Skip to content

Commit 9ad46e3

Browse files
gcf-owl-bot[bot]quirogas
gcf-owl-bot[bot]
and
quirogas
authored
feat: [kms] Add KeyProjectResolutionMode to AutokeyConfig to support project-level configurations (#7239)
* feat: Added DeleteCryptoKey and DeleteCryptoKeyVersion RPCs to permanently remove resources feat: Introduced the RetiredResource resource to track records of deleted keys and prevent the reuse of their resource names feat: Added ListRetiredResources and GetRetiredResource RPCs to manage and view these records PiperOrigin-RevId: 868670725 Source-Link: googleapis/googleapis@f248ed0 Source-Link: googleapis/googleapis-gen@78b3172 Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWttcy8uT3dsQm90LnlhbWwiLCJoIjoiNzhiMzE3MjE2YTk2MWUxMGY0MjY0ODdmMTA5NzI4MDQ5MTJiODVlYyJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * feat: Add KeyProjectResolutionMode to AutokeyConfig to support project-level configurations feat: Add more post-quantum (PQ) signature algorithms to CryptoKeyVersion docs: Update documentation for AutokeyAdmin service and messages to support folder and project-level configurations docs: Clarify supported resources for the crypto_key_backend field in ImportJob PiperOrigin-RevId: 870858133 Source-Link: googleapis/googleapis@b026ba8 Source-Link: googleapis/googleapis-gen@958c60c Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWttcy8uT3dsQm90LnlhbWwiLCJoIjoiOTU4YzYwYzk4NDRlNmIxYzQzNzhjNDNlMzRlYmU4N2U2NjFhMzMyMCJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com> Co-authored-by: Santiago Quiroga <[email protected]>
1 parent 279c8b8 commit 9ad46e3

27 files changed

Lines changed: 7431 additions & 743 deletions

‎packages/google-cloud-kms/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ Samples are in the [`samples/`][homepage_samples] directory. Each sample's `READ
8888
| create key ring | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.create_key_ring.js) |
8989
| decapsulate | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.decapsulate.js) |
9090
| decrypt | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.decrypt.js) |
91+
| delete crypto key | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.delete_crypto_key.js) |
92+
| delete crypto key version | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.delete_crypto_key_version.js) |
9193
| destroy crypto key version | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.destroy_crypto_key_version.js) |
9294
| encrypt | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.encrypt.js) |
9395
| generate random bytes | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.generate_random_bytes.js) |
@@ -96,11 +98,13 @@ Samples are in the [`samples/`][homepage_samples] directory. Each sample's `READ
9698
| get import job | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.get_import_job.js) |
9799
| get key ring | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.get_key_ring.js) |
98100
| get public key | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.get_public_key.js) |
101+
| get retired resource | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.get_retired_resource.js) |
99102
| import crypto key version | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.import_crypto_key_version.js) |
100103
| list crypto key versions | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.list_crypto_key_versions.js) |
101104
| list crypto keys | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.list_crypto_keys.js) |
102105
| list import jobs | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.list_import_jobs.js) |
103106
| list key rings | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.list_key_rings.js) |
107+
| list retired resources | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.list_retired_resources.js) |
104108
| mac sign | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.mac_sign.js) |
105109
| mac verify | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.mac_verify.js) |
106110
| raw decrypt | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.raw_decrypt.js) |

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/autokey.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/autokey_admin.proto‎

Lines changed: 64 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -28,21 +28,23 @@ option java_outer_classname = "AutokeyAdminProto";
2828
option java_package = "com.google.cloud.kms.v1";
2929

3030
// Provides interfaces for managing [Cloud KMS
31-
// Autokey](https://cloud.google.com/kms/help/autokey) folder-level
32-
// configurations. A configuration is inherited by all descendent projects. A
33-
// configuration at one folder overrides any other configurations in its
34-
// ancestry. Setting a configuration on a folder is a prerequisite for Cloud KMS
35-
// Autokey, so that users working in a descendant project can request
36-
// provisioned [CryptoKeys][google.cloud.kms.v1.CryptoKey], ready for Customer
37-
// Managed Encryption Key (CMEK) use, on-demand.
31+
// Autokey](https://cloud.google.com/kms/help/autokey) folder-level or
32+
// project-level configurations. A configuration is inherited by all descendent
33+
// folders and projects. A configuration at a folder or project overrides any
34+
// other configurations in its ancestry. Setting a configuration on a folder is
35+
// a prerequisite for Cloud KMS Autokey, so that users working in a descendant
36+
// project can request provisioned [CryptoKeys][google.cloud.kms.v1.CryptoKey],
37+
// ready for Customer Managed Encryption Key (CMEK) use, on-demand when using
38+
// the dedicated key project mode. This is not required when using the delegated
39+
// key management mode for same-project keys.
3840
service AutokeyAdmin {
3941
option (google.api.default_host) = "cloudkms.googleapis.com";
4042
option (google.api.oauth_scopes) =
4143
"https://www.googleapis.com/auth/cloud-platform,"
4244
"https://www.googleapis.com/auth/cloudkms";
4345

44-
// Updates the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] for a
45-
// folder. The caller must have both `cloudkms.autokeyConfigs.update`
46+
// Updates the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] for a folder
47+
// or a project. The caller must have both `cloudkms.autokeyConfigs.update`
4648
// permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy`
4749
// permission on the provided key project. A
4850
// [KeyHandle][google.cloud.kms.v1.KeyHandle] creation in the folder's
@@ -52,15 +54,20 @@ service AutokeyAdmin {
5254
option (google.api.http) = {
5355
patch: "/v1/{autokey_config.name=folders/*/autokeyConfig}"
5456
body: "autokey_config"
57+
additional_bindings {
58+
patch: "/v1/{autokey_config.name=projects/*/autokeyConfig}"
59+
body: "autokey_config"
60+
}
5561
};
5662
option (google.api.method_signature) = "autokey_config,update_mask";
5763
}
5864

59-
// Returns the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] for a
60-
// folder.
65+
// Returns the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] for a folder
66+
// or project.
6167
rpc GetAutokeyConfig(GetAutokeyConfigRequest) returns (AutokeyConfig) {
6268
option (google.api.http) = {
6369
get: "/v1/{name=folders/*/autokeyConfig}"
70+
additional_bindings { get: "/v1/{name=projects/*/autokeyConfig}" }
6471
};
6572
option (google.api.method_signature) = "name";
6673
}
@@ -93,7 +100,8 @@ message UpdateAutokeyConfigRequest {
93100
// [GetAutokeyConfig][google.cloud.kms.v1.AutokeyAdmin.GetAutokeyConfig].
94101
message GetAutokeyConfigRequest {
95102
// Required. Name of the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig]
96-
// resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`.
103+
// resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig` or
104+
// `projects/{PROJECT_NUMBER}/autokeyConfig`.
97105
string name = 1 [
98106
(google.api.field_behavior) = REQUIRED,
99107
(google.api.resource_reference) = {
@@ -107,6 +115,7 @@ message AutokeyConfig {
107115
option (google.api.resource) = {
108116
type: "cloudkms.googleapis.com/AutokeyConfig"
109117
pattern: "folders/{folder}/autokeyConfig"
118+
pattern: "projects/{project}/autokeyConfig"
110119
plural: "autokeyConfigs"
111120
singular: "autokeyConfig"
112121
};
@@ -126,10 +135,45 @@ message AutokeyConfig {
126135
// The AutokeyConfig is not yet initialized or has been reset to its default
127136
// uninitialized state.
128137
UNINITIALIZED = 3;
138+
139+
// The service account lacks the necessary permissions in the key project to
140+
// configure Autokey.
141+
KEY_PROJECT_PERMISSION_DENIED = 4;
142+
}
143+
144+
// Defines the resolution mode enum for the key project.
145+
// The
146+
// [KeyProjectResolutionMode][google.cloud.kms.v1.AutokeyConfig.KeyProjectResolutionMode]
147+
// determines the mechanism by which
148+
// [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] identifies a
149+
// [key_project][google.cloud.kms.v1.AutokeyConfig.key_project] at its
150+
// specific configuration node. This parameter also determines if Autokey can
151+
// be used within this project or folder.
152+
enum KeyProjectResolutionMode {
153+
// Default value. KeyProjectResolutionMode when not specified will act as
154+
// `DEDICATED_KEY_PROJECT`.
155+
KEY_PROJECT_RESOLUTION_MODE_UNSPECIFIED = 0;
156+
157+
// Keys are created in a dedicated project specified by `key_project`.
158+
DEDICATED_KEY_PROJECT = 1;
159+
160+
// Keys are created in the same project as the resource requesting the key.
161+
// The `key_project` must not be set when this mode is used.
162+
RESOURCE_PROJECT = 2;
163+
164+
// Disables the AutokeyConfig. When this mode is set, any AutokeyConfig
165+
// from higher levels in the resource hierarchy are ignored for this
166+
// resource and its descendants. This setting can be overridden
167+
// by a more specific configuration at a lower level. For example,
168+
// if Autokey is disabled on a folder, it can be re-enabled on a sub-folder
169+
// or project within that folder by setting a different mode (e.g.,
170+
// DEDICATED_KEY_PROJECT or RESOURCE_PROJECT).
171+
DISABLED = 3;
129172
}
130173

131174
// Identifier. Name of the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig]
132-
// resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`.
175+
// resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig` or
176+
// `projects/{PROJECT_NUMBER}/autokeyConfig`.
133177
string name = 1 [(google.api.field_behavior) = IDENTIFIER];
134178

135179
// Optional. Name of the key project, e.g. `projects/{PROJECT_ID}` or
@@ -153,6 +197,12 @@ message AutokeyConfig {
153197
// an up-to-date value before proceeding. The request will be rejected with an
154198
// ABORTED error on a mismatched etag.
155199
string etag = 6 [(google.api.field_behavior) = OPTIONAL];
200+
201+
// Optional. KeyProjectResolutionMode for the AutokeyConfig.
202+
// Valid values are `DEDICATED_KEY_PROJECT`, `RESOURCE_PROJECT`, or
203+
// `DISABLED`.
204+
KeyProjectResolutionMode key_project_resolution_mode = 8
205+
[(google.api.field_behavior) = OPTIONAL];
156206
}
157207

158208
// Request message for

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/ekm_service.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/resources.proto‎

Lines changed: 62 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -490,13 +490,40 @@ message CryptoKeyVersion {
490490
// datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/.
491491
KEM_XWING = 63;
492492

493+
// The post-quantum Module-Lattice-Based Digital Signature Algorithm, at
494+
// security level 1. Randomized version.
495+
PQ_SIGN_ML_DSA_44 = 68;
496+
493497
// The post-quantum Module-Lattice-Based Digital Signature Algorithm, at
494498
// security level 3. Randomized version.
495499
PQ_SIGN_ML_DSA_65 = 56;
496500

501+
// The post-quantum Module-Lattice-Based Digital Signature Algorithm, at
502+
// security level 5. Randomized version.
503+
PQ_SIGN_ML_DSA_87 = 69;
504+
497505
// The post-quantum stateless hash-based digital signature algorithm, at
498506
// security level 1. Randomized version.
499507
PQ_SIGN_SLH_DSA_SHA2_128S = 57;
508+
509+
// The post-quantum stateless hash-based digital signature algorithm, at
510+
// security level 1. Randomized pre-hash version supporting SHA256 digests.
511+
PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256 = 60;
512+
513+
// The post-quantum Module-Lattice-Based Digital Signature Algorithm, at
514+
// security level 1. Randomized version supporting externally-computed
515+
// message representatives.
516+
PQ_SIGN_ML_DSA_44_EXTERNAL_MU = 70;
517+
518+
// The post-quantum Module-Lattice-Based Digital Signature Algorithm, at
519+
// security level 3. Randomized version supporting externally-computed
520+
// message representatives.
521+
PQ_SIGN_ML_DSA_65_EXTERNAL_MU = 67;
522+
523+
// The post-quantum Module-Lattice-Based Digital Signature Algorithm, at
524+
// security level 5. Randomized version supporting externally-computed
525+
// message representatives.
526+
PQ_SIGN_ML_DSA_87_EXTERNAL_MU = 71;
500527
}
501528

502529
// The state of a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion],
@@ -999,8 +1026,7 @@ message ImportJob {
9991026
// operations are performed. Currently, this field is only populated for keys
10001027
// stored in HSM_SINGLE_TENANT. Note, this list is non-exhaustive and may
10011028
// apply to additional [ProtectionLevels][google.cloud.kms.v1.ProtectionLevel]
1002-
// in the future.
1003-
// Supported resources:
1029+
// in the future. Supported resources:
10041030
// * `"projects/*/locations/*/singleTenantHsmInstances/*"`
10051031
string crypto_key_backend = 11 [
10061032
(google.api.field_behavior) = IMMUTABLE,
@@ -1040,6 +1066,40 @@ message KeyAccessJustificationsPolicy {
10401066
repeated AccessReason allowed_access_reasons = 1;
10411067
}
10421068

1069+
// A RetiredResource resource represents the record of a deleted
1070+
// [CryptoKey][google.cloud.kms.v1.CryptoKey]. Its purpose is to provide
1071+
// visibility into retained user data and to prevent reuse of these names for
1072+
// new [CryptoKeys][google.cloud.kms.v1.CryptoKey].
1073+
message RetiredResource {
1074+
option (google.api.resource) = {
1075+
type: "cloudkms.googleapis.com/RetiredResource"
1076+
pattern: "projects/{project}/locations/{location}/retiredResources/{retired_resource}"
1077+
plural: "retiredResources"
1078+
singular: "retiredResource"
1079+
};
1080+
1081+
// Output only. Identifier. The resource name for this
1082+
// [RetiredResource][google.cloud.kms.v1.RetiredResource] in the format
1083+
// `projects/*/locations/*/retiredResources/*`.
1084+
string name = 1 [
1085+
(google.api.field_behavior) = OUTPUT_ONLY,
1086+
(google.api.field_behavior) = IDENTIFIER
1087+
];
1088+
1089+
// Output only. The full resource name of the original
1090+
// [CryptoKey][google.cloud.kms.v1.CryptoKey] that was deleted in the format
1091+
// `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
1092+
string original_resource = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
1093+
1094+
// Output only. The resource type of the original deleted resource.
1095+
string resource_type = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
1096+
1097+
// Output only. The time at which the original resource was deleted and this
1098+
// RetiredResource record was created.
1099+
google.protobuf.Timestamp delete_time = 4
1100+
[(google.api.field_behavior) = OUTPUT_ONLY];
1101+
}
1102+
10431103
// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] specifies how
10441104
// cryptographic operations are performed. For more information, see [Protection
10451105
// levels] (https://cloud.google.com/kms/docs/algorithms#protection_levels).

0 commit comments

Comments
 (0)