Package com.google.cloud.kms.v1

Interface CryptoKeyOrBuilder

All Superinterfaces:
com.google.protobuf.MessageLiteOrBuilder, com.google.protobuf.MessageOrBuilder
All Known Implementing Classes:
CryptoKey, CryptoKey.Builder
@Generated public interface CryptoKeyOrBuilder extends com.google.protobuf.MessageOrBuilder

  • Method Details

    • getName

      String getName()
       Output only. The resource name for this
 [CryptoKey][google.cloud.kms.v1.CryptoKey] in the format
 `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
      string name = 1 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The name.

    • getNameBytes

      com.google.protobuf.ByteString getNameBytes()
       Output only. The resource name for this
 [CryptoKey][google.cloud.kms.v1.CryptoKey] in the format
 `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
      string name = 1 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The bytes for name.

    • hasPrimary

      boolean hasPrimary()
       Output only. A copy of the "primary"
 [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that will be used
 by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] when this
 [CryptoKey][google.cloud.kms.v1.CryptoKey] is given in
 [EncryptRequest.name][google.cloud.kms.v1.EncryptRequest.name].

 The [CryptoKey][google.cloud.kms.v1.CryptoKey]'s primary version can be
 updated via
 [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion].

 Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
 [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
 may have a primary. For other keys, this field will be omitted.
      .google.cloud.kms.v1.CryptoKeyVersion primary = 2 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      Whether the primary field is set.

    • getPrimary

      CryptoKeyVersion getPrimary()
       Output only. A copy of the "primary"
 [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that will be used
 by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] when this
 [CryptoKey][google.cloud.kms.v1.CryptoKey] is given in
 [EncryptRequest.name][google.cloud.kms.v1.EncryptRequest.name].

 The [CryptoKey][google.cloud.kms.v1.CryptoKey]'s primary version can be
 updated via
 [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion].

 Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
 [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
 may have a primary. For other keys, this field will be omitted.
      .google.cloud.kms.v1.CryptoKeyVersion primary = 2 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The primary.

    • getPrimaryOrBuilder

      CryptoKeyVersionOrBuilder getPrimaryOrBuilder()
       Output only. A copy of the "primary"
 [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that will be used
 by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] when this
 [CryptoKey][google.cloud.kms.v1.CryptoKey] is given in
 [EncryptRequest.name][google.cloud.kms.v1.EncryptRequest.name].

 The [CryptoKey][google.cloud.kms.v1.CryptoKey]'s primary version can be
 updated via
 [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion].

 Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
 [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
 may have a primary. For other keys, this field will be omitted.
      .google.cloud.kms.v1.CryptoKeyVersion primary = 2 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getPurposeValue

      int getPurposeValue()
       Immutable. The immutable purpose of this
 [CryptoKey][google.cloud.kms.v1.CryptoKey].
      .google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose purpose = 3 [(.google.api.field_behavior) = IMMUTABLE];
      Returns:
      The enum numeric value on the wire for purpose.

    • getPurpose

      CryptoKey.CryptoKeyPurpose getPurpose()
       Immutable. The immutable purpose of this
 [CryptoKey][google.cloud.kms.v1.CryptoKey].
      .google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose purpose = 3 [(.google.api.field_behavior) = IMMUTABLE];
      Returns:
      The purpose.

    • hasCreateTime

      boolean hasCreateTime()
       Output only. The time at which this
 [CryptoKey][google.cloud.kms.v1.CryptoKey] was created.
      .google.protobuf.Timestamp create_time = 5 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      Whether the createTime field is set.

    • getCreateTime

      com.google.protobuf.Timestamp getCreateTime()
       Output only. The time at which this
 [CryptoKey][google.cloud.kms.v1.CryptoKey] was created.
      .google.protobuf.Timestamp create_time = 5 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The createTime.

    • getCreateTimeOrBuilder

      com.google.protobuf.TimestampOrBuilder getCreateTimeOrBuilder()
       Output only. The time at which this
 [CryptoKey][google.cloud.kms.v1.CryptoKey] was created.
      .google.protobuf.Timestamp create_time = 5 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • hasNextRotationTime

      boolean hasNextRotationTime()
       At [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time],
 the Key Management Service will automatically:

 1. Create a new version of this [CryptoKey][google.cloud.kms.v1.CryptoKey].
 2. Mark the new version as primary.

 Key rotations performed manually via
 [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
 and
 [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion]
 do not affect
 [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time].

 Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
 [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
 support automatic rotation. For other keys, this field must be omitted.
      .google.protobuf.Timestamp next_rotation_time = 7;
      Returns:
      Whether the nextRotationTime field is set.

    • getNextRotationTime

      com.google.protobuf.Timestamp getNextRotationTime()
       At [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time],
 the Key Management Service will automatically:

 1. Create a new version of this [CryptoKey][google.cloud.kms.v1.CryptoKey].
 2. Mark the new version as primary.

 Key rotations performed manually via
 [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
 and
 [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion]
 do not affect
 [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time].

 Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
 [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
 support automatic rotation. For other keys, this field must be omitted.
      .google.protobuf.Timestamp next_rotation_time = 7;
      Returns:
      The nextRotationTime.

    • getNextRotationTimeOrBuilder

      com.google.protobuf.TimestampOrBuilder getNextRotationTimeOrBuilder()
       At [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time],
 the Key Management Service will automatically:

 1. Create a new version of this [CryptoKey][google.cloud.kms.v1.CryptoKey].
 2. Mark the new version as primary.

 Key rotations performed manually via
 [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
 and
 [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion]
 do not affect
 [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time].

 Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
 [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
 support automatic rotation. For other keys, this field must be omitted.
      .google.protobuf.Timestamp next_rotation_time = 7;

    • hasRotationPeriod

      boolean hasRotationPeriod()
       [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]
 will be advanced by this period when the service automatically rotates a
 key. Must be at least 24 hours and at most 876,000 hours.

 If [rotation_period][google.cloud.kms.v1.CryptoKey.rotation_period] is
 set,
 [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]
 must also be set.

 Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
 [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
 support automatic rotation. For other keys, this field must be omitted.
      .google.protobuf.Duration rotation_period = 8;
      Returns:
      Whether the rotationPeriod field is set.

    • getRotationPeriod

      com.google.protobuf.Duration getRotationPeriod()
       [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]
 will be advanced by this period when the service automatically rotates a
 key. Must be at least 24 hours and at most 876,000 hours.

 If [rotation_period][google.cloud.kms.v1.CryptoKey.rotation_period] is
 set,
 [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]
 must also be set.

 Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
 [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
 support automatic rotation. For other keys, this field must be omitted.
      .google.protobuf.Duration rotation_period = 8;
      Returns:
      The rotationPeriod.

    • getRotationPeriodOrBuilder

      com.google.protobuf.DurationOrBuilder getRotationPeriodOrBuilder()
       [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]
 will be advanced by this period when the service automatically rotates a
 key. Must be at least 24 hours and at most 876,000 hours.

 If [rotation_period][google.cloud.kms.v1.CryptoKey.rotation_period] is
 set,
 [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time]
 must also be set.

 Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
 [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT]
 support automatic rotation. For other keys, this field must be omitted.
      .google.protobuf.Duration rotation_period = 8;

    • hasVersionTemplate

      boolean hasVersionTemplate()
       A template describing settings for new
 [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances. The
 properties of new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
 instances created by either
 [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
 or auto-rotation are controlled by this template.
      .google.cloud.kms.v1.CryptoKeyVersionTemplate version_template = 11;
      Returns:
      Whether the versionTemplate field is set.

    • getVersionTemplate

      CryptoKeyVersionTemplate getVersionTemplate()
       A template describing settings for new
 [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances. The
 properties of new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
 instances created by either
 [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
 or auto-rotation are controlled by this template.
      .google.cloud.kms.v1.CryptoKeyVersionTemplate version_template = 11;
      Returns:
      The versionTemplate.

    • getVersionTemplateOrBuilder

      CryptoKeyVersionTemplateOrBuilder getVersionTemplateOrBuilder()
       A template describing settings for new
 [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances. The
 properties of new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
 instances created by either
 [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
 or auto-rotation are controlled by this template.
      .google.cloud.kms.v1.CryptoKeyVersionTemplate version_template = 11;

    • getLabelsCount

      int getLabelsCount()
       Labels with user-defined metadata. For more information, see
 [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
      map<string, string> labels = 10;

    • containsLabels

      boolean containsLabels(String key)
       Labels with user-defined metadata. For more information, see
 [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
      map<string, string> labels = 10;

    • getLabels

      @Deprecated Map<String,String> getLabels()
      Deprecated.
      Use getLabelsMap() instead.

    • getLabelsMap

      Map<String,String> getLabelsMap()
       Labels with user-defined metadata. For more information, see
 [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
      map<string, string> labels = 10;

    • getLabelsOrDefault

      String getLabelsOrDefault(String key, String defaultValue)
       Labels with user-defined metadata. For more information, see
 [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
      map<string, string> labels = 10;

    • getLabelsOrThrow

      String getLabelsOrThrow(String key)
       Labels with user-defined metadata. For more information, see
 [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
      map<string, string> labels = 10;

    • getImportOnly

      boolean getImportOnly()
       Immutable. Whether this key may contain imported versions only.
      bool import_only = 13 [(.google.api.field_behavior) = IMMUTABLE];
      Returns:
      The importOnly.

    • hasDestroyScheduledDuration

      boolean hasDestroyScheduledDuration()
       Immutable. The period of time that versions of this key spend in the
 [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
 state before transitioning to
 [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED].
 If not specified at creation time, the default duration is 30 days.
      .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
      Returns:
      Whether the destroyScheduledDuration field is set.

    • getDestroyScheduledDuration

      com.google.protobuf.Duration getDestroyScheduledDuration()
       Immutable. The period of time that versions of this key spend in the
 [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
 state before transitioning to
 [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED].
 If not specified at creation time, the default duration is 30 days.
      .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];
      Returns:
      The destroyScheduledDuration.

    • getDestroyScheduledDurationOrBuilder

      com.google.protobuf.DurationOrBuilder getDestroyScheduledDurationOrBuilder()
       Immutable. The period of time that versions of this key spend in the
 [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
 state before transitioning to
 [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED].
 If not specified at creation time, the default duration is 30 days.
      .google.protobuf.Duration destroy_scheduled_duration = 14 [(.google.api.field_behavior) = IMMUTABLE];

    • getCryptoKeyBackend

      String getCryptoKeyBackend()
       Immutable. The resource name of the backend environment where the key
 material for all [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]
 associated with this [CryptoKey][google.cloud.kms.v1.CryptoKey] reside and
 where all related cryptographic operations are performed. Only applicable
 if [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] have a
 [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
 [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC], with the
 resource name in the format `projects/*/locations/*/ekmConnections/*`. Only
 applicable if [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]
 have a [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
 [HSM_SINGLE_TENANT][google.cloud.kms.v1.ProtectionLevel.HSM_SINGLE_TENANT],
 with the resource name in the format
 `projects/*/locations/*/singleTenantHsmInstances/*`.
 Note, this list is non-exhaustive and may apply to additional
 [ProtectionLevels][google.cloud.kms.v1.ProtectionLevel] in the future.
      string crypto_key_backend = 15 [(.google.api.field_behavior) = IMMUTABLE, (.google.api.resource_reference) = { ... }
      Returns:
      The cryptoKeyBackend.

    • getCryptoKeyBackendBytes

      com.google.protobuf.ByteString getCryptoKeyBackendBytes()
       Immutable. The resource name of the backend environment where the key
 material for all [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]
 associated with this [CryptoKey][google.cloud.kms.v1.CryptoKey] reside and
 where all related cryptographic operations are performed. Only applicable
 if [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] have a
 [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
 [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC], with the
 resource name in the format `projects/*/locations/*/ekmConnections/*`. Only
 applicable if [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion]
 have a [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
 [HSM_SINGLE_TENANT][google.cloud.kms.v1.ProtectionLevel.HSM_SINGLE_TENANT],
 with the resource name in the format
 `projects/*/locations/*/singleTenantHsmInstances/*`.
 Note, this list is non-exhaustive and may apply to additional
 [ProtectionLevels][google.cloud.kms.v1.ProtectionLevel] in the future.
      string crypto_key_backend = 15 [(.google.api.field_behavior) = IMMUTABLE, (.google.api.resource_reference) = { ... }
      Returns:
      The bytes for cryptoKeyBackend.

    • hasKeyAccessJustificationsPolicy

      boolean hasKeyAccessJustificationsPolicy()
       Optional. The policy used for Key Access Justifications Policy Enforcement.
 If this field is present and this key is enrolled in Key Access
 Justifications Policy Enforcement, the policy will be evaluated in encrypt,
 decrypt, and sign operations, and the operation will fail if rejected by
 the policy. The policy is defined by specifying zero or more allowed
 justification codes.
 https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
 By default, this field is absent, and all justification codes are allowed.
 If the
 `key_access_justifications_policy.allowed_access_reasons`
 is empty (zero allowed justification code), all encrypt, decrypt, and sign
 operations will fail.
      .google.cloud.kms.v1.KeyAccessJustificationsPolicy key_access_justifications_policy = 17 [(.google.api.field_behavior) = OPTIONAL];
      Returns:
      Whether the keyAccessJustificationsPolicy field is set.

    • getKeyAccessJustificationsPolicy

      KeyAccessJustificationsPolicy getKeyAccessJustificationsPolicy()
       Optional. The policy used for Key Access Justifications Policy Enforcement.
 If this field is present and this key is enrolled in Key Access
 Justifications Policy Enforcement, the policy will be evaluated in encrypt,
 decrypt, and sign operations, and the operation will fail if rejected by
 the policy. The policy is defined by specifying zero or more allowed
 justification codes.
 https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
 By default, this field is absent, and all justification codes are allowed.
 If the
 `key_access_justifications_policy.allowed_access_reasons`
 is empty (zero allowed justification code), all encrypt, decrypt, and sign
 operations will fail.
      .google.cloud.kms.v1.KeyAccessJustificationsPolicy key_access_justifications_policy = 17 [(.google.api.field_behavior) = OPTIONAL];
      Returns:
      The keyAccessJustificationsPolicy.

    • getKeyAccessJustificationsPolicyOrBuilder

      KeyAccessJustificationsPolicyOrBuilder getKeyAccessJustificationsPolicyOrBuilder()
       Optional. The policy used for Key Access Justifications Policy Enforcement.
 If this field is present and this key is enrolled in Key Access
 Justifications Policy Enforcement, the policy will be evaluated in encrypt,
 decrypt, and sign operations, and the operation will fail if rejected by
 the policy. The policy is defined by specifying zero or more allowed
 justification codes.
 https://cloud.google.com/assured-workloads/key-access-justifications/docs/justification-codes
 By default, this field is absent, and all justification codes are allowed.
 If the
 `key_access_justifications_policy.allowed_access_reasons`
 is empty (zero allowed justification code), all encrypt, decrypt, and sign
 operations will fail.
      .google.cloud.kms.v1.KeyAccessJustificationsPolicy key_access_justifications_policy = 17 [(.google.api.field_behavior) = OPTIONAL];

    • getRotationScheduleCase

      CryptoKey.RotationScheduleCase getRotationScheduleCase()