Skip to content

Commit f390001

Browse files
gcf-owl-bot[bot]miguelvelezsa
gcf-owl-bot[bot]
and
miguelvelezsa
authored
feat: [kms] add the SingleTenantHsm functionality including the management API and resource types (#7014)
* feat: add the SingleTenantHsm functionality including the management API and resource types docs: A comment for field `crypto_key_backend` in message `.google.cloud.kms.v1.CryptoKey` is expanded to include SingleTenantHsmInstances docs: A comment for enum value `MODIFIED_CUSTOMER_INITIATED_ACCESS` in enum `AccessReason` is changed docs: A comment for enum value `MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION` in enum `AccessReason` is changed PiperOrigin-RevId: 858582271 Source-Link: googleapis/googleapis@d9f058d Source-Link: googleapis/googleapis-gen@6399b00 Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWttcy8uT3dsQm90LnlhbWwiLCJoIjoiNjM5OWIwMGE4ZDA4ZWFlMGRlOTgyYWRmNzUzZGI2MWYxYzM4NDdlMiJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com> Co-authored-by: miguel <[email protected]>
1 parent 7792cae commit f390001

38 files changed

Lines changed: 22248 additions & 16 deletions

‎packages/google-cloud-kms/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,15 @@ Samples are in the [`samples/`][homepage_samples] directory. Each sample's `READ
7171
| update ekm config | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/ekm_service.update_ekm_config.js) |
7272
| update ekm connection | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/ekm_service.update_ekm_connection.js) |
7373
| verify connectivity | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/ekm_service.verify_connectivity.js) |
74+
| approve single tenant hsm instance proposal | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/hsm_management.approve_single_tenant_hsm_instance_proposal.js) |
75+
| create single tenant hsm instance | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/hsm_management.create_single_tenant_hsm_instance.js) |
76+
| create single tenant hsm instance proposal | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/hsm_management.create_single_tenant_hsm_instance_proposal.js) |
77+
| delete single tenant hsm instance proposal | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/hsm_management.delete_single_tenant_hsm_instance_proposal.js) |
78+
| execute single tenant hsm instance proposal | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/hsm_management.execute_single_tenant_hsm_instance_proposal.js) |
79+
| get single tenant hsm instance | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/hsm_management.get_single_tenant_hsm_instance.js) |
80+
| get single tenant hsm instance proposal | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/hsm_management.get_single_tenant_hsm_instance_proposal.js) |
81+
| list single tenant hsm instance proposals | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/hsm_management.list_single_tenant_hsm_instance_proposals.js) |
82+
| list single tenant hsm instances | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/hsm_management.list_single_tenant_hsm_instances.js) |
7483
| asymmetric decrypt | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.asymmetric_decrypt.js) |
7584
| asymmetric sign | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.asymmetric_sign.js) |
7685
| create crypto key | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-kms/samples/generated/v1/key_management_service.create_crypto_key.js) |

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/hsm_management.proto‎

Lines changed: 1015 additions & 0 deletions
Large diffs are not rendered by default.

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/resources.proto‎

Lines changed: 35 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -29,6 +29,8 @@ option java_outer_classname = "KmsResourcesProto";
2929
option java_package = "com.google.cloud.kms.v1";
3030
option php_namespace = "Google\\Cloud\\Kms\\V1";
3131

32+
// LINT: LEGACY_NAMES
33+
3234
// A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of
3335
// [CryptoKeys][google.cloud.kms.v1.CryptoKey].
3436
message KeyRing {
@@ -200,7 +202,12 @@ message CryptoKey {
200202
// if [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] have a
201203
// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
202204
// [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC], with the
203-
// resource name in the format `projects/*/locations/*/ekmConnections/*`.
205+
// resource name in the format `projects/*/locations/*/ekmConnections/*`. Only
206+
// applicable if [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]
207+
// have a [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
208+
// [HSM_SINGLE_TENANT][google.cloud.kms.v1.ProtectionLevel.HSM_SINGLE_TENANT],
209+
// with the resource name in the format
210+
// `projects/*/locations/*/singleTenantHsmInstances/*`.
204211
// Note, this list is non-exhaustive and may apply to additional
205212
// [ProtectionLevels][google.cloud.kms.v1.ProtectionLevel] in the future.
206213
string crypto_key_backend = 15 [
@@ -986,6 +993,19 @@ message ImportJob {
986993
// protection level of [HSM][google.cloud.kms.v1.ProtectionLevel.HSM].
987994
KeyOperationAttestation attestation = 8
988995
[(google.api.field_behavior) = OUTPUT_ONLY];
996+
997+
// Immutable. The resource name of the backend environment where the key
998+
// material for the wrapping key resides and where all related cryptographic
999+
// operations are performed. Currently, this field is only populated for keys
1000+
// stored in HSM_SINGLE_TENANT. Note, this list is non-exhaustive and may
1001+
// apply to additional [ProtectionLevels][google.cloud.kms.v1.ProtectionLevel]
1002+
// in the future.
1003+
// Supported resources:
1004+
// * `"projects/*/locations/*/singleTenantHsmInstances/*"`
1005+
string crypto_key_backend = 11 [
1006+
(google.api.field_behavior) = IMMUTABLE,
1007+
(google.api.resource_reference) = { type: "*" }
1008+
];
9891009
}
9901010

9911011
// ExternalProtectionLevelOptions stores a group of additional fields for
@@ -1038,6 +1058,9 @@ enum ProtectionLevel {
10381058

10391059
// Crypto operations are performed in an EKM-over-VPC backend.
10401060
EXTERNAL_VPC = 4;
1061+
1062+
// Crypto operations are performed in a single-tenant HSM.
1063+
HSM_SINGLE_TENANT = 5;
10411064
}
10421065

10431066
// Describes the reason for a data access. Please refer to
@@ -1070,10 +1093,11 @@ enum AccessReason {
10701093
// No reason is expected for this key request.
10711094
REASON_NOT_EXPECTED = 7;
10721095

1073-
// Deprecated: This code is no longer generated by Google Cloud. The
1074-
// GOOGLE_RESPONSE_TO_PRODUCTION_ALERT justification codes available in both
1075-
// Key Access Justifications and Access Transparency logs provide
1076-
// customer-visible signals of emergency access in more precise contexts.
1096+
// Deprecated: This code is no longer generated by
1097+
// Google Cloud. The GOOGLE_RESPONSE_TO_PRODUCTION_ALERT justification codes
1098+
// available in both Key Access Justifications and Access Transparency logs
1099+
// provide customer-visible signals of emergency access in more precise
1100+
// contexts.
10771101
//
10781102
// Customer uses their account to perform any access to their own data which
10791103
// their IAM policy authorizes, and one of the following is true:
@@ -1085,10 +1109,11 @@ enum AccessReason {
10851109
// within the past 7 days.
10861110
MODIFIED_CUSTOMER_INITIATED_ACCESS = 8 [deprecated = true];
10871111

1088-
// Deprecated: This code is no longer generated by Google Cloud. The
1089-
// GOOGLE_RESPONSE_TO_PRODUCTION_ALERT justification codes available in both
1090-
// Key Access Justifications and Access Transparency logs provide
1091-
// customer-visible signals of emergency access in more precise contexts.
1112+
// Deprecated: This code is no longer generated by
1113+
// Google Cloud. The GOOGLE_RESPONSE_TO_PRODUCTION_ALERT justification codes
1114+
// available in both Key Access Justifications and Access Transparency logs
1115+
// provide customer-visible signals of emergency access in more precise
1116+
// contexts.
10921117
//
10931118
// Google systems access customer data to help optimize the structure of the
10941119
// data or quality for future uses by the customer, and one of the following

‎packages/google-cloud-kms/protos/google/cloud/kms/v1/service.proto‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -2205,4 +2205,10 @@ message LocationMetadata {
22052205
// [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL] can be created in
22062206
// this location.
22072207
bool ekm_available = 2;
2208+
2209+
// Indicates whether [CryptoKeys][google.cloud.kms.v1.CryptoKey] with
2210+
// [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level]
2211+
// [HSM_SINGLE_TENANT][google.cloud.kms.v1.ProtectionLevel.HSM_SINGLE_TENANT]
2212+
// can be created in this location.
2213+
bool hsm_single_tenant_available = 3;
22082214
}

0 commit comments

Comments
 (0)