pulumi-google-native-kotlin/com.pulumi.googlenative.cloudkms.v1.kotlin.outputs

Package-level declarations

Types

data class AuditConfigResponse(val auditLogConfigs: List<AuditLogConfigResponse>, val service: String)

Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both allServices and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": "user:jose@example.com" }, { "log_type": "DATA_WRITE" }, { "log_type": "ADMIN_READ" } ] }, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": "user:aliya@example.com" } ] } ] } For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts jose@example.com from DATA_READ logging, and aliya@example.com from DATA_WRITE logging.

AuditLogConfigResponse

data class AuditLogConfigResponse(val exemptedMembers: List<String>, val logType: String)

Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": "user:jose@example.com" }, { "log_type": "DATA_WRITE" } ] } This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.

BindingResponse

data class BindingResponse(val condition: ExprResponse, val members: List<String>, val role: String)

Associates members, or principals, with a role.

CertificateChainsResponse

data class CertificateChainsResponse(val caviumCerts: List<String>, val googleCardCerts: List<String>, val googlePartitionCerts: List<String>)

Certificate chains needed to verify the attestation. Certificates in chains are PEM-encoded and are ordered based on https://tools.ietf.org/html/rfc5246#section-7.4.2.

CertificateResponse

data class CertificateResponse(val issuer: String, val notAfterTime: String, val notBeforeTime: String, val parsed: Boolean, val rawDer: String, val serialNumber: String, val sha256Fingerprint: String, val subject: String, val subjectAlternativeDnsNames: List<String>)

A Certificate represents an X.509 certificate used to authenticate HTTPS connections to EKM replicas.

CryptoKeyVersionResponse

data class CryptoKeyVersionResponse(val algorithm: String, val attestation: KeyOperationAttestationResponse, val createTime: String, val destroyEventTime: String, val destroyTime: String, val externalDestructionFailureReason: String, val externalProtectionLevelOptions: ExternalProtectionLevelOptionsResponse, val generateTime: String, val generationFailureReason: String, val importFailureReason: String, val importJob: String, val importTime: String, val name: String, val protectionLevel: String, val reimportEligible: Boolean, val state: String)

A CryptoKeyVersion represents an individual cryptographic key, and the associated key material. An ENABLED version can be used for cryptographic operations. For security reasons, the raw cryptographic key material represented by a CryptoKeyVersion can never be viewed or exported. It can only be used to encrypt, decrypt, or sign data when an authorized user or application invokes Cloud KMS.

CryptoKeyVersionTemplateResponse

data class CryptoKeyVersionTemplateResponse(val algorithm: String, val protectionLevel: String)

A CryptoKeyVersionTemplate specifies the properties to use when creating a new CryptoKeyVersion, either manually with CreateCryptoKeyVersion or automatically as a result of auto-rotation.

ExprResponse

data class ExprResponse(val description: String, val expression: String, val location: String, val title: String)

Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.

ExternalProtectionLevelOptionsResponse

data class ExternalProtectionLevelOptionsResponse(val ekmConnectionKeyPath: String, val externalKeyUri: String)

ExternalProtectionLevelOptions stores a group of additional fields for configuring a CryptoKeyVersion that are specific to the EXTERNAL protection level and EXTERNAL_VPC protection levels.

GetCryptoKeyResult

data class GetCryptoKeyResult(val createTime: String, val cryptoKeyBackend: String, val destroyScheduledDuration: String, val importOnly: Boolean, val labels: Map<String, String>, val name: String, val nextRotationTime: String, val primary: CryptoKeyVersionResponse, val purpose: String, val rotationPeriod: String, val versionTemplate: CryptoKeyVersionTemplateResponse)

GetCryptoKeyVersionResult

data class GetCryptoKeyVersionResult(val algorithm: String, val attestation: KeyOperationAttestationResponse, val createTime: String, val destroyEventTime: String, val destroyTime: String, val externalDestructionFailureReason: String, val externalProtectionLevelOptions: ExternalProtectionLevelOptionsResponse, val generateTime: String, val generationFailureReason: String, val importFailureReason: String, val importJob: String, val importTime: String, val name: String, val protectionLevel: String, val reimportEligible: Boolean, val state: String)

GetEkmConfigIamPolicyResult

data class GetEkmConfigIamPolicyResult(val auditConfigs: List<AuditConfigResponse>, val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetEkmConnectionIamPolicyResult

data class GetEkmConnectionIamPolicyResult(val auditConfigs: List<AuditConfigResponse>, val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetEkmConnectionResult

data class GetEkmConnectionResult(val createTime: String, val cryptoSpacePath: String, val etag: String, val keyManagementMode: String, val name: String, val serviceResolvers: List<ServiceResolverResponse>)

GetImportJobResult

data class GetImportJobResult(val attestation: KeyOperationAttestationResponse, val createTime: String, val expireEventTime: String, val expireTime: String, val generateTime: String, val importMethod: String, val name: String, val protectionLevel: String, val publicKey: WrappingPublicKeyResponse, val state: String)

GetKeyRingCryptoKeyIamPolicyResult

data class GetKeyRingCryptoKeyIamPolicyResult(val auditConfigs: List<AuditConfigResponse>, val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetKeyRingIamPolicyResult

data class GetKeyRingIamPolicyResult(val auditConfigs: List<AuditConfigResponse>, val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetKeyRingImportJobIamPolicyResult

data class GetKeyRingImportJobIamPolicyResult(val auditConfigs: List<AuditConfigResponse>, val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetKeyRingResult

data class GetKeyRingResult(val createTime: String, val name: String)

KeyOperationAttestationResponse

data class KeyOperationAttestationResponse(val certChains: CertificateChainsResponse, val content: String, val format: String)

Contains an HSM-generated attestation about a key operation. For more information, see Verifying attestations (https://cloud.google.com/kms/docs/attest-key).

ServiceResolverResponse

data class ServiceResolverResponse(val endpointFilter: String, val hostname: String, val serverCertificates: List<CertificateResponse>, val serviceDirectoryService: String)

A ServiceResolver represents an EKM replica that can be reached within an EkmConnection.

WrappingPublicKeyResponse

data class WrappingPublicKeyResponse(val pem: String)

The public key component of the wrapping key. For details of the type of key this public key corresponds to, see the ImportMethod.