kms

package
v0.33.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 13, 2018 License: Apache-2.0 Imports: 17 Imported by: 0

Documentation

Overview

Manages keys and performs cryptographic operations in a central cloud service, for direct use by other cloud resources and applications.

Index

Examples

Constants

This section is empty.

Variables

This section is empty.

Functions

func DefaultAuthScopes

func DefaultAuthScopes() []string

DefaultAuthScopes reports the default set of authentication scopes to use with this package.

Types

type CryptoKeyIterator

type CryptoKeyIterator struct {

	// InternalFetch is for use by the Google Cloud Libraries only.
	// It is not part of the stable interface of this package.
	//
	// InternalFetch returns results from a single call to the underlying RPC.
	// The number of results is no greater than pageSize.
	// If there are no more results, nextPageToken is empty and err is nil.
	InternalFetch func(pageSize int, pageToken string) (results []*kmspb.CryptoKey, nextPageToken string, err error)
	// contains filtered or unexported fields
}

CryptoKeyIterator manages a stream of *kmspb.CryptoKey.

func (*CryptoKeyIterator) Next

func (it *CryptoKeyIterator) Next() (*kmspb.CryptoKey, error)

Next returns the next result. Its second return value is iterator.Done if there are no more results. Once Next returns Done, all subsequent calls will return Done.

func (*CryptoKeyIterator) PageInfo

func (it *CryptoKeyIterator) PageInfo() *iterator.PageInfo

PageInfo supports pagination. See the google.golang.org/api/iterator package for details.

type CryptoKeyVersionIterator

type CryptoKeyVersionIterator struct {

	// InternalFetch is for use by the Google Cloud Libraries only.
	// It is not part of the stable interface of this package.
	//
	// InternalFetch returns results from a single call to the underlying RPC.
	// The number of results is no greater than pageSize.
	// If there are no more results, nextPageToken is empty and err is nil.
	InternalFetch func(pageSize int, pageToken string) (results []*kmspb.CryptoKeyVersion, nextPageToken string, err error)
	// contains filtered or unexported fields
}

CryptoKeyVersionIterator manages a stream of *kmspb.CryptoKeyVersion.

func (*CryptoKeyVersionIterator) Next

Next returns the next result. Its second return value is iterator.Done if there are no more results. Once Next returns Done, all subsequent calls will return Done.

func (*CryptoKeyVersionIterator) PageInfo

func (it *CryptoKeyVersionIterator) PageInfo() *iterator.PageInfo

PageInfo supports pagination. See the google.golang.org/api/iterator package for details.

type KeyManagementCallOptions

type KeyManagementCallOptions struct {
	ListKeyRings                  []gax.CallOption
	ListCryptoKeys                []gax.CallOption
	ListCryptoKeyVersions         []gax.CallOption
	GetKeyRing                    []gax.CallOption
	GetCryptoKey                  []gax.CallOption
	GetCryptoKeyVersion           []gax.CallOption
	CreateKeyRing                 []gax.CallOption
	CreateCryptoKey               []gax.CallOption
	CreateCryptoKeyVersion        []gax.CallOption
	UpdateCryptoKey               []gax.CallOption
	UpdateCryptoKeyVersion        []gax.CallOption
	Encrypt                       []gax.CallOption
	Decrypt                       []gax.CallOption
	UpdateCryptoKeyPrimaryVersion []gax.CallOption
	DestroyCryptoKeyVersion       []gax.CallOption
	RestoreCryptoKeyVersion       []gax.CallOption
	GetPublicKey                  []gax.CallOption
	AsymmetricDecrypt             []gax.CallOption
	AsymmetricSign                []gax.CallOption
}

KeyManagementCallOptions contains the retry settings for each method of KeyManagementClient.

type KeyManagementClient

type KeyManagementClient struct {

	// The call options for this service.
	CallOptions *KeyManagementCallOptions
	// contains filtered or unexported fields
}

KeyManagementClient is a client for interacting with Cloud Key Management Service (KMS) API.

Methods, except Close, may be called concurrently. However, fields must not be modified concurrently with method calls.

func NewKeyManagementClient

func NewKeyManagementClient(ctx context.Context, opts ...option.ClientOption) (*KeyManagementClient, error)

NewKeyManagementClient creates a new key management service client.

Google Cloud Key Management Service

Manages cryptographic keys and operations using those keys. Implements a REST model with the following objects:

[KeyRing][google.cloud.kms.v1.KeyRing]

[CryptoKey][google.cloud.kms.v1.CryptoKey]

[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]

If you are using manual gRPC libraries, see Using gRPC with Cloud KMS (at https://cloud.google.com/kms/docs/grpc).

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use client.
_ = c
Output:

func (*KeyManagementClient) AsymmetricDecrypt added in v0.28.0

AsymmetricDecrypt decrypts data that was encrypted with a public key retrieved from [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] corresponding to a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_DECRYPT.

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.AsymmetricDecryptRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.AsymmetricDecrypt(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) AsymmetricSign added in v0.28.0

AsymmetricSign signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_SIGN, producing a signature that can be verified with the public key retrieved from [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.AsymmetricSignRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.AsymmetricSign(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) Close

func (c *KeyManagementClient) Close() error

Close closes the connection to the API service. The user should invoke this when the client is no longer required.

func (*KeyManagementClient) Connection

func (c *KeyManagementClient) Connection() *grpc.ClientConn

Connection returns the client's connection to the API service.

func (*KeyManagementClient) CreateCryptoKey

CreateCryptoKey create a new [CryptoKey][google.cloud.kms.v1.CryptoKey] within a [KeyRing][google.cloud.kms.v1.KeyRing].

[CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] and [CryptoKey.version_template.algorithm][google.cloud.kms.v1.CryptoKeyVersionTemplate.algorithm] are required.

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.CreateCryptoKeyRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.CreateCryptoKey(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) CreateCryptoKeyVersion

CreateCryptoKeyVersion create a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in a [CryptoKey][google.cloud.kms.v1.CryptoKey].

The server will assign the next sequential id. If unset, [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.CreateCryptoKeyVersionRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.CreateCryptoKeyVersion(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) CreateKeyRing

func (c *KeyManagementClient) CreateKeyRing(ctx context.Context, req *kmspb.CreateKeyRingRequest, opts ...gax.CallOption) (*kmspb.KeyRing, error)

CreateKeyRing create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and Location.

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.CreateKeyRingRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.CreateKeyRing(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) CryptoKeyIAM added in v0.33.0

func (c *KeyManagementClient) CryptoKeyIAM(cryptoKey *kmspb.CryptoKey) *iam.Handle

CryptoKeyIAM returns a handle to inspect and change permissions of a CryptoKey.

func (*KeyManagementClient) Decrypt

Decrypt decrypts data that was protected by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.DecryptRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.Decrypt(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) DestroyCryptoKeyVersion

DestroyCryptoKeyVersion schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.

Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED] and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to a time 24 hours in the future, at which point the [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be changed to [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key material will be irrevocably destroyed.

Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached, [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.DestroyCryptoKeyVersionRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.DestroyCryptoKeyVersion(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) Encrypt

Encrypt encrypts data, so that it can only be recovered by a call to [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.EncryptRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.Encrypt(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) GetCryptoKey

GetCryptoKey returns metadata for a given [CryptoKey][google.cloud.kms.v1.CryptoKey], as well as its [primary][google.cloud.kms.v1.CryptoKey.primary] [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.GetCryptoKeyRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.GetCryptoKey(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) GetCryptoKeyVersion

GetCryptoKeyVersion returns metadata for a given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.GetCryptoKeyVersionRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.GetCryptoKeyVersion(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) GetKeyRing

GetKeyRing returns metadata for a given [KeyRing][google.cloud.kms.v1.KeyRing].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.GetKeyRingRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.GetKeyRing(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) GetPublicKey added in v0.28.0

GetPublicKey returns the public key for the given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN] or [ASYMMETRIC_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.GetPublicKeyRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.GetPublicKey(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) KeyRingIAM added in v0.33.0

func (c *KeyManagementClient) KeyRingIAM(keyRing *kmspb.KeyRing) *iam.Handle

KeyRingIAM returns a handle to inspect and change permissions of a KeyRing.

func (*KeyManagementClient) ListCryptoKeyVersions

ListCryptoKeyVersions lists [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.ListCryptoKeyVersionsRequest{
	// TODO: Fill request struct fields.
}
it := c.ListCryptoKeyVersions(ctx, req)
for {
	resp, err := it.Next()
	if err == iterator.Done {
		break
	}
	if err != nil {
		// TODO: Handle error.
	}
	// TODO: Use resp.
	_ = resp
}
Output:

func (*KeyManagementClient) ListCryptoKeys

ListCryptoKeys lists [CryptoKeys][google.cloud.kms.v1.CryptoKey].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.ListCryptoKeysRequest{
	// TODO: Fill request struct fields.
}
it := c.ListCryptoKeys(ctx, req)
for {
	resp, err := it.Next()
	if err == iterator.Done {
		break
	}
	if err != nil {
		// TODO: Handle error.
	}
	// TODO: Use resp.
	_ = resp
}
Output:

func (*KeyManagementClient) ListKeyRings

ListKeyRings lists [KeyRings][google.cloud.kms.v1.KeyRing].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.ListKeyRingsRequest{
	// TODO: Fill request struct fields.
}
it := c.ListKeyRings(ctx, req)
for {
	resp, err := it.Next()
	if err == iterator.Done {
		break
	}
	if err != nil {
		// TODO: Handle error.
	}
	// TODO: Use resp.
	_ = resp
}
Output:

func (*KeyManagementClient) RestoreCryptoKeyVersion

RestoreCryptoKeyVersion restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED] state.

Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED], and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.RestoreCryptoKeyVersionRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.RestoreCryptoKeyVersion(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) UpdateCryptoKey

UpdateCryptoKey update a [CryptoKey][google.cloud.kms.v1.CryptoKey].

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.UpdateCryptoKeyRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.UpdateCryptoKey(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) UpdateCryptoKeyPrimaryVersion

func (c *KeyManagementClient) UpdateCryptoKeyPrimaryVersion(ctx context.Context, req *kmspb.UpdateCryptoKeyPrimaryVersionRequest, opts ...gax.CallOption) (*kmspb.CryptoKey, error)

UpdateCryptoKeyPrimaryVersion update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].

Returns an error if called on an asymmetric key.

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.UpdateCryptoKeyPrimaryVersionRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.UpdateCryptoKeyPrimaryVersion(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

func (*KeyManagementClient) UpdateCryptoKeyVersion

UpdateCryptoKeyVersion update a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s metadata.

[state][google.cloud.kms.v1.CryptoKeyVersion.state] may be changed between [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] and [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] using this method. See [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion] and [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] to move between other states.

Example
ctx := context.Background()
c, err := kms.NewKeyManagementClient(ctx)
if err != nil {
	// TODO: Handle error.
}

req := &kmspb.UpdateCryptoKeyVersionRequest{
	// TODO: Fill request struct fields.
}
resp, err := c.UpdateCryptoKeyVersion(ctx, req)
if err != nil {
	// TODO: Handle error.
}
// TODO: Use resp.
_ = resp
Output:

type KeyRingIterator

type KeyRingIterator struct {

	// InternalFetch is for use by the Google Cloud Libraries only.
	// It is not part of the stable interface of this package.
	//
	// InternalFetch returns results from a single call to the underlying RPC.
	// The number of results is no greater than pageSize.
	// If there are no more results, nextPageToken is empty and err is nil.
	InternalFetch func(pageSize int, pageToken string) (results []*kmspb.KeyRing, nextPageToken string, err error)
	// contains filtered or unexported fields
}

KeyRingIterator manages a stream of *kmspb.KeyRing.

func (*KeyRingIterator) Next

func (it *KeyRingIterator) Next() (*kmspb.KeyRing, error)

Next returns the next result. Its second return value is iterator.Done if there are no more results. Once Next returns Done, all subsequent calls will return Done.

func (*KeyRingIterator) PageInfo

func (it *KeyRingIterator) PageInfo() *iterator.PageInfo

PageInfo supports pagination. See the google.golang.org/api/iterator package for details.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL