Skip to content

Commit c2b61d3

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: [Kms] Add support for trusted key wrapping and HSM key trust upgrades (#9350)
* feat: Add support for trusted key wrapping and HSM key trust upgrades docs: A comment for field `key_portability_enabled` in message `.google.cloud.kms.v1.SingleTenantHsmInstance` is changed to indicate key portability is now GA PiperOrigin-RevId: 948320582 Source-Link: googleapis/googleapis@fe04226 Source-Link: googleapis/googleapis-gen@81ba0b3 Copy-Tag: eyJwIjoiS21zLy5Pd2xCb3QueWFtbCIsImgiOiI4MWJhMGIzMTYxNmMyMGEwNjJhNmZiYTZlNmNiZmVjZmUzYjVlYmQwIn0= * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent 4f75a74 commit c2b61d3

22 files changed

Lines changed: 1671 additions & 7 deletions

‎Kms/metadata/V1/HsmManagement.php‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Kms/metadata/V1/Resources.php‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Kms/metadata/V1/Service.php‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Kms/samples/V1/KeyManagementServiceClient/export_trusted_key_wrapped_crypto_key_version.php‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* https://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/*
19+
* GENERATED CODE WARNING
20+
* This file was automatically generated - do not edit!
21+
*/
22+
23+
require_once __DIR__ . '/../../../vendor/autoload.php';
24+
25+
// [START cloudkms_v1_generated_KeyManagementService_ExportTrustedKeyWrappedCryptoKeyVersion_sync]
26+
use Google\ApiCore\ApiException;
27+
use Google\Cloud\Kms\V1\Client\KeyManagementServiceClient;
28+
use Google\Cloud\Kms\V1\ExportTrustedKeyWrappedCryptoKeyVersionRequest;
29+
use Google\Cloud\Kms\V1\ExportTrustedKeyWrappedCryptoKeyVersionResponse;
30+
31+
/**
32+
* Exports a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with a
33+
* trusted key.
34+
*
35+
* The [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] must have
36+
* trusted_wrapping_enabled set to true. The
37+
* [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] of the
38+
* [wrapping_key] must have the
39+
* [AES_WRAPPING][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.AES_WRAPPING]
40+
* purpose. The [wrapping_key] must have the
41+
* [AES_256_KWP][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.AES_256_KWP]
42+
* algorithm.
43+
*
44+
* @param string $formattedName The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the
45+
* [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to export. The
46+
* [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] must have
47+
* [trusted_wrapping_enabled][google.cloud.kms.v1.CryptoKeyVersion.trusted_wrapping_enabled]
48+
* set to true. Please see
49+
* {@see KeyManagementServiceClient::cryptoKeyVersionName()} for help formatting this field.
50+
* @param string $formattedWrappingKey The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the
51+
* [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] to use as a
52+
* wrapping key. The [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
53+
* must have [hsm_trusted][google.cloud.kms.v1.CryptoKeyVersion.hsm_trusted]
54+
* set to true. Please see
55+
* {@see KeyManagementServiceClient::cryptoKeyVersionName()} for help formatting this field.
56+
*/
57+
function export_trusted_key_wrapped_crypto_key_version_sample(
58+
string $formattedName,
59+
string $formattedWrappingKey
60+
): void {
61+
// Create a client.
62+
$keyManagementServiceClient = new KeyManagementServiceClient();
63+
64+
// Prepare the request message.
65+
$request = (new ExportTrustedKeyWrappedCryptoKeyVersionRequest())
66+
->setName($formattedName)
67+
->setWrappingKey($formattedWrappingKey);
68+
69+
// Call the API and handle any network failures.
70+
try {
71+
/** @var ExportTrustedKeyWrappedCryptoKeyVersionResponse $response */
72+
$response = $keyManagementServiceClient->exportTrustedKeyWrappedCryptoKeyVersion($request);
73+
printf('Response data: %s' . PHP_EOL, $response->serializeToJsonString());
74+
} catch (ApiException $ex) {
75+
printf('Call failed with message: %s' . PHP_EOL, $ex->getMessage());
76+
}
77+
}
78+
79+
/**
80+
* Helper to execute the sample.
81+
*
82+
* This sample has been automatically generated and should be regarded as a code
83+
* template only. It will require modifications to work:
84+
* - It may require correct/in-range values for request initialization.
85+
* - It may require specifying regional endpoints when creating the service client,
86+
* please see the apiEndpoint client configuration option for more details.
87+
*/
88+
function callSample(): void
89+
{
90+
$formattedName = KeyManagementServiceClient::cryptoKeyVersionName(
91+
'[PROJECT]',
92+
'[LOCATION]',
93+
'[KEY_RING]',
94+
'[CRYPTO_KEY]',
95+
'[CRYPTO_KEY_VERSION]'
96+
);
97+
$formattedWrappingKey = KeyManagementServiceClient::cryptoKeyVersionName(
98+
'[PROJECT]',
99+
'[LOCATION]',
100+
'[KEY_RING]',
101+
'[CRYPTO_KEY]',
102+
'[CRYPTO_KEY_VERSION]'
103+
);
104+
105+
export_trusted_key_wrapped_crypto_key_version_sample($formattedName, $formattedWrappingKey);
106+
}
107+
// [END cloudkms_v1_generated_KeyManagementService_ExportTrustedKeyWrappedCryptoKeyVersion_sync]

‎Kms/samples/V1/KeyManagementServiceClient/import_trusted_key_wrapped_crypto_key_version.php‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* https://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/*
19+
* GENERATED CODE WARNING
20+
* This file was automatically generated - do not edit!
21+
*/
22+
23+
require_once __DIR__ . '/../../../vendor/autoload.php';
24+
25+
// [START cloudkms_v1_generated_KeyManagementService_ImportTrustedKeyWrappedCryptoKeyVersion_sync]
26+
use Google\ApiCore\ApiException;
27+
use Google\Cloud\Kms\V1\Client\KeyManagementServiceClient;
28+
use Google\Cloud\Kms\V1\CryptoKeyVersion;
29+
use Google\Cloud\Kms\V1\CryptoKeyVersion\CryptoKeyVersionAlgorithm;
30+
use Google\Cloud\Kms\V1\ImportTrustedKeyWrappedCryptoKeyVersionRequest;
31+
32+
/**
33+
* Import wrapped key material into a
34+
* [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with a trusted
35+
* key.
36+
*
37+
* All requests must specify a [CryptoKey][google.cloud.kms.v1.CryptoKey]. If
38+
* a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] is additionally
39+
* specified in the request, key material will be reimported into that
40+
* version. Otherwise, a new version will be created, and will be assigned the
41+
* next sequential id within the [CryptoKey][google.cloud.kms.v1.CryptoKey].
42+
*
43+
* The [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] will have
44+
* trusted_wrapping_enabled set to true.
45+
*
46+
* @param string $parent The [name][google.cloud.kms.v1.CryptoKey.name] of the
47+
* [CryptoKey][google.cloud.kms.v1.CryptoKey] to be imported into.
48+
* @param string $importingKey Required - the CKV of the trusted key used to import.
49+
* This can be the name of a CryptoKeyVersion or a CryptoKey.
50+
* @param string $wrappedKey The target key pre-wrapped on premises.
51+
* @param int $algorithm Required - The
52+
* [algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]
53+
* of the key being imported. This does not need to match the
54+
* [version_template][google.cloud.kms.v1.CryptoKey.version_template] of the
55+
* [CryptoKey][google.cloud.kms.v1.CryptoKey] this version imports into.
56+
*/
57+
function import_trusted_key_wrapped_crypto_key_version_sample(
58+
string $parent,
59+
string $importingKey,
60+
string $wrappedKey,
61+
int $algorithm
62+
): void {
63+
// Create a client.
64+
$keyManagementServiceClient = new KeyManagementServiceClient();
65+
66+
// Prepare the request message.
67+
$request = (new ImportTrustedKeyWrappedCryptoKeyVersionRequest())
68+
->setParent($parent)
69+
->setImportingKey($importingKey)
70+
->setWrappedKey($wrappedKey)
71+
->setAlgorithm($algorithm);
72+
73+
// Call the API and handle any network failures.
74+
try {
75+
/** @var CryptoKeyVersion $response */
76+
$response = $keyManagementServiceClient->importTrustedKeyWrappedCryptoKeyVersion($request);
77+
printf('Response data: %s' . PHP_EOL, $response->serializeToJsonString());
78+
} catch (ApiException $ex) {
79+
printf('Call failed with message: %s' . PHP_EOL, $ex->getMessage());
80+
}
81+
}
82+
83+
/**
84+
* Helper to execute the sample.
85+
*
86+
* This sample has been automatically generated and should be regarded as a code
87+
* template only. It will require modifications to work:
88+
* - It may require correct/in-range values for request initialization.
89+
* - It may require specifying regional endpoints when creating the service client,
90+
* please see the apiEndpoint client configuration option for more details.
91+
*/
92+
function callSample(): void
93+
{
94+
$parent = '[PARENT]';
95+
$importingKey = '[IMPORTING_KEY]';
96+
$wrappedKey = '...';
97+
$algorithm = CryptoKeyVersionAlgorithm::CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED;
98+
99+
import_trusted_key_wrapped_crypto_key_version_sample(
100+
$parent,
101+
$importingKey,
102+
$wrappedKey,
103+
$algorithm
104+
);
105+
}
106+
// [END cloudkms_v1_generated_KeyManagementService_ImportTrustedKeyWrappedCryptoKeyVersion_sync]

‎Kms/src/V1/Client/KeyManagementServiceClient.php‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,8 @@
5959
use Google\Cloud\Kms\V1\DestroyCryptoKeyVersionRequest;
6060
use Google\Cloud\Kms\V1\EncryptRequest;
6161
use Google\Cloud\Kms\V1\EncryptResponse;
62+
use Google\Cloud\Kms\V1\ExportTrustedKeyWrappedCryptoKeyVersionRequest;
63+
use Google\Cloud\Kms\V1\ExportTrustedKeyWrappedCryptoKeyVersionResponse;
6264
use Google\Cloud\Kms\V1\GenerateRandomBytesRequest;
6365
use Google\Cloud\Kms\V1\GenerateRandomBytesResponse;
6466
use Google\Cloud\Kms\V1\GetCryptoKeyRequest;
@@ -69,6 +71,7 @@
6971
use Google\Cloud\Kms\V1\GetRetiredResourceRequest;
7072
use Google\Cloud\Kms\V1\ImportCryptoKeyVersionRequest;
7173
use Google\Cloud\Kms\V1\ImportJob;
74+
use Google\Cloud\Kms\V1\ImportTrustedKeyWrappedCryptoKeyVersionRequest;
7275
use Google\Cloud\Kms\V1\KeyRing;
7376
use Google\Cloud\Kms\V1\ListCryptoKeyVersionsRequest;
7477
use Google\Cloud\Kms\V1\ListCryptoKeysRequest;
@@ -131,6 +134,7 @@
131134
* @method PromiseInterface<OperationResponse> deleteCryptoKeyVersionAsync(DeleteCryptoKeyVersionRequest $request, array $optionalArgs = [])
132135
* @method PromiseInterface<CryptoKeyVersion> destroyCryptoKeyVersionAsync(DestroyCryptoKeyVersionRequest $request, array $optionalArgs = [])
133136
* @method PromiseInterface<EncryptResponse> encryptAsync(EncryptRequest $request, array $optionalArgs = [])
137+
* @method PromiseInterface<ExportTrustedKeyWrappedCryptoKeyVersionResponse> exportTrustedKeyWrappedCryptoKeyVersionAsync(ExportTrustedKeyWrappedCryptoKeyVersionRequest $request, array $optionalArgs = [])
134138
* @method PromiseInterface<GenerateRandomBytesResponse> generateRandomBytesAsync(GenerateRandomBytesRequest $request, array $optionalArgs = [])
135139
* @method PromiseInterface<CryptoKey> getCryptoKeyAsync(GetCryptoKeyRequest $request, array $optionalArgs = [])
136140
* @method PromiseInterface<CryptoKeyVersion> getCryptoKeyVersionAsync(GetCryptoKeyVersionRequest $request, array $optionalArgs = [])
@@ -139,6 +143,7 @@
139143
* @method PromiseInterface<PublicKey> getPublicKeyAsync(GetPublicKeyRequest $request, array $optionalArgs = [])
140144
* @method PromiseInterface<RetiredResource> getRetiredResourceAsync(GetRetiredResourceRequest $request, array $optionalArgs = [])
141145
* @method PromiseInterface<CryptoKeyVersion> importCryptoKeyVersionAsync(ImportCryptoKeyVersionRequest $request, array $optionalArgs = [])
146+
* @method PromiseInterface<CryptoKeyVersion> importTrustedKeyWrappedCryptoKeyVersionAsync(ImportTrustedKeyWrappedCryptoKeyVersionRequest $request, array $optionalArgs = [])
142147
* @method PromiseInterface<PagedListResponse> listCryptoKeyVersionsAsync(ListCryptoKeyVersionsRequest $request, array $optionalArgs = [])
143148
* @method PromiseInterface<PagedListResponse> listCryptoKeysAsync(ListCryptoKeysRequest $request, array $optionalArgs = [])
144149
* @method PromiseInterface<PagedListResponse> listImportJobsAsync(ListImportJobsRequest $request, array $optionalArgs = [])
@@ -889,6 +894,46 @@ public function encrypt(EncryptRequest $request, array $callOptions = []): Encry
889894
return $this->startApiCall('Encrypt', $request, $callOptions)->wait();
890895
}
891896

897+
/**
898+
* Exports a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with a
899+
* trusted key.
900+
*
901+
* The [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] must have
902+
* trusted_wrapping_enabled set to true. The
903+
* [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] of the
904+
* [wrapping_key] must have the
905+
* [AES_WRAPPING][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.AES_WRAPPING]
906+
* purpose. The [wrapping_key] must have the
907+
* [AES_256_KWP][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.AES_256_KWP]
908+
* algorithm.
909+
*
910+
* The async variant is
911+
* {@see KeyManagementServiceClient::exportTrustedKeyWrappedCryptoKeyVersionAsync()}
912+
* .
913+
*
914+
* @example samples/V1/KeyManagementServiceClient/export_trusted_key_wrapped_crypto_key_version.php
915+
*
916+
* @param ExportTrustedKeyWrappedCryptoKeyVersionRequest $request A request to house fields associated with the call.
917+
* @param array $callOptions {
918+
* Optional.
919+
*
920+
* @type RetrySettings|array $retrySettings
921+
* Retry settings to use for this call. Can be a {@see RetrySettings} object, or an
922+
* associative array of retry settings parameters. See the documentation on
923+
* {@see RetrySettings} for example usage.
924+
* }
925+
*
926+
* @return ExportTrustedKeyWrappedCryptoKeyVersionResponse
927+
*
928+
* @throws ApiException Thrown if the API call fails.
929+
*/
930+
public function exportTrustedKeyWrappedCryptoKeyVersion(
931+
ExportTrustedKeyWrappedCryptoKeyVersionRequest $request,
932+
array $callOptions = []
933+
): ExportTrustedKeyWrappedCryptoKeyVersionResponse {
934+
return $this->startApiCall('ExportTrustedKeyWrappedCryptoKeyVersion', $request, $callOptions)->wait();
935+
}
936+
892937
/**
893938
* Generate random bytes using the Cloud KMS randomness source in the provided
894939
* location.
@@ -1123,6 +1168,47 @@ public function importCryptoKeyVersion(
11231168
return $this->startApiCall('ImportCryptoKeyVersion', $request, $callOptions)->wait();
11241169
}
11251170

1171+
/**
1172+
* Import wrapped key material into a
1173+
* [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with a trusted
1174+
* key.
1175+
*
1176+
* All requests must specify a [CryptoKey][google.cloud.kms.v1.CryptoKey]. If
1177+
* a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] is additionally
1178+
* specified in the request, key material will be reimported into that
1179+
* version. Otherwise, a new version will be created, and will be assigned the
1180+
* next sequential id within the [CryptoKey][google.cloud.kms.v1.CryptoKey].
1181+
*
1182+
* The [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] will have
1183+
* trusted_wrapping_enabled set to true.
1184+
*
1185+
* The async variant is
1186+
* {@see KeyManagementServiceClient::importTrustedKeyWrappedCryptoKeyVersionAsync()}
1187+
* .
1188+
*
1189+
* @example samples/V1/KeyManagementServiceClient/import_trusted_key_wrapped_crypto_key_version.php
1190+
*
1191+
* @param ImportTrustedKeyWrappedCryptoKeyVersionRequest $request A request to house fields associated with the call.
1192+
* @param array $callOptions {
1193+
* Optional.
1194+
*
1195+
* @type RetrySettings|array $retrySettings
1196+
* Retry settings to use for this call. Can be a {@see RetrySettings} object, or an
1197+
* associative array of retry settings parameters. See the documentation on
1198+
* {@see RetrySettings} for example usage.
1199+
* }
1200+
*
1201+
* @return CryptoKeyVersion
1202+
*
1203+
* @throws ApiException Thrown if the API call fails.
1204+
*/
1205+
public function importTrustedKeyWrappedCryptoKeyVersion(
1206+
ImportTrustedKeyWrappedCryptoKeyVersionRequest $request,
1207+
array $callOptions = []
1208+
): CryptoKeyVersion {
1209+
return $this->startApiCall('ImportTrustedKeyWrappedCryptoKeyVersion', $request, $callOptions)->wait();
1210+
}
1211+
11261212
/**
11271213
* Lists [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion].
11281214
*

0 commit comments

Comments
 (0)