Skip to content

Commit f248ed0

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Added DeleteCryptoKey and DeleteCryptoKeyVersion RPCs to permanently remove resources
feat: Introduced the RetiredResource resource to track records of deleted keys and prevent the reuse of their resource names feat: Added ListRetiredResources and GetRetiredResource RPCs to manage and view these records PiperOrigin-RevId: 868670725
1 parent c465da0 commit f248ed0

File tree

3 files changed

+218
-0
lines changed

3 files changed

+218
-0
lines changed

‎google/cloud/kms/v1/cloudkms_grpc_service_config.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@
3939
"service": "google.cloud.kms.v1.KeyManagementService",
4040
"method": "ListCryptoKeyVersions"
4141
},
42+
{
43+
"service": "google.cloud.kms.v1.KeyManagementService",
44+
"method": "ListRetiredResources"
45+
},
4246
{
4347
"service": "google.cloud.kms.v1.EkmService",
4448
"method": "GetEkmConnection"
@@ -59,6 +63,10 @@
5963
"service": "google.cloud.kms.v1.KeyManagementService",
6064
"method": "GetCryptoKeyVersion"
6165
},
66+
{
67+
"service": "google.cloud.kms.v1.KeyManagementService",
68+
"method": "GetRetiredResource"
69+
},
6270
{
6371
"service": "google.cloud.kms.v1.EkmService",
6472
"method": "CreateEkmConnection"
@@ -107,6 +115,14 @@
107115
"service": "google.cloud.kms.v1.KeyManagementService",
108116
"method": "RestoreCryptoKeyVersion"
109117
},
118+
{
119+
"service": "google.cloud.kms.v1.KeyManagementService",
120+
"method": "DeleteCryptoKey"
121+
},
122+
{
123+
"service": "google.cloud.kms.v1.KeyManagementService",
124+
"method": "DeleteCryptoKeyVersion"
125+
},
110126
{
111127
"service": "google.cloud.kms.v1.KeyManagementService",
112128
"method": "GetPublicKey"

‎google/cloud/kms/v1/resources.proto‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1040,6 +1040,40 @@ message KeyAccessJustificationsPolicy {
10401040
repeated AccessReason allowed_access_reasons = 1;
10411041
}
10421042

1043+
// A RetiredResource resource represents the record of a deleted
1044+
// [CryptoKey][google.cloud.kms.v1.CryptoKey]. Its purpose is to provide
1045+
// visibility into retained user data and to prevent reuse of these names for
1046+
// new [CryptoKeys][google.cloud.kms.v1.CryptoKey].
1047+
message RetiredResource {
1048+
option (google.api.resource) = {
1049+
type: "cloudkms.googleapis.com/RetiredResource"
1050+
pattern: "projects/{project}/locations/{location}/retiredResources/{retired_resource}"
1051+
plural: "retiredResources"
1052+
singular: "retiredResource"
1053+
};
1054+
1055+
// Output only. Identifier. The resource name for this
1056+
// [RetiredResource][google.cloud.kms.v1.RetiredResource] in the format
1057+
// `projects/*/locations/*/retiredResources/*`.
1058+
string name = 1 [
1059+
(google.api.field_behavior) = OUTPUT_ONLY,
1060+
(google.api.field_behavior) = IDENTIFIER
1061+
];
1062+
1063+
// Output only. The full resource name of the original
1064+
// [CryptoKey][google.cloud.kms.v1.CryptoKey] that was deleted in the format
1065+
// `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
1066+
string original_resource = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
1067+
1068+
// Output only. The resource type of the original deleted resource.
1069+
string resource_type = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
1070+
1071+
// Output only. The time at which the original resource was deleted and this
1072+
// RetiredResource record was created.
1073+
google.protobuf.Timestamp delete_time = 4
1074+
[(google.api.field_behavior) = OUTPUT_ONLY];
1075+
}
1076+
10431077
// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] specifies how
10441078
// cryptographic operations are performed. For more information, see [Protection
10451079
// levels] (https://cloud.google.com/kms/docs/algorithms#protection_levels).

‎google/cloud/kms/v1/service.proto‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ import "google/api/client.proto";
2121
import "google/api/field_behavior.proto";
2222
import "google/api/resource.proto";
2323
import "google/cloud/kms/v1/resources.proto";
24+
import "google/longrunning/operations.proto";
25+
import "google/protobuf/empty.proto";
2426
import "google/protobuf/field_mask.proto";
2527
import "google/protobuf/wrappers.proto";
2628

@@ -82,6 +84,17 @@ service KeyManagementService {
8284
option (google.api.method_signature) = "parent";
8385
}
8486

87+
// Lists the [RetiredResources][google.cloud.kms.v1.RetiredResource] which are
88+
// the records of deleted [CryptoKeys][google.cloud.kms.v1.CryptoKey].
89+
// RetiredResources prevent the reuse of these resource names after deletion.
90+
rpc ListRetiredResources(ListRetiredResourcesRequest)
91+
returns (ListRetiredResourcesResponse) {
92+
option (google.api.http) = {
93+
get: "/v1/{parent=projects/*/locations/*}/retiredResources"
94+
};
95+
option (google.api.method_signature) = "parent";
96+
}
97+
8598
// Returns metadata for a given [KeyRing][google.cloud.kms.v1.KeyRing].
8699
rpc GetKeyRing(GetKeyRingRequest) returns (KeyRing) {
87100
option (google.api.http) = {
@@ -131,6 +144,16 @@ service KeyManagementService {
131144
option (google.api.method_signature) = "name";
132145
}
133146

147+
// Retrieves a specific [RetiredResource][google.cloud.kms.v1.RetiredResource]
148+
// resource, which represents the record of a deleted
149+
// [CryptoKey][google.cloud.kms.v1.CryptoKey].
150+
rpc GetRetiredResource(GetRetiredResourceRequest) returns (RetiredResource) {
151+
option (google.api.http) = {
152+
get: "/v1/{name=projects/*/locations/*/retiredResources/*}"
153+
};
154+
option (google.api.method_signature) = "name";
155+
}
156+
134157
// Create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and
135158
// Location.
136159
rpc CreateKeyRing(CreateKeyRingRequest) returns (KeyRing) {
@@ -170,6 +193,47 @@ service KeyManagementService {
170193
option (google.api.method_signature) = "parent,crypto_key_version";
171194
}
172195

196+
// Permanently deletes the given [CryptoKey][google.cloud.kms.v1.CryptoKey].
197+
// All child [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] must
198+
// have been previously deleted using
199+
// [KeyManagementService.DeleteCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DeleteCryptoKeyVersion].
200+
// The specified crypto key will be immediately and permanently deleted upon
201+
// calling this method. This action cannot be undone.
202+
rpc DeleteCryptoKey(DeleteCryptoKeyRequest)
203+
returns (google.longrunning.Operation) {
204+
option (google.api.http) = {
205+
delete: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*}"
206+
};
207+
option (google.api.method_signature) = "name";
208+
option (google.longrunning.operation_info) = {
209+
response_type: "google.protobuf.Empty"
210+
metadata_type: "DeleteCryptoKeyMetadata"
211+
};
212+
}
213+
214+
// Permanently deletes the given
215+
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Only possible if
216+
// the version has not been previously imported and if its
217+
// [state][google.cloud.kms.v1.CryptoKeyVersion.state] is one of
218+
// [DESTROYED][CryptoKeyVersionState.DESTROYED],
219+
// [IMPORT_FAILED][CryptoKeyVersionState.IMPORT_FAILED], or
220+
// [GENERATION_FAILED][CryptoKeyVersionState.GENERATION_FAILED].
221+
// Successfully imported
222+
// [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] cannot be deleted
223+
// at this time. The specified version will be immediately and permanently
224+
// deleted upon calling this method. This action cannot be undone.
225+
rpc DeleteCryptoKeyVersion(DeleteCryptoKeyVersionRequest)
226+
returns (google.longrunning.Operation) {
227+
option (google.api.http) = {
228+
delete: "/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*}"
229+
};
230+
option (google.api.method_signature) = "name";
231+
option (google.longrunning.operation_info) = {
232+
response_type: "google.protobuf.Empty"
233+
metadata_type: "DeleteCryptoKeyVersionMetadata"
234+
};
235+
}
236+
173237
// Import wrapped key material into a
174238
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
175239
//
@@ -575,6 +639,34 @@ message ListImportJobsRequest {
575639
string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
576640
}
577641

642+
// Request message for
643+
// [KeyManagementService.ListRetiredResources][google.cloud.kms.v1.KeyManagementService.ListRetiredResources].
644+
message ListRetiredResourcesRequest {
645+
// Required. The project-specific location holding the
646+
// [RetiredResources][google.cloud.kms.v1.RetiredResource], in the format
647+
// `projects/*/locations/*`.
648+
string parent = 1 [
649+
(google.api.field_behavior) = REQUIRED,
650+
(google.api.resource_reference) = {
651+
child_type: "cloudkms.googleapis.com/RetiredResource"
652+
}
653+
];
654+
655+
// Optional. Optional limit on the number of
656+
// [RetiredResources][google.cloud.kms.v1.RetiredResource] to be included in
657+
// the response. Further
658+
// [RetiredResources][google.cloud.kms.v1.RetiredResource] can subsequently be
659+
// obtained by including the
660+
// [ListRetiredResourcesResponse.next_page_token][google.cloud.kms.v1.ListRetiredResourcesResponse.next_page_token]
661+
// in a subsequent request. If unspecified, the server will pick an
662+
// appropriate default.
663+
int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
664+
665+
// Optional. Optional pagination token, returned earlier via
666+
// [ListRetiredResourcesResponse.next_page_token][google.cloud.kms.v1.ListRetiredResourcesResponse.next_page_token].
667+
string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
668+
}
669+
578670
// Response message for
579671
// [KeyManagementService.ListKeyRings][google.cloud.kms.v1.KeyManagementService.ListKeyRings].
580672
message ListKeyRingsResponse {
@@ -656,6 +748,22 @@ message ListImportJobsResponse {
656748
int32 total_size = 3;
657749
}
658750

751+
// Response message for
752+
// [KeyManagementService.ListRetiredResources][google.cloud.kms.v1.KeyManagementService.ListRetiredResources].
753+
message ListRetiredResourcesResponse {
754+
// The list of [RetiredResources][google.cloud.kms.v1.RetiredResource].
755+
repeated RetiredResource retired_resources = 1;
756+
757+
// A token to retrieve the next page of results. Pass this value in
758+
// [ListRetiredResourcesRequest.page_token][google.cloud.kms.v1.ListRetiredResourcesRequest.page_token]
759+
// to retrieve the next page of results.
760+
string next_page_token = 2;
761+
762+
// The total number of [RetiredResources][google.cloud.kms.v1.RetiredResource]
763+
// that matched the query.
764+
int64 total_size = 3;
765+
}
766+
659767
// Request message for
660768
// [KeyManagementService.GetKeyRing][google.cloud.kms.v1.KeyManagementService.GetKeyRing].
661769
message GetKeyRingRequest {
@@ -731,6 +839,19 @@ message GetImportJobRequest {
731839
];
732840
}
733841

842+
// Request message for
843+
// [KeyManagementService.GetRetiredResource][google.cloud.kms.v1.KeyManagementService.GetRetiredResource].
844+
message GetRetiredResourceRequest {
845+
// Required. The [name][google.cloud.kms.v1.RetiredResource.name] of the
846+
// [RetiredResource][google.cloud.kms.v1.RetiredResource] to get.
847+
string name = 1 [
848+
(google.api.field_behavior) = REQUIRED,
849+
(google.api.resource_reference) = {
850+
type: "cloudkms.googleapis.com/RetiredResource"
851+
}
852+
];
853+
}
854+
734855
// Request message for
735856
// [KeyManagementService.CreateKeyRing][google.cloud.kms.v1.KeyManagementService.CreateKeyRing].
736857
message CreateKeyRingRequest {
@@ -803,6 +924,32 @@ message CreateCryptoKeyVersionRequest {
803924
[(google.api.field_behavior) = REQUIRED];
804925
}
805926

927+
// Request message for
928+
// [KeyManagementService.DeleteCryptoKey][google.cloud.kms.v1.KeyManagementService.DeleteCryptoKey].
929+
message DeleteCryptoKeyRequest {
930+
// Required. The [name][google.cloud.kms.v1.CryptoKey.name] of the
931+
// [CryptoKey][google.cloud.kms.v1.CryptoKey] to delete.
932+
string name = 1 [
933+
(google.api.field_behavior) = REQUIRED,
934+
(google.api.resource_reference) = {
935+
type: "cloudkms.googleapis.com/CryptoKey"
936+
}
937+
];
938+
}
939+
940+
// Request message for
941+
// [KeyManagementService.DeleteCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DeleteCryptoKeyVersion].
942+
message DeleteCryptoKeyVersionRequest {
943+
// Required. The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the
944+
// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to delete.
945+
string name = 1 [
946+
(google.api.field_behavior) = REQUIRED,
947+
(google.api.resource_reference) = {
948+
type: "cloudkms.googleapis.com/CryptoKeyVersion"
949+
}
950+
];
951+
}
952+
806953
// Request message for
807954
// [KeyManagementService.ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion].
808955
message ImportCryptoKeyVersionRequest {
@@ -2212,3 +2359,24 @@ message LocationMetadata {
22122359
// can be created in this location.
22132360
bool hsm_single_tenant_available = 3;
22142361
}
2362+
2363+
// Represents the metadata of the
2364+
// [KeyManagementService.DeleteCryptoKey][google.cloud.kms.v1.KeyManagementService.DeleteCryptoKey]
2365+
// long-running operation.
2366+
message DeleteCryptoKeyMetadata {
2367+
// Output only. The resource name of the
2368+
// [RetiredResource][google.cloud.kms.v1.RetiredResource] created as a result
2369+
// of this operation, in the format
2370+
// `projects/*/locations/*/retiredResources/*`.
2371+
string retired_resource = 1 [
2372+
(google.api.field_behavior) = OUTPUT_ONLY,
2373+
(google.api.resource_reference) = {
2374+
type: "cloudkms.googleapis.com/RetiredResource"
2375+
}
2376+
];
2377+
}
2378+
2379+
// Represents the metadata of the
2380+
// [KeyManagementService.DeleteCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DeleteCryptoKeyVersion]
2381+
// long-running operation.
2382+
message DeleteCryptoKeyVersionMetadata {}

0 commit comments

Comments
 (0)