feat: add CMEK support

Google APIs · copybara-github · commit e51fec1d0851 · 2025-03-19T12:38:46.000-07:00
PiperOrigin-RevId: 738501501
diff --git a/google/cloud/parametermanager/v1/service.proto b/google/cloud/parametermanager/v1/service.proto
@@ -204,6 +204,13 @@ message Parameter {
   // resource.
   google.iam.v1.ResourcePolicyMember policy_member = 6
       [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Optional. Customer managed encryption key (CMEK) to use for encrypting the
+  // Parameter Versions. If not set, the default Google-managed encryption key
+  // will be used. Cloud KMS CryptoKeys must reside in the same location as the
+  // Parameter. The expected format is
+  // `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
+  optional string kms_key = 7 [(google.api.field_behavior) = OPTIONAL];
 }
 
 // Message for requesting list of Parameters
@@ -390,6 +397,15 @@ message ParameterVersion {
     (google.api.field_behavior) = REQUIRED,
     (google.api.field_behavior) = IMMUTABLE
   ];
+
+  // Optional. Output only. [Output only] The resource name of the KMS key
+  // version used to encrypt the ParameterVersion payload. This field is
+  // populated only if the Parameter resource has customer managed encryption
+  // key (CMEK) configured.
+  optional string kms_key_version = 6 [
+    (google.api.field_behavior) = OUTPUT_ONLY,
+    (google.api.field_behavior) = OPTIONAL
+  ];
 }
 
 // Message for storing a ParameterVersion resource's payload data
@@ -480,7 +496,7 @@ message RenderParameterVersionResponse {
 
   // Output only. Server generated rendered version of the user provided payload
   // data (ParameterVersionPayload) which has substitutions of all (if any)
-  // references to a SecretManager SecretVersion resources. This substituion
+  // references to a SecretManager SecretVersion resources. This substitution
   // only works for a Parameter which is in JSON or YAML format.
   bytes rendered_payload = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
