]

177

# (https://cloud.google.com/kms/docs/attest-key).

178

"format": "A String", # Output only. The format of the attestation data.

179

"content": "A String", # Output only. The attestation data provided by the HSM when the key

180

# operation was performed.

181

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

182

"createTime": "A String", # Output only. The time at which this CryptoKeyVersion was created.

183

"destroyTime": "A String", # Output only. The time this CryptoKeyVersion's key material is scheduled

184

# for destruction. Only present if state is

185

# DESTROY_SCHEDULED.

186

"destroyEventTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

187

# destroyed. Only present if state is

188

# DESTROYED.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

189

"protectionLevel": "A String", # Output only. The ProtectionLevel describing how crypto operations are

190

# performed with this CryptoKeyVersion.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

191

"externalProtectionLevelOptions": { # ExternalProtectionLevelOptions stores a group of additional fields for # ExternalProtectionLevelOptions stores a group of additional fields for

192

# configuring a CryptoKeyVersion that are specific to the

193

# EXTERNAL protection level.

194

# configuring a CryptoKeyVersion that are specific to the

195

# EXTERNAL protection level.

196

"externalKeyUri": "A String", # The URI for an external resource that this CryptoKeyVersion represents.

197

},

198

"importJob": "A String", # Output only. The name of the ImportJob used to import this

199

# CryptoKeyVersion. Only present if the underlying key material was

200

# imported.

201

"algorithm": "A String", # Output only. The CryptoKeyVersionAlgorithm that this

202

# CryptoKeyVersion supports.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

203

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

204

"versionTemplate": { # A CryptoKeyVersionTemplate specifies the properties to use when creating # A template describing settings for new CryptoKeyVersion instances.

205

# The properties of new CryptoKeyVersion instances created by either

206

# CreateCryptoKeyVersion or

207

# auto-rotation are controlled by this template.

208

# a new CryptoKeyVersion, either manually with

209

# CreateCryptoKeyVersion or

210

# automatically as a result of auto-rotation.

211

"algorithm": "A String", # Required. Algorithm to use

212

# when creating a CryptoKeyVersion based on this template.

213

#

214

# For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both

215

# this field is omitted and CryptoKey.purpose is

216

# ENCRYPT_DECRYPT.

217

"protectionLevel": "A String", # ProtectionLevel to use when creating a CryptoKeyVersion based on

218

# this template. Immutable. Defaults to SOFTWARE.

219

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

220

"rotationPeriod": "A String", # next_rotation_time will be advanced by this period when the service

221

# automatically rotates a key. Must be at least 24 hours and at most

222

# 876,000 hours.

223

#

224

# If rotation_period is set, next_rotation_time must also be set.

225

#

226

# Keys with purpose

227

# ENCRYPT_DECRYPT support

228

# automatic rotation. For other keys, this field must be omitted.

229

"nextRotationTime": "A String", # At next_rotation_time, the Key Management Service will automatically:

230

#

231

# 1. Create a new version of this CryptoKey.

232

# 2. Mark the new version as primary.

233

#

234

# Key rotations performed manually via

235

# CreateCryptoKeyVersion and

236

# UpdateCryptoKeyPrimaryVersion

237

# do not affect next_rotation_time.

238

#

239

# Keys with purpose

240

# ENCRYPT_DECRYPT support

241

# automatic rotation. For other keys, this field must be omitted.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

242

}

243

244

cryptoKeyId: string, Required. It must be unique within a KeyRing and match the regular

245

expression `[a-zA-Z0-9_-]{1,63}`

246

skipInitialVersionCreation: boolean, If set to true, the request will create a CryptoKey without any

247

CryptoKeyVersions. You must manually call

248

CreateCryptoKeyVersion or

249

ImportCryptoKeyVersion

250

before you can use this CryptoKey.

251

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

258

259

{ # A CryptoKey represents a logical key that can be used for cryptographic

260

# operations.

261

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

262

# A CryptoKey is made up of zero or more versions,

263

# which represent the actual key material used in cryptographic operations.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

264

"labels": { # Labels with user-defined metadata. For more information, see

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

265

# [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

266

"a_key": "A String",

267

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

268

"purpose": "A String", # Immutable. The immutable purpose of this CryptoKey.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

269

"createTime": "A String", # Output only. The time at which this CryptoKey was created.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

270

"name": "A String", # Output only. The resource name for this CryptoKey in the format

271

# `projects/*/locations/*/keyRings/*/cryptoKeys/*`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

272

"primary": { # A CryptoKeyVersion represents an individual cryptographic key, and the # Output only. A copy of the "primary" CryptoKeyVersion that will be used

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

273

# by Encrypt when this CryptoKey is given

274

# in EncryptRequest.name.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

275

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

276

# The CryptoKey's primary version can be updated via

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

277

# UpdateCryptoKeyPrimaryVersion.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

278

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

279

# Keys with purpose

280

# ENCRYPT_DECRYPT may have a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

281

# primary. For other keys, this field will be omitted.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

282

# associated key material.

283

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

284

# An ENABLED version can be

285

# used for cryptographic operations.

286

#

287

# For security reasons, the raw cryptographic key material represented by a

288

# CryptoKeyVersion can never be viewed or exported. It can only be used to

289

# encrypt, decrypt, or sign data when an authorized user or application invokes

290

# Cloud KMS.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

291

"generateTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

292

# generated.

293

"name": "A String", # Output only. The resource name for this CryptoKeyVersion in the format

294

# `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

295

"importTime": "A String", # Output only. The time at which this CryptoKeyVersion's key material

296

# was imported.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

297

"importFailureReason": "A String", # Output only. The root cause of an import failure. Only present if

298

# state is

299

# IMPORT_FAILED.

300

"state": "A String", # The current state of the CryptoKeyVersion.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

301

"attestation": { # Contains an HSM-generated attestation about a key operation. For more # Output only. Statement that was generated and signed by the HSM at key

302

# creation time. Use this statement to verify attributes of the key as stored

303

# on the HSM, independently of Google. Only provided for key versions with

304

# protection_level HSM.

305

# information, see [Verifying attestations]

306

# (https://cloud.google.com/kms/docs/attest-key).

307

"format": "A String", # Output only. The format of the attestation data.

308

"content": "A String", # Output only. The attestation data provided by the HSM when the key

309

# operation was performed.

310

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

311

"createTime": "A String", # Output only. The time at which this CryptoKeyVersion was created.

312

"destroyTime": "A String", # Output only. The time this CryptoKeyVersion's key material is scheduled

313

# for destruction. Only present if state is

314

# DESTROY_SCHEDULED.

315

"destroyEventTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

316

# destroyed. Only present if state is

317

# DESTROYED.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

318

"protectionLevel": "A String", # Output only. The ProtectionLevel describing how crypto operations are

319

# performed with this CryptoKeyVersion.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

320

"externalProtectionLevelOptions": { # ExternalProtectionLevelOptions stores a group of additional fields for # ExternalProtectionLevelOptions stores a group of additional fields for

321

# configuring a CryptoKeyVersion that are specific to the

322

# EXTERNAL protection level.

323

# configuring a CryptoKeyVersion that are specific to the

324

# EXTERNAL protection level.

325

"externalKeyUri": "A String", # The URI for an external resource that this CryptoKeyVersion represents.

326

},

327

"importJob": "A String", # Output only. The name of the ImportJob used to import this

328

# CryptoKeyVersion. Only present if the underlying key material was

329

# imported.

330

"algorithm": "A String", # Output only. The CryptoKeyVersionAlgorithm that this

331

# CryptoKeyVersion supports.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

332

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

333

"versionTemplate": { # A CryptoKeyVersionTemplate specifies the properties to use when creating # A template describing settings for new CryptoKeyVersion instances.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

334

# The properties of new CryptoKeyVersion instances created by either

335

# CreateCryptoKeyVersion or

336

# auto-rotation are controlled by this template.

337

# a new CryptoKeyVersion, either manually with

338

# CreateCryptoKeyVersion or

339

# automatically as a result of auto-rotation.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

340

"algorithm": "A String", # Required. Algorithm to use

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

341

# when creating a CryptoKeyVersion based on this template.

342

#

343

# For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both

344

# this field is omitted and CryptoKey.purpose is

345

# ENCRYPT_DECRYPT.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

346

"protectionLevel": "A String", # ProtectionLevel to use when creating a CryptoKeyVersion based on

347

# this template. Immutable. Defaults to SOFTWARE.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

348

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

349

"rotationPeriod": "A String", # next_rotation_time will be advanced by this period when the service

350

# automatically rotates a key. Must be at least 24 hours and at most

351

# 876,000 hours.

352

#

353

# If rotation_period is set, next_rotation_time must also be set.

354

#

355

# Keys with purpose

356

# ENCRYPT_DECRYPT support

357

# automatic rotation. For other keys, this field must be omitted.

358

"nextRotationTime": "A String", # At next_rotation_time, the Key Management Service will automatically:

359

#

360

# 1. Create a new version of this CryptoKey.

361

# 2. Mark the new version as primary.

362

#

363

# Key rotations performed manually via

364

# CreateCryptoKeyVersion and

365

# UpdateCryptoKeyPrimaryVersion

366

# do not affect next_rotation_time.

367

#

368

# Keys with purpose

369

# ENCRYPT_DECRYPT support

370

# automatic rotation. For other keys, this field must be omitted.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

371

}</pre>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

375

<code class="details" id="decrypt">decrypt(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

376

<pre>Decrypts data that was protected by Encrypt. The CryptoKey.purpose

377

must be ENCRYPT_DECRYPT.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

378

379

Args:

380

name: string, Required. The resource name of the CryptoKey to use for decryption.

381

The server will choose the appropriate version. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

382

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

383

The object takes the form of:

384

385

{ # Request message for KeyManagementService.Decrypt.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

386

"ciphertextCrc32c": "A String", # Optional. An optional CRC32C checksum of the DecryptRequest.ciphertext. If

387

# specified, KeyManagementService will verify the integrity of the

388

# received DecryptRequest.ciphertext using this checksum.

389

# KeyManagementService will report an error if the checksum verification

390

# fails. If you receive a checksum error, your client should verify that

391

# CRC32C(DecryptRequest.ciphertext) is equal to

392

# DecryptRequest.ciphertext_crc32c, and if so, perform a limited number

393

# of retries. A persistent mismatch may indicate an issue in your computation

394

# of the CRC32C checksum.

395

# Note: This field is defined as int64 for reasons of compatibility across

396

# different languages. However, it is a non-negative integer, which will

397

# never exceed 2^32-1, and can be safely downconverted to uint32 in languages

398

# that support this type.

399

#

400

# NOTE: This field is in Beta.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

401

"additionalAuthenticatedData": "A String", # Optional. Optional data that must match the data originally supplied in

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

402

# EncryptRequest.additional_authenticated_data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

403

"ciphertext": "A String", # Required. The encrypted data originally returned in

404

# EncryptResponse.ciphertext.

405

"additionalAuthenticatedDataCrc32c": "A String", # Optional. An optional CRC32C checksum of the

406

# DecryptRequest.additional_authenticated_data. If specified,

407

# KeyManagementService will verify the integrity of the received

408

# DecryptRequest.additional_authenticated_data using this checksum.

409

# KeyManagementService will report an error if the checksum verification

410

# fails. If you receive a checksum error, your client should verify that

411

# CRC32C(DecryptRequest.additional_authenticated_data) is equal to

412

# DecryptRequest.additional_authenticated_data_crc32c, and if so, perform

413

# a limited number of retries. A persistent mismatch may indicate an issue in

414

# your computation of the CRC32C checksum.

415

# Note: This field is defined as int64 for reasons of compatibility across

416

# different languages. However, it is a non-negative integer, which will

417

# never exceed 2^32-1, and can be safely downconverted to uint32 in languages

418

# that support this type.

419

#

420

# NOTE: This field is in Beta.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

421

}

422

423

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

430

431

{ # Response message for KeyManagementService.Decrypt.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

432

"plaintextCrc32c": "A String", # Integrity verification field. A CRC32C checksum of the returned

433

# DecryptResponse.plaintext. An integrity check of

434

# DecryptResponse.plaintext can be performed by computing the CRC32C

435

# checksum of DecryptResponse.plaintext and comparing your results to

436

# this field. Discard the response in case of non-matching checksum values,

437

# and perform a limited number of retries. A persistent mismatch may indicate

438

# an issue in your computation of the CRC32C checksum. Note: receiving this

439

# response message indicates that KeyManagementService is able to

440

# successfully decrypt the ciphertext.

441

# Note: This field is defined as int64 for reasons of compatibility across

442

# different languages. However, it is a non-negative integer, which will

443

# never exceed 2^32-1, and can be safely downconverted to uint32 in languages

444

# that support this type.

445

#

446

# NOTE: This field is in Beta.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

447

"plaintext": "A String", # The decrypted data originally supplied in EncryptRequest.plaintext.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

452

<code class="details" id="encrypt">encrypt(name, body=None, x__xgafv=None)</code>

Sai Cheemalapati

4ba8c23

2017-06-06 18:46:08 -0400

[diff] [blame]

453

<pre>Encrypts data, so that it can only be recovered by a call to Decrypt.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

454

The CryptoKey.purpose must be

455

ENCRYPT_DECRYPT.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

Args:

to use for encryption.

460

461

If a CryptoKey is specified, the server will use its

462

primary version. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

463

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

464

The object takes the form of:

465

466

{ # Request message for KeyManagementService.Encrypt.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

467

"plaintextCrc32c": "A String", # Optional. An optional CRC32C checksum of the EncryptRequest.plaintext. If

468

# specified, KeyManagementService will verify the integrity of the

469

# received EncryptRequest.plaintext using this checksum.

470

# KeyManagementService will report an error if the checksum verification

471

# fails. If you receive a checksum error, your client should verify that

472

# CRC32C(EncryptRequest.plaintext) is equal to

473

# EncryptRequest.plaintext_crc32c, and if so, perform a limited number of

474

# retries. A persistent mismatch may indicate an issue in your computation of

475

# the CRC32C checksum.

476

# Note: This field is defined as int64 for reasons of compatibility across

477

# different languages. However, it is a non-negative integer, which will

478

# never exceed 2^32-1, and can be safely downconverted to uint32 in languages

479

# that support this type.

480

#

481

# NOTE: This field is in Beta.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

482

"plaintext": "A String", # Required. The data to encrypt. Must be no larger than 64KiB.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

483

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

484

# The maximum size depends on the key version's

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

485

# protection_level. For

486

# SOFTWARE keys, the plaintext must be no larger

487

# than 64KiB. For HSM keys, the combined length of the

488

# plaintext and additional_authenticated_data fields must be no larger than

489

# 8KiB.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

490

"additionalAuthenticatedData": "A String", # Optional. Optional data that, if specified, must also be provided during decryption

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

491

# through DecryptRequest.additional_authenticated_data.

492

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

493

# The maximum size depends on the key version's

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

494

# protection_level. For

495

# SOFTWARE keys, the AAD must be no larger than

496

# 64KiB. For HSM keys, the combined length of the

497

# plaintext and additional_authenticated_data fields must be no larger than

498

# 8KiB.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

499

"additionalAuthenticatedDataCrc32c": "A String", # Optional. An optional CRC32C checksum of the

500

# EncryptRequest.additional_authenticated_data. If specified,

501

# KeyManagementService will verify the integrity of the received

502

# EncryptRequest.additional_authenticated_data using this checksum.

503

# KeyManagementService will report an error if the checksum verification

504

# fails. If you receive a checksum error, your client should verify that

505

# CRC32C(EncryptRequest.additional_authenticated_data) is equal to

506

# EncryptRequest.additional_authenticated_data_crc32c, and if so, perform

507

# a limited number of retries. A persistent mismatch may indicate an issue in

508

# your computation of the CRC32C checksum.

509

# Note: This field is defined as int64 for reasons of compatibility across

510

# different languages. However, it is a non-negative integer, which will

511

# never exceed 2^32-1, and can be safely downconverted to uint32 in languages

512

# that support this type.

513

#

514

# NOTE: This field is in Beta.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

515

}

516

517

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

524

525

{ # Response message for KeyManagementService.Encrypt.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

526

"verifiedAdditionalAuthenticatedDataCrc32c": True or False, # Integrity verification field. A flag indicating whether

527

# EncryptRequest.additional_authenticated_data_crc32c was received by

528

# KeyManagementService and used for the integrity verification of the

529

# AAD. A false value of this

530

# field indicates either that

531

# EncryptRequest.additional_authenticated_data_crc32c was left unset or

532

# that it was not delivered to KeyManagementService. If you've set

533

# EncryptRequest.additional_authenticated_data_crc32c but this field is

534

# still false, discard the response and perform a limited number of retries.

535

#

536

# NOTE: This field is in Beta.

537

"ciphertextCrc32c": "A String", # Integrity verification field. A CRC32C checksum of the returned

538

# EncryptResponse.ciphertext. An integrity check of

539

# EncryptResponse.ciphertext can be performed by computing the CRC32C

540

# checksum of EncryptResponse.ciphertext and comparing your results to

541

# this field. Discard the response in case of non-matching checksum values,

542

# and perform a limited number of retries. A persistent mismatch may indicate

543

# an issue in your computation of the CRC32C checksum.

544

# Note: This field is defined as int64 for reasons of compatibility across

545

# different languages. However, it is a non-negative integer, which will

546

# never exceed 2^32-1, and can be safely downconverted to uint32 in languages

547

# that support this type.

548

#

549

# NOTE: This field is in Beta.

550

"verifiedPlaintextCrc32c": True or False, # Integrity verification field. A flag indicating whether

551

# EncryptRequest.plaintext_crc32c was received by

552

# KeyManagementService and used for the integrity verification of the

553

# plaintext. A false value of this field

554

# indicates either that EncryptRequest.plaintext_crc32c was left unset or

555

# that it was not delivered to KeyManagementService. If you've set

556

# EncryptRequest.plaintext_crc32c but this field is still false, discard

557

# the response and perform a limited number of retries.

558

#

559

# NOTE: This field is in Beta.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

560

"ciphertext": "A String", # The encrypted data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

561

"name": "A String", # The resource name of the CryptoKeyVersion used in encryption. Check

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

562

# this field to verify that the intended resource was used for encryption.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

568

<pre>Returns metadata for a given CryptoKey, as well as its

569

primary CryptoKeyVersion.

570

571

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

572

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

573

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

580

581

{ # A CryptoKey represents a logical key that can be used for cryptographic

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

582

# operations.

583

#

584

# A CryptoKey is made up of zero or more versions,

585

# which represent the actual key material used in cryptographic operations.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

586

"labels": { # Labels with user-defined metadata. For more information, see

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

587

# [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

588

"a_key": "A String",

589

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

590

"purpose": "A String", # Immutable. The immutable purpose of this CryptoKey.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

591

"createTime": "A String", # Output only. The time at which this CryptoKey was created.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

592

"name": "A String", # Output only. The resource name for this CryptoKey in the format

593

# `projects/*/locations/*/keyRings/*/cryptoKeys/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

594

"primary": { # A CryptoKeyVersion represents an individual cryptographic key, and the # Output only. A copy of the "primary" CryptoKeyVersion that will be used

595

# by Encrypt when this CryptoKey is given

596

# in EncryptRequest.name.

597

#

598

# The CryptoKey's primary version can be updated via

599

# UpdateCryptoKeyPrimaryVersion.

600

#

601

# Keys with purpose

602

# ENCRYPT_DECRYPT may have a

603

# primary. For other keys, this field will be omitted.

604

# associated key material.

605

#

606

# An ENABLED version can be

607

# used for cryptographic operations.

608

#

609

# For security reasons, the raw cryptographic key material represented by a

610

# CryptoKeyVersion can never be viewed or exported. It can only be used to

611

# encrypt, decrypt, or sign data when an authorized user or application invokes

612

# Cloud KMS.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

613

"generateTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

614

# generated.

615

"name": "A String", # Output only. The resource name for this CryptoKeyVersion in the format

616

# `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

617

"importTime": "A String", # Output only. The time at which this CryptoKeyVersion's key material

618

# was imported.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

619

"importFailureReason": "A String", # Output only. The root cause of an import failure. Only present if

620

# state is

621

# IMPORT_FAILED.

622

"state": "A String", # The current state of the CryptoKeyVersion.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

623

"attestation": { # Contains an HSM-generated attestation about a key operation. For more # Output only. Statement that was generated and signed by the HSM at key

624

# creation time. Use this statement to verify attributes of the key as stored

625

# on the HSM, independently of Google. Only provided for key versions with

626

# protection_level HSM.

627

# information, see [Verifying attestations]

628

# (https://cloud.google.com/kms/docs/attest-key).

629

"format": "A String", # Output only. The format of the attestation data.

630

"content": "A String", # Output only. The attestation data provided by the HSM when the key

631

# operation was performed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

632

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

633

"createTime": "A String", # Output only. The time at which this CryptoKeyVersion was created.

634

"destroyTime": "A String", # Output only. The time this CryptoKeyVersion's key material is scheduled

635

# for destruction. Only present if state is

636

# DESTROY_SCHEDULED.

637

"destroyEventTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

638

# destroyed. Only present if state is

639

# DESTROYED.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

640

"protectionLevel": "A String", # Output only. The ProtectionLevel describing how crypto operations are

641

# performed with this CryptoKeyVersion.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

642

"externalProtectionLevelOptions": { # ExternalProtectionLevelOptions stores a group of additional fields for # ExternalProtectionLevelOptions stores a group of additional fields for

643

# configuring a CryptoKeyVersion that are specific to the

644

# EXTERNAL protection level.

645

# configuring a CryptoKeyVersion that are specific to the

646

# EXTERNAL protection level.

647

"externalKeyUri": "A String", # The URI for an external resource that this CryptoKeyVersion represents.

648

},

649

"importJob": "A String", # Output only. The name of the ImportJob used to import this

650

# CryptoKeyVersion. Only present if the underlying key material was

651

# imported.

652

"algorithm": "A String", # Output only. The CryptoKeyVersionAlgorithm that this

653

# CryptoKeyVersion supports.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

654

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

655

"versionTemplate": { # A CryptoKeyVersionTemplate specifies the properties to use when creating # A template describing settings for new CryptoKeyVersion instances.

656

# The properties of new CryptoKeyVersion instances created by either

657

# CreateCryptoKeyVersion or

658

# auto-rotation are controlled by this template.

659

# a new CryptoKeyVersion, either manually with

660

# CreateCryptoKeyVersion or

661

# automatically as a result of auto-rotation.

662

"algorithm": "A String", # Required. Algorithm to use

663

# when creating a CryptoKeyVersion based on this template.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

664

#

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

665

# For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both

666

# this field is omitted and CryptoKey.purpose is

667

# ENCRYPT_DECRYPT.

668

"protectionLevel": "A String", # ProtectionLevel to use when creating a CryptoKeyVersion based on

669

# this template. Immutable. Defaults to SOFTWARE.

670

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

671

"rotationPeriod": "A String", # next_rotation_time will be advanced by this period when the service

672

# automatically rotates a key. Must be at least 24 hours and at most

673

# 876,000 hours.

674

#

675

# If rotation_period is set, next_rotation_time must also be set.

676

#

677

# Keys with purpose

678

# ENCRYPT_DECRYPT support

679

# automatic rotation. For other keys, this field must be omitted.

680

"nextRotationTime": "A String", # At next_rotation_time, the Key Management Service will automatically:

681

#

682

# 1. Create a new version of this CryptoKey.

683

# 2. Mark the new version as primary.

684

#

685

# Key rotations performed manually via

686

# CreateCryptoKeyVersion and

687

# UpdateCryptoKeyPrimaryVersion

688

# do not affect next_rotation_time.

689

#

690

# Keys with purpose

691

# ENCRYPT_DECRYPT support

692

# automatic rotation. For other keys, this field must be omitted.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

693

}</pre>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

697

<code class="details" id="getIamPolicy">getIamPolicy(resource, options_requestedPolicyVersion=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

698

<pre>Gets the access control policy for a resource.

699

Returns an empty policy if the resource exists and does not have a policy

set.

Args:

resource: string, REQUIRED: The resource for which the policy is being requested.

704

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

705

options_requestedPolicyVersion: integer, Optional. The policy format version to be returned.

706

707

Valid values are 0, 1, and 3. Requests specifying an invalid value will be

708

rejected.

709

710

Requests for policies with any conditional bindings must specify version 3.

711

Policies without any conditional bindings may specify any valid value or

712

leave the field unset.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

713

714

To learn which resources support conditions in their IAM policies, see the

715

[IAM

716

documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

717

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

724

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

725

{ # An Identity and Access Management (IAM) policy, which specifies access

726

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

727

#

728

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

729

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

730

# `members` to a single `role`. Members can be user accounts, service accounts,

731

# Google groups, and domains (such as G Suite). A `role` is a named list of

732

# permissions; each `role` can be an IAM predefined role or a user-created

733

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

734

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

735

# For some types of Google Cloud resources, a `binding` can also specify a

736

# `condition`, which is a logical expression that allows access to a resource

737

# only if the expression evaluates to `true`. A condition can add constraints

738

# based on attributes of the request, the resource, or both. To learn which

739

# resources support conditions in their IAM policies, see the

740

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

741

#

742

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

743

#

744

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

745

# "bindings": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

746

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

747

# "role": "roles/resourcemanager.organizationAdmin",

748

# "members": [

749

# "user:mike@example.com",

750

# "group:admins@example.com",

751

# "domain:google.com",

752

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

753

# ]

754

# },

755

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

756

# "role": "roles/resourcemanager.organizationViewer",

757

# "members": [

758

# "user:eve@example.com"

759

# ],

760

# "condition": {

761

# "title": "expirable access",

762

# "description": "Does not grant access after Sep 2020",

763

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

764

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

765

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

766

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

767

# "etag": "BwWWja0YfJA=",

768

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

769

# }

770

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

771

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

776

# - group:admins@example.com

777

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

778

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

779

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

780

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

781

# - user:eve@example.com

782

# role: roles/resourcemanager.organizationViewer

783

# condition:

784

# title: expirable access

785

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

786

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

787

# - etag: BwWWja0YfJA=

788

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

789

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

790

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

791

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

792

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

793

# prevent simultaneous updates of a policy from overwriting each other.

794

# It is strongly suggested that systems make use of the `etag` in the

795

# read-modify-write cycle to perform policy updates in order to avoid race

796

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

797

# systems are expected to put that etag in the request to `setIamPolicy` to

798

# ensure that their change will be applied to the same version of the policy.

799

#

800

# **Important:** If you use IAM Conditions, you must include the `etag` field

801

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

802

# you to overwrite a version `3` policy with a version `1` policy, and all of

803

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

804

"version": 42, # Specifies the format of the policy.

805

#

806

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

807

# are rejected.

808

#

809

# Any operation that affects conditional role bindings must specify version

810

# `3`. This requirement applies to the following operations:

811

#

812

# * Getting a policy that includes a conditional role binding

813

# * Adding a conditional role binding to a policy

814

# * Changing a conditional role binding in a policy

815

# * Removing any role binding, with or without a condition, from a policy

816

# that includes conditions

817

#

818

# **Important:** If you use IAM Conditions, you must include the `etag` field

819

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

820

# you to overwrite a version `3` policy with a version `1` policy, and all of

821

# the conditions in the version `3` policy are lost.

822

#

823

# If a policy does not include any conditions, operations on that policy may

824

# specify any valid version or leave the field unset.

825

#

826

# To learn which resources support conditions in their IAM policies, see the

827

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

828

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

829

# `condition` that determines how and when the `bindings` are applied. Each

830

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

831

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

832

"role": "A String", # Role that is assigned to `members`.

833

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

834

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

835

#

836

# If the condition evaluates to `true`, then this binding applies to the

837

# current request.

838

#

839

# If the condition evaluates to `false`, then this binding does not apply to

840

# the current request. However, a different role binding might grant the same

841

# role to one or more of the members in this binding.

842

#

843

# To learn which resources support conditions in their IAM policies, see the

844

# [IAM

845

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

846

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

847

# are documented at https://github.com/google/cel-spec.

848

#

849

# Example (Comparison):

850

#

851

# title: "Summary size limit"

852

# description: "Determines if a summary is less than 100 chars"

853

# expression: "document.summary.size() < 100"

854

#

855

# Example (Equality):

856

#

857

# title: "Requestor is owner"

858

# description: "Determines if requestor is the document owner"

859

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

864

# description: "Determine whether the document should be publicly visible"

865

# expression: "document.type != 'private' && document.type != 'internal'"

866

#

867

# Example (Data Manipulation):

868

#

869

# title: "Notification string"

870

# description: "Create a notification string with a timestamp."

871

# expression: "'New message received at ' + string(document.create_time)"

872

#

873

# The exact variables and functions that may be referenced within an expression

874

# are determined by the service that evaluates it. See the service

875

# documentation for additional information.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

876

"description": "A String", # Optional. Description of the expression. This is a longer text which

877

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

878

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

879

# its purpose. This can be used e.g. in UIs which allow to enter the

880

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

881

"expression": "A String", # Textual representation of an expression in Common Expression Language

882

# syntax.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

883

"location": "A String", # Optional. String indicating the location of the expression for error

884

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

885

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

886

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

887

# `members` can have the following values:

888

#

889

# * `allUsers`: A special identifier that represents anyone who is

890

# on the internet; with or without a Google account.

891

#

892

# * `allAuthenticatedUsers`: A special identifier that represents anyone

893

# who is authenticated with a Google account or a service account.

894

#

895

# * `user:{emailid}`: An email address that represents a specific Google

896

# account. For example, `alice@example.com` .

897

#

898

#

899

# * `serviceAccount:{emailid}`: An email address that represents a service

900

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

901

#

902

# * `group:{emailid}`: An email address that represents a Google group.

903

# For example, `admins@example.com`.

904

#

905

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

906

# identifier) representing a user that has been recently deleted. For

907

# example, `alice@example.com?uid=123456789012345678901`. If the user is

908

# recovered, this value reverts to `user:{emailid}` and the recovered user

909

# retains the role in the binding.

910

#

911

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

912

# unique identifier) representing a service account that has been recently

913

# deleted. For example,

914

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

915

# If the service account is undeleted, this value reverts to

916

# `serviceAccount:{emailid}` and the undeleted service account retains the

917

# role in the binding.

918

#

919

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

920

# identifier) representing a Google group that has been recently

921

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

922

# the group is recovered, this value reverts to `group:{emailid}` and the

923

# recovered group retains the role in the binding.

924

#

925

#

926

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

927

# users of that domain. For example, `google.com` or `example.com`.

928

#

929

"A String",

930

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

931

},

932

],

933

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

934

{ # Specifies the audit configuration for a service.

935

# The configuration determines which permission types are logged, and what

936

# identities, if any, are exempted from logging.

937

# An AuditConfig must have one or more AuditLogConfigs.

938

#

939

# If there are AuditConfigs for both `allServices` and a specific service,

940

# the union of the two AuditConfigs is used for that service: the log_types

941

# specified in each AuditConfig are enabled, and the exempted_members in each

942

# AuditLogConfig are exempted.

943

#

944

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices",

950

# "audit_log_configs": [

951

# {

952

# "log_type": "DATA_READ",

953

# "exempted_members": [

954

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

959

# },

960

# {

961

# "log_type": "ADMIN_READ"

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com",

967

# "audit_log_configs": [

968

# {

969

# "log_type": "DATA_READ"

970

# },

971

# {

972

# "log_type": "DATA_WRITE",

973

# "exempted_members": [

974

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

983

# logging. It also exempts jose@example.com from DATA_READ logging, and

984

# aliya@example.com from DATA_WRITE logging.

985

"auditLogConfigs": [ # The configuration for logging of each type of permission.

986

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

991

# {

992

# "log_type": "DATA_READ",

993

# "exempted_members": [

994

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1004

# jose@example.com from DATA_READ logging.

1005

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1006

# permission.

1007

# Follows the same format of Binding.members.

1008

"A String",

1009

],

1010

"logType": "A String", # The log type that this config enables.

1011

},

1012

],

1013

"service": "A String", # Specifies a service that will be enabled for audit logging.

1014

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1015

# `allServices` is a special value that covers all services.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1016

},

1017

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1022

<code class="details" id="list">list(parent, orderBy=None, pageToken=None, pageSize=None, versionView=None, filter=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1023

<pre>Lists CryptoKeys.

1024

1025

Args:

1026

parent: string, Required. The resource name of the KeyRing to list, in the format

1027

`projects/*/locations/*/keyRings/*`. (required)

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1028

orderBy: string, Optional. Specify how the results should be sorted. If not specified, the

1029

results will be sorted in the default order. For more information, see

1030

[Sorting and filtering list

1031

results](https://cloud.google.com/kms/docs/sorting-and-filtering).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1032

pageToken: string, Optional. Optional pagination token, returned earlier via

1033

ListCryptoKeysResponse.next_page_token.

1034

pageSize: integer, Optional. Optional limit on the number of CryptoKeys to include in the

1035

response. Further CryptoKeys can subsequently be obtained by

1036

including the ListCryptoKeysResponse.next_page_token in a subsequent

1037

request. If unspecified, the server will pick an appropriate default.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1038

versionView: string, The fields of the primary version to include in the response.

1039

filter: string, Optional. Only include resources that match the filter in the response. For

1040

more information, see

1041

[Sorting and filtering list

1042

results](https://cloud.google.com/kms/docs/sorting-and-filtering).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1043

x__xgafv: string, V1 error format.

1044

Allowed values

1045

1 - v1 error format

1046

2 - v2 error format

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1047

1048

Returns:

1049

An object of the form:

1050

1051

{ # Response message for KeyManagementService.ListCryptoKeys.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1052

"nextPageToken": "A String", # A token to retrieve next page of results. Pass this value in

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1053

# ListCryptoKeysRequest.page_token to retrieve the next page of results.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1054

"totalSize": 42, # The total number of CryptoKeys that matched the query.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1055

"cryptoKeys": [ # The list of CryptoKeys.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1056

{ # A CryptoKey represents a logical key that can be used for cryptographic

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1057

# operations.

1058

#

1059

# A CryptoKey is made up of zero or more versions,

1060

# which represent the actual key material used in cryptographic operations.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1061

"labels": { # Labels with user-defined metadata. For more information, see

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1062

# [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1063

"a_key": "A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1064

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1065

"purpose": "A String", # Immutable. The immutable purpose of this CryptoKey.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1066

"createTime": "A String", # Output only. The time at which this CryptoKey was created.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1067

"name": "A String", # Output only. The resource name for this CryptoKey in the format

1068

# `projects/*/locations/*/keyRings/*/cryptoKeys/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1069

"primary": { # A CryptoKeyVersion represents an individual cryptographic key, and the # Output only. A copy of the "primary" CryptoKeyVersion that will be used

1070

# by Encrypt when this CryptoKey is given

1071

# in EncryptRequest.name.

1072

#

1073

# The CryptoKey's primary version can be updated via

1074

# UpdateCryptoKeyPrimaryVersion.

1075

#

1076

# Keys with purpose

1077

# ENCRYPT_DECRYPT may have a

1078

# primary. For other keys, this field will be omitted.

1079

# associated key material.

1080

#

1081

# An ENABLED version can be

1082

# used for cryptographic operations.

1083

#

1084

# For security reasons, the raw cryptographic key material represented by a

1085

# CryptoKeyVersion can never be viewed or exported. It can only be used to

1086

# encrypt, decrypt, or sign data when an authorized user or application invokes

1087

# Cloud KMS.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1088

"generateTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

1089

# generated.

1090

"name": "A String", # Output only. The resource name for this CryptoKeyVersion in the format

1091

# `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1092

"importTime": "A String", # Output only. The time at which this CryptoKeyVersion's key material

1093

# was imported.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1094

"importFailureReason": "A String", # Output only. The root cause of an import failure. Only present if

1095

# state is

1096

# IMPORT_FAILED.

1097

"state": "A String", # The current state of the CryptoKeyVersion.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1098

"attestation": { # Contains an HSM-generated attestation about a key operation. For more # Output only. Statement that was generated and signed by the HSM at key

1099

# creation time. Use this statement to verify attributes of the key as stored

1100

# on the HSM, independently of Google. Only provided for key versions with

1101

# protection_level HSM.

1102

# information, see [Verifying attestations]

1103

# (https://cloud.google.com/kms/docs/attest-key).

1104

"format": "A String", # Output only. The format of the attestation data.

1105

"content": "A String", # Output only. The attestation data provided by the HSM when the key

1106

# operation was performed.

1107

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1108

"createTime": "A String", # Output only. The time at which this CryptoKeyVersion was created.

1109

"destroyTime": "A String", # Output only. The time this CryptoKeyVersion's key material is scheduled

1110

# for destruction. Only present if state is

1111

# DESTROY_SCHEDULED.

1112

"destroyEventTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

1113

# destroyed. Only present if state is

1114

# DESTROYED.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1115

"protectionLevel": "A String", # Output only. The ProtectionLevel describing how crypto operations are

1116

# performed with this CryptoKeyVersion.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1117

"externalProtectionLevelOptions": { # ExternalProtectionLevelOptions stores a group of additional fields for # ExternalProtectionLevelOptions stores a group of additional fields for

1118

# configuring a CryptoKeyVersion that are specific to the

1119

# EXTERNAL protection level.

1120

# configuring a CryptoKeyVersion that are specific to the

1121

# EXTERNAL protection level.

1122

"externalKeyUri": "A String", # The URI for an external resource that this CryptoKeyVersion represents.

1123

},

1124

"importJob": "A String", # Output only. The name of the ImportJob used to import this

1125

# CryptoKeyVersion. Only present if the underlying key material was

1126

# imported.

1127

"algorithm": "A String", # Output only. The CryptoKeyVersionAlgorithm that this

1128

# CryptoKeyVersion supports.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1129

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1130

"versionTemplate": { # A CryptoKeyVersionTemplate specifies the properties to use when creating # A template describing settings for new CryptoKeyVersion instances.

1131

# The properties of new CryptoKeyVersion instances created by either

1132

# CreateCryptoKeyVersion or

1133

# auto-rotation are controlled by this template.

1134

# a new CryptoKeyVersion, either manually with

1135

# CreateCryptoKeyVersion or

1136

# automatically as a result of auto-rotation.

1137

"algorithm": "A String", # Required. Algorithm to use

1138

# when creating a CryptoKeyVersion based on this template.

1139

#

1140

# For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both

1141

# this field is omitted and CryptoKey.purpose is

1142

# ENCRYPT_DECRYPT.

1143

"protectionLevel": "A String", # ProtectionLevel to use when creating a CryptoKeyVersion based on

1144

# this template. Immutable. Defaults to SOFTWARE.

1145

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1146

"rotationPeriod": "A String", # next_rotation_time will be advanced by this period when the service

1147

# automatically rotates a key. Must be at least 24 hours and at most

1148

# 876,000 hours.

1149

#

1150

# If rotation_period is set, next_rotation_time must also be set.

1151

#

1152

# Keys with purpose

1153

# ENCRYPT_DECRYPT support

1154

# automatic rotation. For other keys, this field must be omitted.

1155

"nextRotationTime": "A String", # At next_rotation_time, the Key Management Service will automatically:

1156

#

1157

# 1. Create a new version of this CryptoKey.

1158

# 2. Mark the new version as primary.

1159

#

1160

# Key rotations performed manually via

1161

# CreateCryptoKeyVersion and

1162

# UpdateCryptoKeyPrimaryVersion

1163

# do not affect next_rotation_time.

1164

#

1165

# Keys with purpose

1166

# ENCRYPT_DECRYPT support

1167

# automatic rotation. For other keys, this field must be omitted.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1168

},

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1169

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

1175

<pre>Retrieves the next page of results.

1176

1177

Args:

1178

previous_request: The request for the previous page. (required)

1179

previous_response: The response from the request for the previous page. (required)

1180

1181

Returns:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1182

A request object that you can call 'execute()' on to request the next

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1183

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1188

<code class="details" id="patch">patch(name, body=None, updateMask=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1189

<pre>Update a CryptoKey.

Args:

`projects/*/locations/*/keyRings/*/cryptoKeys/*`. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1194

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1195

The object takes the form of:

1196

1197

{ # A CryptoKey represents a logical key that can be used for cryptographic

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1198

# operations.

1199

#

1200

# A CryptoKey is made up of zero or more versions,

1201

# which represent the actual key material used in cryptographic operations.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1202

"labels": { # Labels with user-defined metadata. For more information, see

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1203

# [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1204

"a_key": "A String",

1205

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1206

"purpose": "A String", # Immutable. The immutable purpose of this CryptoKey.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1207

"createTime": "A String", # Output only. The time at which this CryptoKey was created.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1208

"name": "A String", # Output only. The resource name for this CryptoKey in the format

1209

# `projects/*/locations/*/keyRings/*/cryptoKeys/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1210

"primary": { # A CryptoKeyVersion represents an individual cryptographic key, and the # Output only. A copy of the "primary" CryptoKeyVersion that will be used

1211

# by Encrypt when this CryptoKey is given

1212

# in EncryptRequest.name.

1213

#

1214

# The CryptoKey's primary version can be updated via

1215

# UpdateCryptoKeyPrimaryVersion.

1216

#

1217

# Keys with purpose

1218

# ENCRYPT_DECRYPT may have a

1219

# primary. For other keys, this field will be omitted.

1220

# associated key material.

1221

#

1222

# An ENABLED version can be

1223

# used for cryptographic operations.

1224

#

1225

# For security reasons, the raw cryptographic key material represented by a

1226

# CryptoKeyVersion can never be viewed or exported. It can only be used to

1227

# encrypt, decrypt, or sign data when an authorized user or application invokes

1228

# Cloud KMS.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1229

"generateTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

1230

# generated.

1231

"name": "A String", # Output only. The resource name for this CryptoKeyVersion in the format

1232

# `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1233

"importTime": "A String", # Output only. The time at which this CryptoKeyVersion's key material

1234

# was imported.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1235

"importFailureReason": "A String", # Output only. The root cause of an import failure. Only present if

1236

# state is

1237

# IMPORT_FAILED.

1238

"state": "A String", # The current state of the CryptoKeyVersion.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1239

"attestation": { # Contains an HSM-generated attestation about a key operation. For more # Output only. Statement that was generated and signed by the HSM at key

1240

# creation time. Use this statement to verify attributes of the key as stored

1241

# on the HSM, independently of Google. Only provided for key versions with

1242

# protection_level HSM.

1243

# information, see [Verifying attestations]

1244

# (https://cloud.google.com/kms/docs/attest-key).

1245

"format": "A String", # Output only. The format of the attestation data.

1246

"content": "A String", # Output only. The attestation data provided by the HSM when the key

1247

# operation was performed.

1248

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1249

"createTime": "A String", # Output only. The time at which this CryptoKeyVersion was created.

1250

"destroyTime": "A String", # Output only. The time this CryptoKeyVersion's key material is scheduled

1251

# for destruction. Only present if state is

1252

# DESTROY_SCHEDULED.

1253

"destroyEventTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

1254

# destroyed. Only present if state is

1255

# DESTROYED.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1256

"protectionLevel": "A String", # Output only. The ProtectionLevel describing how crypto operations are

1257

# performed with this CryptoKeyVersion.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1258

"externalProtectionLevelOptions": { # ExternalProtectionLevelOptions stores a group of additional fields for # ExternalProtectionLevelOptions stores a group of additional fields for

1259

# configuring a CryptoKeyVersion that are specific to the

1260

# EXTERNAL protection level.

1261

# configuring a CryptoKeyVersion that are specific to the

1262

# EXTERNAL protection level.

1263

"externalKeyUri": "A String", # The URI for an external resource that this CryptoKeyVersion represents.

1264

},

1265

"importJob": "A String", # Output only. The name of the ImportJob used to import this

1266

# CryptoKeyVersion. Only present if the underlying key material was

1267

# imported.

1268

"algorithm": "A String", # Output only. The CryptoKeyVersionAlgorithm that this

1269

# CryptoKeyVersion supports.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1270

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1271

"versionTemplate": { # A CryptoKeyVersionTemplate specifies the properties to use when creating # A template describing settings for new CryptoKeyVersion instances.

1272

# The properties of new CryptoKeyVersion instances created by either

1273

# CreateCryptoKeyVersion or

1274

# auto-rotation are controlled by this template.

1275

# a new CryptoKeyVersion, either manually with

1276

# CreateCryptoKeyVersion or

1277

# automatically as a result of auto-rotation.

1278

"algorithm": "A String", # Required. Algorithm to use

1279

# when creating a CryptoKeyVersion based on this template.

1280

#

1281

# For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both

1282

# this field is omitted and CryptoKey.purpose is

1283

# ENCRYPT_DECRYPT.

1284

"protectionLevel": "A String", # ProtectionLevel to use when creating a CryptoKeyVersion based on

1285

# this template. Immutable. Defaults to SOFTWARE.

1286

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1287

"rotationPeriod": "A String", # next_rotation_time will be advanced by this period when the service

1288

# automatically rotates a key. Must be at least 24 hours and at most

1289

# 876,000 hours.

1290

#

1291

# If rotation_period is set, next_rotation_time must also be set.

1292

#

1293

# Keys with purpose

1294

# ENCRYPT_DECRYPT support

1295

# automatic rotation. For other keys, this field must be omitted.

1296

"nextRotationTime": "A String", # At next_rotation_time, the Key Management Service will automatically:

1297

#

1298

# 1. Create a new version of this CryptoKey.

1299

# 2. Mark the new version as primary.

1300

#

1301

# Key rotations performed manually via

1302

# CreateCryptoKeyVersion and

1303

# UpdateCryptoKeyPrimaryVersion

1304

# do not affect next_rotation_time.

1305

#

1306

# Keys with purpose

1307

# ENCRYPT_DECRYPT support

1308

# automatic rotation. For other keys, this field must be omitted.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1309

}

1310

1311

updateMask: string, Required. List of fields to be updated in this request.

1312

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1319

1320

{ # A CryptoKey represents a logical key that can be used for cryptographic

1321

# operations.

1322

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1323

# A CryptoKey is made up of zero or more versions,

1324

# which represent the actual key material used in cryptographic operations.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1325

"labels": { # Labels with user-defined metadata. For more information, see

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1326

# [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1327

"a_key": "A String",

1328

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1329

"purpose": "A String", # Immutable. The immutable purpose of this CryptoKey.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1330

"createTime": "A String", # Output only. The time at which this CryptoKey was created.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1331

"name": "A String", # Output only. The resource name for this CryptoKey in the format

1332

# `projects/*/locations/*/keyRings/*/cryptoKeys/*`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1333

"primary": { # A CryptoKeyVersion represents an individual cryptographic key, and the # Output only. A copy of the "primary" CryptoKeyVersion that will be used

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1334

# by Encrypt when this CryptoKey is given

1335

# in EncryptRequest.name.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1336

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1337

# The CryptoKey's primary version can be updated via

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1338

# UpdateCryptoKeyPrimaryVersion.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1339

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1340

# Keys with purpose

1341

# ENCRYPT_DECRYPT may have a

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1342

# primary. For other keys, this field will be omitted.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1343

# associated key material.

1344

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1345

# An ENABLED version can be

1346

# used for cryptographic operations.

1347

#

1348

# For security reasons, the raw cryptographic key material represented by a

1349

# CryptoKeyVersion can never be viewed or exported. It can only be used to

1350

# encrypt, decrypt, or sign data when an authorized user or application invokes

1351

# Cloud KMS.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1352

"generateTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

1353

# generated.

1354

"name": "A String", # Output only. The resource name for this CryptoKeyVersion in the format

1355

# `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1356

"importTime": "A String", # Output only. The time at which this CryptoKeyVersion's key material

1357

# was imported.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1358

"importFailureReason": "A String", # Output only. The root cause of an import failure. Only present if

1359

# state is

1360

# IMPORT_FAILED.

1361

"state": "A String", # The current state of the CryptoKeyVersion.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1362

"attestation": { # Contains an HSM-generated attestation about a key operation. For more # Output only. Statement that was generated and signed by the HSM at key

1363

# creation time. Use this statement to verify attributes of the key as stored

1364

# on the HSM, independently of Google. Only provided for key versions with

1365

# protection_level HSM.

1366

# information, see [Verifying attestations]

1367

# (https://cloud.google.com/kms/docs/attest-key).

1368

"format": "A String", # Output only. The format of the attestation data.

1369

"content": "A String", # Output only. The attestation data provided by the HSM when the key

1370

# operation was performed.

1371

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1372

"createTime": "A String", # Output only. The time at which this CryptoKeyVersion was created.

1373

"destroyTime": "A String", # Output only. The time this CryptoKeyVersion's key material is scheduled

1374

# for destruction. Only present if state is

1375

# DESTROY_SCHEDULED.

1376

"destroyEventTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

1377

# destroyed. Only present if state is

1378

# DESTROYED.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1379

"protectionLevel": "A String", # Output only. The ProtectionLevel describing how crypto operations are

1380

# performed with this CryptoKeyVersion.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1381

"externalProtectionLevelOptions": { # ExternalProtectionLevelOptions stores a group of additional fields for # ExternalProtectionLevelOptions stores a group of additional fields for

1382

# configuring a CryptoKeyVersion that are specific to the

1383

# EXTERNAL protection level.

1384

# configuring a CryptoKeyVersion that are specific to the

1385

# EXTERNAL protection level.

1386

"externalKeyUri": "A String", # The URI for an external resource that this CryptoKeyVersion represents.

1387

},

1388

"importJob": "A String", # Output only. The name of the ImportJob used to import this

1389

# CryptoKeyVersion. Only present if the underlying key material was

1390

# imported.

1391

"algorithm": "A String", # Output only. The CryptoKeyVersionAlgorithm that this

1392

# CryptoKeyVersion supports.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1393

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1394

"versionTemplate": { # A CryptoKeyVersionTemplate specifies the properties to use when creating # A template describing settings for new CryptoKeyVersion instances.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1395

# The properties of new CryptoKeyVersion instances created by either

1396

# CreateCryptoKeyVersion or

1397

# auto-rotation are controlled by this template.

1398

# a new CryptoKeyVersion, either manually with

1399

# CreateCryptoKeyVersion or

1400

# automatically as a result of auto-rotation.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1401

"algorithm": "A String", # Required. Algorithm to use

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1402

# when creating a CryptoKeyVersion based on this template.

1403

#

1404

# For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both

1405

# this field is omitted and CryptoKey.purpose is

1406

# ENCRYPT_DECRYPT.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1407

"protectionLevel": "A String", # ProtectionLevel to use when creating a CryptoKeyVersion based on

1408

# this template. Immutable. Defaults to SOFTWARE.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1409

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1410

"rotationPeriod": "A String", # next_rotation_time will be advanced by this period when the service

1411

# automatically rotates a key. Must be at least 24 hours and at most

1412

# 876,000 hours.

1413

#

1414

# If rotation_period is set, next_rotation_time must also be set.

1415

#

1416

# Keys with purpose

1417

# ENCRYPT_DECRYPT support

1418

# automatic rotation. For other keys, this field must be omitted.

1419

"nextRotationTime": "A String", # At next_rotation_time, the Key Management Service will automatically:

1420

#

1421

# 1. Create a new version of this CryptoKey.

1422

# 2. Mark the new version as primary.

1423

#

1424

# Key rotations performed manually via

1425

# CreateCryptoKeyVersion and

1426

# UpdateCryptoKeyPrimaryVersion

1427

# do not affect next_rotation_time.

1428

#

1429

# Keys with purpose

1430

# ENCRYPT_DECRYPT support

1431

# automatic rotation. For other keys, this field must be omitted.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1432

}</pre>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1436

<code class="details" id="setIamPolicy">setIamPolicy(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1437

<pre>Sets the access control policy on the specified resource. Replaces any

1438

existing policy.

1439

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1440

Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1441

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1442

Args:

1443

resource: string, REQUIRED: The resource for which the policy is being specified.

1444

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1445

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1446

The object takes the form of:

1447

1448

{ # Request message for `SetIamPolicy` method.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1449

"updateMask": "A String", # OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only

1450

# the fields in the mask will be modified. If no mask is provided, the

1451

# following default mask is used:

1452

#

1453

# `paths: "bindings, etag"`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1454

"policy": { # An Identity and Access Management (IAM) policy, which specifies access # REQUIRED: The complete policy to be applied to the `resource`. The size of

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1455

# the policy is limited to a few 10s of KB. An empty policy is a

1456

# valid policy but certain Cloud Platform services (such as Projects)

1457

# might reject them.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1458

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1459

#

1460

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1461

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1462

# `members` to a single `role`. Members can be user accounts, service accounts,

1463

# Google groups, and domains (such as G Suite). A `role` is a named list of

1464

# permissions; each `role` can be an IAM predefined role or a user-created

1465

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1466

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1467

# For some types of Google Cloud resources, a `binding` can also specify a

1468

# `condition`, which is a logical expression that allows access to a resource

1469

# only if the expression evaluates to `true`. A condition can add constraints

1470

# based on attributes of the request, the resource, or both. To learn which

1471

# resources support conditions in their IAM policies, see the

1472

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1473

#

1474

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1475

#

1476

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1477

# "bindings": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1478

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1479

# "role": "roles/resourcemanager.organizationAdmin",

1480

# "members": [

1481

# "user:mike@example.com",

1482

# "group:admins@example.com",

1483

# "domain:google.com",

1484

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1485

# ]

1486

# },

1487

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1488

# "role": "roles/resourcemanager.organizationViewer",

1489

# "members": [

1490

# "user:eve@example.com"

1491

# ],

1492

# "condition": {

1493

# "title": "expirable access",

1494

# "description": "Does not grant access after Sep 2020",

1495

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1496

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1497

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1498

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1499

# "etag": "BwWWja0YfJA=",

1500

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1501

# }

1502

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1503

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1508

# - group:admins@example.com

1509

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1510

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1511

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1512

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1513

# - user:eve@example.com

1514

# role: roles/resourcemanager.organizationViewer

1515

# condition:

1516

# title: expirable access

1517

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1518

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1519

# - etag: BwWWja0YfJA=

1520

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1521

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1522

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1523

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1524

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1525

# prevent simultaneous updates of a policy from overwriting each other.

1526

# It is strongly suggested that systems make use of the `etag` in the

1527

# read-modify-write cycle to perform policy updates in order to avoid race

1528

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1529

# systems are expected to put that etag in the request to `setIamPolicy` to

1530

# ensure that their change will be applied to the same version of the policy.

1531

#

1532

# **Important:** If you use IAM Conditions, you must include the `etag` field

1533

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1534

# you to overwrite a version `3` policy with a version `1` policy, and all of

1535

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1536

"version": 42, # Specifies the format of the policy.

1537

#

1538

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1539

# are rejected.

1540

#

1541

# Any operation that affects conditional role bindings must specify version

1542

# `3`. This requirement applies to the following operations:

1543

#

1544

# * Getting a policy that includes a conditional role binding

1545

# * Adding a conditional role binding to a policy

1546

# * Changing a conditional role binding in a policy

1547

# * Removing any role binding, with or without a condition, from a policy

1548

# that includes conditions

1549

#

1550

# **Important:** If you use IAM Conditions, you must include the `etag` field

1551

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1552

# you to overwrite a version `3` policy with a version `1` policy, and all of

1553

# the conditions in the version `3` policy are lost.

1554

#

1555

# If a policy does not include any conditions, operations on that policy may

1556

# specify any valid version or leave the field unset.

1557

#

1558

# To learn which resources support conditions in their IAM policies, see the

1559

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1560

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1561

# `condition` that determines how and when the `bindings` are applied. Each

1562

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1563

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1564

"role": "A String", # Role that is assigned to `members`.

1565

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1566

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1567

#

1568

# If the condition evaluates to `true`, then this binding applies to the

1569

# current request.

1570

#

1571

# If the condition evaluates to `false`, then this binding does not apply to

1572

# the current request. However, a different role binding might grant the same

1573

# role to one or more of the members in this binding.

1574

#

1575

# To learn which resources support conditions in their IAM policies, see the

1576

# [IAM

1577

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1578

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1579

# are documented at https://github.com/google/cel-spec.

1580

#

1581

# Example (Comparison):

1582

#

1583

# title: "Summary size limit"

1584

# description: "Determines if a summary is less than 100 chars"

1585

# expression: "document.summary.size() < 100"

1586

#

1587

# Example (Equality):

1588

#

1589

# title: "Requestor is owner"

1590

# description: "Determines if requestor is the document owner"

1591

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1596

# description: "Determine whether the document should be publicly visible"

1597

# expression: "document.type != 'private' && document.type != 'internal'"

1598

#

1599

# Example (Data Manipulation):

1600

#

1601

# title: "Notification string"

1602

# description: "Create a notification string with a timestamp."

1603

# expression: "'New message received at ' + string(document.create_time)"

1604

#

1605

# The exact variables and functions that may be referenced within an expression

1606

# are determined by the service that evaluates it. See the service

1607

# documentation for additional information.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1608

"description": "A String", # Optional. Description of the expression. This is a longer text which

1609

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1610

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1611

# its purpose. This can be used e.g. in UIs which allow to enter the

1612

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1613

"expression": "A String", # Textual representation of an expression in Common Expression Language

1614

# syntax.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1615

"location": "A String", # Optional. String indicating the location of the expression for error

1616

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1617

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1618

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

1619

# `members` can have the following values:

1620

#

1621

# * `allUsers`: A special identifier that represents anyone who is

1622

# on the internet; with or without a Google account.

1623

#

1624

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1625

# who is authenticated with a Google account or a service account.

1626

#

1627

# * `user:{emailid}`: An email address that represents a specific Google

1628

# account. For example, `alice@example.com` .

1629

#

1630

#

1631

# * `serviceAccount:{emailid}`: An email address that represents a service

1632

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1633

#

1634

# * `group:{emailid}`: An email address that represents a Google group.

1635

# For example, `admins@example.com`.

1636

#

1637

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1638

# identifier) representing a user that has been recently deleted. For

1639

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1640

# recovered, this value reverts to `user:{emailid}` and the recovered user

1641

# retains the role in the binding.

1642

#

1643

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1644

# unique identifier) representing a service account that has been recently

1645

# deleted. For example,

1646

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1647

# If the service account is undeleted, this value reverts to

1648

# `serviceAccount:{emailid}` and the undeleted service account retains the

1649

# role in the binding.

1650

#

1651

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1652

# identifier) representing a Google group that has been recently

1653

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1654

# the group is recovered, this value reverts to `group:{emailid}` and the

1655

# recovered group retains the role in the binding.

1656

#

1657

#

1658

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

1659

# users of that domain. For example, `google.com` or `example.com`.

1660

#

1661

"A String",

1662

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1663

},

1664

],

1665

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1666

{ # Specifies the audit configuration for a service.

1667

# The configuration determines which permission types are logged, and what

1668

# identities, if any, are exempted from logging.

1669

# An AuditConfig must have one or more AuditLogConfigs.

1670

#

1671

# If there are AuditConfigs for both `allServices` and a specific service,

1672

# the union of the two AuditConfigs is used for that service: the log_types

1673

# specified in each AuditConfig are enabled, and the exempted_members in each

1674

# AuditLogConfig are exempted.

1675

#

1676

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices",

1682

# "audit_log_configs": [

1683

# {

1684

# "log_type": "DATA_READ",

1685

# "exempted_members": [

1686

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

1691

# },

1692

# {

1693

# "log_type": "ADMIN_READ"

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com",

1699

# "audit_log_configs": [

1700

# {

1701

# "log_type": "DATA_READ"

1702

# },

1703

# {

1704

# "log_type": "DATA_WRITE",

1705

# "exempted_members": [

1706

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

1715

# logging. It also exempts jose@example.com from DATA_READ logging, and

1716

# aliya@example.com from DATA_WRITE logging.

1717

"auditLogConfigs": [ # The configuration for logging of each type of permission.

1718

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

1723

# {

1724

# "log_type": "DATA_READ",

1725

# "exempted_members": [

1726

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

1736

# jose@example.com from DATA_READ logging.

1737

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

1738

# permission.

1739

# Follows the same format of Binding.members.

1740

"A String",

1741

],

1742

"logType": "A String", # The log type that this config enables.

1743

},

1744

],

1745

"service": "A String", # Specifies a service that will be enabled for audit logging.

1746

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

1747

# `allServices` is a special value that covers all services.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1748

},

1749

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1750

},

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1751

}

1752

1753

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1760

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1761

{ # An Identity and Access Management (IAM) policy, which specifies access

1762

# controls for Google Cloud resources.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1763

#

1764

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1765

# A `Policy` is a collection of `bindings`. A `binding` binds one or more

1766

# `members` to a single `role`. Members can be user accounts, service accounts,

1767

# Google groups, and domains (such as G Suite). A `role` is a named list of

1768

# permissions; each `role` can be an IAM predefined role or a user-created

1769

# custom role.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1770

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1771

# For some types of Google Cloud resources, a `binding` can also specify a

1772

# `condition`, which is a logical expression that allows access to a resource

1773

# only if the expression evaluates to `true`. A condition can add constraints

1774

# based on attributes of the request, the resource, or both. To learn which

1775

# resources support conditions in their IAM policies, see the

1776

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1777

#

1778

# **JSON example:**

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1779

#

1780

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1781

# "bindings": [

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1782

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1783

# "role": "roles/resourcemanager.organizationAdmin",

1784

# "members": [

1785

# "user:mike@example.com",

1786

# "group:admins@example.com",

1787

# "domain:google.com",

1788

# "serviceAccount:my-project-id@appspot.gserviceaccount.com"

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1789

# ]

1790

# },

1791

# {

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1792

# "role": "roles/resourcemanager.organizationViewer",

1793

# "members": [

1794

# "user:eve@example.com"

1795

# ],

1796

# "condition": {

1797

# "title": "expirable access",

1798

# "description": "Does not grant access after Sep 2020",

1799

# "expression": "request.time < timestamp('2020-10-01T00:00:00.000Z')",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1800

# }

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1801

# }

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1802

# ],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1803

# "etag": "BwWWja0YfJA=",

1804

# "version": 3

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1805

# }

1806

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1807

# **YAML example:**

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

#

# bindings:

# - members:

# - user:mike@example.com

1812

# - group:admins@example.com

1813

# - domain:google.com

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1814

# - serviceAccount:my-project-id@appspot.gserviceaccount.com

1815

# role: roles/resourcemanager.organizationAdmin

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1816

# - members:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1817

# - user:eve@example.com

1818

# role: roles/resourcemanager.organizationViewer

1819

# condition:

1820

# title: expirable access

1821

# description: Does not grant access after Sep 2020

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1822

# expression: request.time < timestamp('2020-10-01T00:00:00.000Z')

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1823

# - etag: BwWWja0YfJA=

1824

# - version: 3

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1825

#

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

1826

# For a description of IAM and its features, see the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1827

# [IAM documentation](https://cloud.google.com/iam/docs/).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1828

"etag": "A String", # `etag` is used for optimistic concurrency control as a way to help

1829

# prevent simultaneous updates of a policy from overwriting each other.

1830

# It is strongly suggested that systems make use of the `etag` in the

1831

# read-modify-write cycle to perform policy updates in order to avoid race

1832

# conditions: An `etag` is returned in the response to `getIamPolicy`, and

1833

# systems are expected to put that etag in the request to `setIamPolicy` to

1834

# ensure that their change will be applied to the same version of the policy.

1835

#

1836

# **Important:** If you use IAM Conditions, you must include the `etag` field

1837

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1838

# you to overwrite a version `3` policy with a version `1` policy, and all of

1839

# the conditions in the version `3` policy are lost.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1840

"version": 42, # Specifies the format of the policy.

1841

#

1842

# Valid values are `0`, `1`, and `3`. Requests that specify an invalid value

1843

# are rejected.

1844

#

1845

# Any operation that affects conditional role bindings must specify version

1846

# `3`. This requirement applies to the following operations:

1847

#

1848

# * Getting a policy that includes a conditional role binding

1849

# * Adding a conditional role binding to a policy

1850

# * Changing a conditional role binding in a policy

1851

# * Removing any role binding, with or without a condition, from a policy

1852

# that includes conditions

1853

#

1854

# **Important:** If you use IAM Conditions, you must include the `etag` field

1855

# whenever you call `setIamPolicy`. If you omit this field, then IAM allows

1856

# you to overwrite a version `3` policy with a version `1` policy, and all of

1857

# the conditions in the version `3` policy are lost.

1858

#

1859

# If a policy does not include any conditions, operations on that policy may

1860

# specify any valid version or leave the field unset.

1861

#

1862

# To learn which resources support conditions in their IAM policies, see the

1863

# [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1864

"bindings": [ # Associates a list of `members` to a `role`. Optionally, may specify a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1865

# `condition` that determines how and when the `bindings` are applied. Each

1866

# of the `bindings` must contain at least one member.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1867

{ # Associates `members` with a `role`.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1868

"role": "A String", # Role that is assigned to `members`.

1869

# For example, `roles/viewer`, `roles/editor`, or `roles/owner`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1870

"condition": { # Represents a textual expression in the Common Expression Language (CEL) # The condition that is associated with this binding.

1871

#

1872

# If the condition evaluates to `true`, then this binding applies to the

1873

# current request.

1874

#

1875

# If the condition evaluates to `false`, then this binding does not apply to

1876

# the current request. However, a different role binding might grant the same

1877

# role to one or more of the members in this binding.

1878

#

1879

# To learn which resources support conditions in their IAM policies, see the

1880

# [IAM

1881

# documentation](https://cloud.google.com/iam/help/conditions/resource-policies).

1882

# syntax. CEL is a C-like expression language. The syntax and semantics of CEL

1883

# are documented at https://github.com/google/cel-spec.

1884

#

1885

# Example (Comparison):

1886

#

1887

# title: "Summary size limit"

1888

# description: "Determines if a summary is less than 100 chars"

1889

# expression: "document.summary.size() < 100"

1890

#

1891

# Example (Equality):

1892

#

1893

# title: "Requestor is owner"

1894

# description: "Determines if requestor is the document owner"

1895

# expression: "document.owner == request.auth.claims.email"

#

# Example (Logic):

#

# title: "Public documents"

1900

# description: "Determine whether the document should be publicly visible"

1901

# expression: "document.type != 'private' && document.type != 'internal'"

1902

#

1903

# Example (Data Manipulation):

1904

#

1905

# title: "Notification string"

1906

# description: "Create a notification string with a timestamp."

1907

# expression: "'New message received at ' + string(document.create_time)"

1908

#

1909

# The exact variables and functions that may be referenced within an expression

1910

# are determined by the service that evaluates it. See the service

1911

# documentation for additional information.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1912

"description": "A String", # Optional. Description of the expression. This is a longer text which

1913

# describes the expression, e.g. when hovered over it in a UI.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1914

"title": "A String", # Optional. Title for the expression, i.e. a short string describing

1915

# its purpose. This can be used e.g. in UIs which allow to enter the

1916

# expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1917

"expression": "A String", # Textual representation of an expression in Common Expression Language

1918

# syntax.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1919

"location": "A String", # Optional. String indicating the location of the expression for error

1920

# reporting, e.g. a file name and a position in the file.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1921

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1922

"members": [ # Specifies the identities requesting access for a Cloud Platform resource.

1923

# `members` can have the following values:

1924

#

1925

# * `allUsers`: A special identifier that represents anyone who is

1926

# on the internet; with or without a Google account.

1927

#

1928

# * `allAuthenticatedUsers`: A special identifier that represents anyone

1929

# who is authenticated with a Google account or a service account.

1930

#

1931

# * `user:{emailid}`: An email address that represents a specific Google

1932

# account. For example, `alice@example.com` .

1933

#

1934

#

1935

# * `serviceAccount:{emailid}`: An email address that represents a service

1936

# account. For example, `my-other-app@appspot.gserviceaccount.com`.

1937

#

1938

# * `group:{emailid}`: An email address that represents a Google group.

1939

# For example, `admins@example.com`.

1940

#

1941

# * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique

1942

# identifier) representing a user that has been recently deleted. For

1943

# example, `alice@example.com?uid=123456789012345678901`. If the user is

1944

# recovered, this value reverts to `user:{emailid}` and the recovered user

1945

# retains the role in the binding.

1946

#

1947

# * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus

1948

# unique identifier) representing a service account that has been recently

1949

# deleted. For example,

1950

# `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.

1951

# If the service account is undeleted, this value reverts to

1952

# `serviceAccount:{emailid}` and the undeleted service account retains the

1953

# role in the binding.

1954

#

1955

# * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique

1956

# identifier) representing a Google group that has been recently

1957

# deleted. For example, `admins@example.com?uid=123456789012345678901`. If

1958

# the group is recovered, this value reverts to `group:{emailid}` and the

1959

# recovered group retains the role in the binding.

1960

#

1961

#

1962

# * `domain:{domain}`: The G Suite domain (primary) that represents all the

1963

# users of that domain. For example, `google.com` or `example.com`.

1964

#

1965

"A String",

1966

],

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1967

},

1968

],

1969

"auditConfigs": [ # Specifies cloud audit logging configuration for this policy.

1970

{ # Specifies the audit configuration for a service.

1971

# The configuration determines which permission types are logged, and what

1972

# identities, if any, are exempted from logging.

1973

# An AuditConfig must have one or more AuditLogConfigs.

1974

#

1975

# If there are AuditConfigs for both `allServices` and a specific service,

1976

# the union of the two AuditConfigs is used for that service: the log_types

1977

# specified in each AuditConfig are enabled, and the exempted_members in each

1978

# AuditLogConfig are exempted.

1979

#

1980

# Example Policy with multiple AuditConfigs:

#

# {

# "audit_configs": [

# {

# "service": "allServices",

1986

# "audit_log_configs": [

1987

# {

1988

# "log_type": "DATA_READ",

1989

# "exempted_members": [

1990

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

1995

# },

1996

# {

1997

# "log_type": "ADMIN_READ"

# }

# ]

# },

# {

# "service": "sampleservice.googleapis.com",

2003

# "audit_log_configs": [

2004

# {

2005

# "log_type": "DATA_READ"

2006

# },

2007

# {

2008

# "log_type": "DATA_WRITE",

2009

# "exempted_members": [

2010

# "user:aliya@example.com"

# ]

# }

# ]

# }

# ]

# }

#

# For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ

2019

# logging. It also exempts jose@example.com from DATA_READ logging, and

2020

# aliya@example.com from DATA_WRITE logging.

2021

"auditLogConfigs": [ # The configuration for logging of each type of permission.

2022

{ # Provides the configuration for logging a type of permissions.

# Example:

#

# {

# "audit_log_configs": [

2027

# {

2028

# "log_type": "DATA_READ",

2029

# "exempted_members": [

2030

# "user:jose@example.com"

# ]

# },

# {

# "log_type": "DATA_WRITE"

# }

# ]

# }

#

# This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting

2040

# jose@example.com from DATA_READ logging.

2041

"exemptedMembers": [ # Specifies the identities that do not cause logging for this type of

2042

# permission.

2043

# Follows the same format of Binding.members.

2044

"A String",

2045

],

2046

"logType": "A String", # The log type that this config enables.

2047

},

2048

],

2049

"service": "A String", # Specifies a service that will be enabled for audit logging.

2050

# For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.

2051

# `allServices` is a special value that covers all services.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2052

},

2053

],

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2058

<code class="details" id="testIamPermissions">testIamPermissions(resource, body=None, x__xgafv=None)</code>

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2059

<pre>Returns permissions that a caller has on the specified resource.

2060

If the resource does not exist, this will return an empty set of

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2061

permissions, not a `NOT_FOUND` error.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2062

2063

Note: This operation is designed to be used for building permission-aware

2064

UIs and command-line tools, not for authorization checking. This operation

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2065

may "fail open" without warning.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2066

2067

Args:

2068

resource: string, REQUIRED: The resource for which the policy detail is being requested.

2069

See the operation documentation for the appropriate value for this field. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2070

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2071

The object takes the form of:

2072

2073

{ # Request message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2074

"permissions": [ # The set of permissions to check for the `resource`. Permissions with

2075

# wildcards (such as '*' or 'storage.*') are not allowed. For more

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2076

# information see

2077

# [IAM Overview](https://cloud.google.com/iam/docs/overview#permissions).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2078

"A String",

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

],

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2089

2090

{ # Response message for `TestIamPermissions` method.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2091

"permissions": [ # A subset of `TestPermissionsRequest.permissions` that the caller is

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2092

# allowed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2093

"A String",

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

],

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2099

<code class="details" id="updatePrimaryVersion">updatePrimaryVersion(name, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2100

<pre>Update the version of a CryptoKey that will be used in Encrypt.

2101

2102

Returns an error if called on an asymmetric key.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2103

2104

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2105

2106

body: object, The request body.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2107

The object takes the form of:

2108

2109

{ # Request message for KeyManagementService.UpdateCryptoKeyPrimaryVersion.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2110

"cryptoKeyVersionId": "A String", # Required. The id of the child CryptoKeyVersion to use as primary.

Sai Cheemalapati

2017-03-13 12:12:03 -0400

[diff] [blame]

2111

}

2112

2113

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2120

2121

{ # A CryptoKey represents a logical key that can be used for cryptographic

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2122

# operations.

2123

#

2124

# A CryptoKey is made up of zero or more versions,

2125

# which represent the actual key material used in cryptographic operations.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2126

"labels": { # Labels with user-defined metadata. For more information, see

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2127

# [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2128

"a_key": "A String",

2129

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2130

"purpose": "A String", # Immutable. The immutable purpose of this CryptoKey.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2131

"createTime": "A String", # Output only. The time at which this CryptoKey was created.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2132

"name": "A String", # Output only. The resource name for this CryptoKey in the format

2133

# `projects/*/locations/*/keyRings/*/cryptoKeys/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2134

"primary": { # A CryptoKeyVersion represents an individual cryptographic key, and the # Output only. A copy of the "primary" CryptoKeyVersion that will be used

2135

# by Encrypt when this CryptoKey is given

2136

# in EncryptRequest.name.

2137

#

2138

# The CryptoKey's primary version can be updated via

2139

# UpdateCryptoKeyPrimaryVersion.

2140

#

2141

# Keys with purpose

2142

# ENCRYPT_DECRYPT may have a

2143

# primary. For other keys, this field will be omitted.

2144

# associated key material.

2145

#

2146

# An ENABLED version can be

2147

# used for cryptographic operations.

2148

#

2149

# For security reasons, the raw cryptographic key material represented by a

2150

# CryptoKeyVersion can never be viewed or exported. It can only be used to

2151

# encrypt, decrypt, or sign data when an authorized user or application invokes

2152

# Cloud KMS.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2153

"generateTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

2154

# generated.

2155

"name": "A String", # Output only. The resource name for this CryptoKeyVersion in the format

2156

# `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2157

"importTime": "A String", # Output only. The time at which this CryptoKeyVersion's key material

2158

# was imported.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2159

"importFailureReason": "A String", # Output only. The root cause of an import failure. Only present if

2160

# state is

2161

# IMPORT_FAILED.

2162

"state": "A String", # The current state of the CryptoKeyVersion.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2163

"attestation": { # Contains an HSM-generated attestation about a key operation. For more # Output only. Statement that was generated and signed by the HSM at key

2164

# creation time. Use this statement to verify attributes of the key as stored

2165

# on the HSM, independently of Google. Only provided for key versions with

2166

# protection_level HSM.

2167

# information, see [Verifying attestations]

2168

# (https://cloud.google.com/kms/docs/attest-key).

2169

"format": "A String", # Output only. The format of the attestation data.

2170

"content": "A String", # Output only. The attestation data provided by the HSM when the key

2171

# operation was performed.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2172

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2173

"createTime": "A String", # Output only. The time at which this CryptoKeyVersion was created.

2174

"destroyTime": "A String", # Output only. The time this CryptoKeyVersion's key material is scheduled

2175

# for destruction. Only present if state is

2176

# DESTROY_SCHEDULED.

2177

"destroyEventTime": "A String", # Output only. The time this CryptoKeyVersion's key material was

2178

# destroyed. Only present if state is

2179

# DESTROYED.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2180

"protectionLevel": "A String", # Output only. The ProtectionLevel describing how crypto operations are

2181

# performed with this CryptoKeyVersion.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2182

"externalProtectionLevelOptions": { # ExternalProtectionLevelOptions stores a group of additional fields for # ExternalProtectionLevelOptions stores a group of additional fields for

2183

# configuring a CryptoKeyVersion that are specific to the

2184

# EXTERNAL protection level.

2185

# configuring a CryptoKeyVersion that are specific to the

2186

# EXTERNAL protection level.

2187

"externalKeyUri": "A String", # The URI for an external resource that this CryptoKeyVersion represents.

2188

},

2189

"importJob": "A String", # Output only. The name of the ImportJob used to import this

2190

# CryptoKeyVersion. Only present if the underlying key material was

2191

# imported.

2192

"algorithm": "A String", # Output only. The CryptoKeyVersionAlgorithm that this

2193

# CryptoKeyVersion supports.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2194

},

Bu Sun Kim