import * as pulumi from "@pulumi/pulumi"; /** * A `KeyHandle` is a resource used to auto-provision CryptoKeys for CMEK. * * > **Note:** KeyHandles cannot be deleted from Google Cloud Platform. * Destroying a Terraform-managed KeyHandle will remove it from state but * *will not delete the resource from the project.* * * To get more information about KeyHandle, see: * * * [API documentation](https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyHandles) * * How-to Guides * * [Cloud KMS with Autokey](https://cloud.google.com/kms/docs/kms-with-autokey) * * ## Example Usage * * ### Kms Key Handle Basic * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as gcp from "@pulumi/gcp"; * import * as time from "@pulumiverse/time"; * * // Create Folder in GCP Organization * const autokmsFolder = new gcp.organizations.Folder("autokms_folder", { * displayName: "folder-kh", * parent: "organizations/123456789", * deletionProtection: false, * }); * // Create the key project * const keyProject = new gcp.organizations.Project("key_project", { * projectId: "key-proj", * name: "key-proj", * folderId: autokmsFolder.folderId, * billingAccount: "000000-0000000-0000000-000000", * deletionPolicy: "DELETE", * }, { * dependsOn: [autokmsFolder], * }); * // Create the resource project * const resourceProject = new gcp.organizations.Project("resource_project", { * projectId: "res-proj", * name: "res-proj", * folderId: autokmsFolder.folderId, * billingAccount: "000000-0000000-0000000-000000", * deletionPolicy: "DELETE", * }, { * dependsOn: [autokmsFolder], * }); * // Enable the Cloud KMS API * const kmsApiService = new gcp.projects.Service("kms_api_service", { * service: "cloudkms.googleapis.com", * project: keyProject.projectId, * disableDependentServices: true, * }, { * dependsOn: [keyProject], * }); * // Wait delay after enabling APIs * const waitEnableServiceApi = new time.Sleep("wait_enable_service_api", {createDuration: "30s"}, { * dependsOn: [kmsApiService], * }); * //Create KMS Service Agent * const kmsServiceAgent = new gcp.projects.ServiceIdentity("kms_service_agent", { * service: "cloudkms.googleapis.com", * project: keyProject.number, * }, { * dependsOn: [waitEnableServiceApi], * }); * // Wait delay after creating service agent. * const waitServiceAgent = new time.Sleep("wait_service_agent", {createDuration: "10s"}, { * dependsOn: [kmsServiceAgent], * }); * //Grant the KMS Service Agent the Cloud KMS Admin role * const autokeyProjectAdmin = new gcp.projects.IAMMember("autokey_project_admin", { * project: keyProject.projectId, * role: "roles/cloudkms.admin", * member: pulumi.interpolate`serviceAccount:service-${keyProject.number}@gcp-sa-cloudkms.iam.gserviceaccount.com`, * }, { * dependsOn: [waitServiceAgent], * }); * // Wait delay after granting IAM permissions * const waitSrvAccPermissions = new time.Sleep("wait_srv_acc_permissions", {createDuration: "10s"}, { * dependsOn: [autokeyProjectAdmin], * }); * const autokeyConfig = new gcp.kms.AutokeyConfig("autokey_config", { * folder: autokmsFolder.folderId, * keyProject: pulumi.interpolate`projects/${keyProject.projectId}`, * }, { * dependsOn: [waitSrvAccPermissions], * }); * // Wait delay for autokey config to take effect * const waitAutokeyConfig = new time.Sleep("wait_autokey_config", {createDuration: "10s"}, { * dependsOn: [autokeyConfig], * }); * const example_keyhandle = new gcp.kms.KeyHandle("example-keyhandle", { * project: resourceProject.projectId, * name: "tf-test-key-handle", * location: "global", * resourceTypeSelector: "storage.googleapis.com/Bucket", * }, { * dependsOn: [waitAutokeyConfig], * }); * ``` * * ## Import * * KeyHandle can be imported using any of these accepted formats: * * * `projects/{{project}}/locations/{{location}}/keyHandles/{{name}}` * * `{{project}}/{{location}}/{{name}}` * * `{{location}}/{{name}}` * * When using the `pulumi import` command, KeyHandle can be imported using one of the formats above. For example: * * ```sh * $ pulumi import gcp:kms/keyHandle:KeyHandle default projects/{{project}}/locations/{{location}}/keyHandles/{{name}} * $ pulumi import gcp:kms/keyHandle:KeyHandle default {{project}}/{{location}}/{{name}} * $ pulumi import gcp:kms/keyHandle:KeyHandle default {{location}}/{{name}} * ``` */ export declare class KeyHandle extends pulumi.CustomResource { /** * Get an existing KeyHandle resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: KeyHandleState, opts?: pulumi.CustomResourceOptions): KeyHandle; /** * Returns true if the given object is an instance of KeyHandle. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is KeyHandle; /** * A reference to a Cloud KMS CryptoKey that can be used for CMEK in the requested * product/project/location, for example * `projects/1/locations/us-east1/keyRings/foo/cryptoKeys/bar-ffffff` */ readonly kmsKey: pulumi.Output; /** * The location for the KeyHandle. * A full list of valid locations can be found by running `gcloud kms locations list`. */ readonly location: pulumi.Output; /** * The resource name for the KeyHandle. */ readonly name: pulumi.Output; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ readonly project: pulumi.Output; /** * Selector of the resource type where we want to protect resources. * For example, `storage.googleapis.com/Bucket`. */ readonly resourceTypeSelector: pulumi.Output; /** * Create a KeyHandle resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: KeyHandleArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering KeyHandle resources. */ export interface KeyHandleState { /** * A reference to a Cloud KMS CryptoKey that can be used for CMEK in the requested * product/project/location, for example * `projects/1/locations/us-east1/keyRings/foo/cryptoKeys/bar-ffffff` */ kmsKey?: pulumi.Input; /** * The location for the KeyHandle. * A full list of valid locations can be found by running `gcloud kms locations list`. */ location?: pulumi.Input; /** * The resource name for the KeyHandle. */ name?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * Selector of the resource type where we want to protect resources. * For example, `storage.googleapis.com/Bucket`. */ resourceTypeSelector?: pulumi.Input; } /** * The set of arguments for constructing a KeyHandle resource. */ export interface KeyHandleArgs { /** * The location for the KeyHandle. * A full list of valid locations can be found by running `gcloud kms locations list`. */ location: pulumi.Input; /** * The resource name for the KeyHandle. */ name?: pulumi.Input; /** * The ID of the project in which the resource belongs. * If it is not provided, the provider project is used. */ project?: pulumi.Input; /** * Selector of the resource type where we want to protect resources. * For example, `storage.googleapis.com/Bucket`. */ resourceTypeSelector: pulumi.Input; } //# sourceMappingURL=keyHandle.d.ts.map