kmsKeyName property
Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources.
It must match the pattern
projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}.
If specified, you must also provide an artifact registry repository using
the docker_repository field that was created with the same KMS crypto
key. The following service accounts need to be granted the role 'Cloud KMS
CryptoKey Encrypter/Decrypter
(roles/cloudkms.cryptoKeyEncrypterDecrypter)' on the
Key/KeyRing/Project/Organization (least access preferred). 1. Google Cloud
Functions service account
(service-{project_number}@gcf-admin-robot.iam.gserviceaccount.com) -
Required to protect the function's image. 2. Google Storage service
account
(service-{project_number}@gs-project-accounts.iam.gserviceaccount.com) -
Required to protect the function's source code. If this service account
does not exist, deploying a function without a KMS key or retrieving the
service agent name provisions it. For more information, see
https://cloud.google.com/storage/docs/projects#service-agents and
https://cloud.google.com/storage/docs/getting-service-agent#gsutil. Google
Cloud Functions delegates access to service agents to protect function
resources in internal projects that are not accessible by the end user.
Implementation
core.String? kmsKeyName;