EkmConnection class

Ekm Connections are used to control the connection settings for an EXTERNAL_VPC CryptoKey. It is used to connect customer's external key manager to Google Cloud EKM.

> Note: Ekm Connections cannot be deleted from Google Cloud Platform.

To get more information about EkmConnection, see:

• API documentation
• How-to Guides
• Creating a Ekm Connection

Example Usage

Kms Ekm Connection Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const example_ekmconnection = new gcp.kms.EkmConnection("example-ekmconnection", {
    name: "ekmconnection_example",
    location: "us-central1",
    keyManagementMode: "MANUAL",
    serviceResolvers: [{
        serviceDirectoryService: "projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name",
        hostname: "example-ekm.goog",
        serverCertificates: [{
            rawDer: "==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY==",
        }],
    }],
});

import pulumi
import pulumi_gcp as gcp

example_ekmconnection = gcp.kms.EkmConnection("example-ekmconnection",
    name="ekmconnection_example",
    location="us-central1",
    key_management_mode="MANUAL",
    service_resolvers=[{
        "service_directory_service": "projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name",
        "hostname": "example-ekm.goog",
        "server_certificates": [{
            "raw_der": "==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY==",
        }],
    }])

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var example_ekmconnection = new Gcp.Kms.EkmConnection("example-ekmconnection", new()
    {
        Name = "ekmconnection_example",
        Location = "us-central1",
        KeyManagementMode = "MANUAL",
        ServiceResolvers = new[]
        {
            new Gcp.Kms.Inputs.EkmConnectionServiceResolverArgs
            {
                ServiceDirectoryService = "projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name",
                Hostname = "example-ekm.goog",
                ServerCertificates = new[]
                {
                    new Gcp.Kms.Inputs.EkmConnectionServiceResolverServerCertificateArgs
                    {
                        RawDer = "==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY==",
                    },
                },
            },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewEkmConnection(ctx, "example-ekmconnection", &kms.EkmConnectionArgs{
			Name:              pulumi.String("ekmconnection_example"),
			Location:          pulumi.String("us-central1"),
			KeyManagementMode: pulumi.String("MANUAL"),
			ServiceResolvers: kms.EkmConnectionServiceResolverArray{
				&kms.EkmConnectionServiceResolverArgs{
					ServiceDirectoryService: pulumi.String("projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name"),
					Hostname:                pulumi.String("example-ekm.goog"),
					ServerCertificates: kms.EkmConnectionServiceResolverServerCertificateArray{
						&kms.EkmConnectionServiceResolverServerCertificateArgs{
							RawDer: pulumi.String("==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY=="),
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_kms_ekmconnection" "example-ekmconnection" {
  name                = "ekmconnection_example"
  location            = "us-central1"
  key_management_mode = "MANUAL"
  service_resolvers {
    service_directory_service = "projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name"
    hostname                  = "example-ekm.goog"
    server_certificates {
      raw_der = "==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY=="
    }
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnection;
import com.pulumi.gcp.kms.EkmConnectionArgs;
import com.pulumi.gcp.kms.inputs.EkmConnectionServiceResolverArgs;
import com.pulumi.gcp.kms.inputs.EkmConnectionServiceResolverServerCertificateArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example_ekmconnection = new EkmConnection("example-ekmconnection", EkmConnectionArgs.builder()
            .name("ekmconnection_example")
            .location("us-central1")
            .keyManagementMode("MANUAL")
            .serviceResolvers(EkmConnectionServiceResolverArgs.builder()
                .serviceDirectoryService("projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name")
                .hostname("example-ekm.goog")
                .serverCertificates(EkmConnectionServiceResolverServerCertificateArgs.builder()
                    .rawDer("==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY==")
                    .build())
                .build())
            .build());

    }
}

resources:
  example-ekmconnection:
    type: gcp:kms:EkmConnection
    properties:
      name: ekmconnection_example
      location: us-central1
      keyManagementMode: MANUAL
      serviceResolvers:
        - serviceDirectoryService: projects/project_id/locations/us-central1/namespaces/namespace_name/services/service_name
          hostname: example-ekm.goog
          serverCertificates:
            - rawDer: ==HAwIBCCAr6gAwIBAgIUWR+EV4lqiV7Ql12VY==

Import

EkmConnection can be imported using any of these accepted formats:

• projects/{{project}}/locations/{{location}}/ekmConnections/{{name}}
• {{project}}/{{location}}/{{name}}
• {{location}}/{{name}}

When using the pulumi import command, EkmConnection can be imported using one of the formats above. For example:

$ pulumi import gcp:kms/ekmConnection:EkmConnection default projects/{{project}}/locations/{{location}}/ekmConnections/{{name}}
$ pulumi import gcp:kms/ekmConnection:EkmConnection default {{project}}/{{location}}/{{name}}
$ pulumi import gcp:kms/ekmConnection:EkmConnection default {{location}}/{{name}}

Constructors

EkmConnection(String name, {EkmConnectionArgs? args, CustomResourceOptions? options})

Creates a new EkmConnection. name The Pulumi resource name. args Arguments used to configure this EkmConnection. The set of arguments for EkmConnection. options Resource options controlling this resource's behavior.

EkmConnection.reference(String urn)

Creates a typed reference to an existing EkmConnection resource.

Properties

childResources → Set<Resource>

final, inherited

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

createTime ↔ Output<String>

Output only. The time at which the EkmConnection was created. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

late, final

cryptoSpacePath ↔ Output<String>

Optional. Identifies the EKM Crypto Space that this EkmConnection maps to. Note: This field is required if KeyManagementMode is CLOUD_KMS.

late, final

etag ↔ Output<String>

Optional. Etag of the currently stored EkmConnection.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

keyManagementMode ↔ Output<String?>

Optional. Describes who can perform control plane operations on the EKM. If unset, this defaults to MANUAL Default value is MANUAL. Possible values are: MANUAL, CLOUD_KMS.

late, final

location ↔ Output<String>

The location for the EkmConnection. A full list of valid locations can be found by running gcloud kms locations list.

late, final

name ↔ Output<String>

The resource name for the EkmConnection.

late, final

project ↔ Output<String>

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

serviceResolvers ↔ Output<List<EkmConnectionServiceResolver>>

A list of ServiceResolvers where the EKM can be reached. There should be one ServiceResolver per EKM replica. Currently, only a single ServiceResolver is supported Structure is documented below.

late, final

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

urn ↔ Output<String>

late, final, inherited

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {EkmConnectionState? state, CustomResourceOptions? options}) → EkmConnection

Gets an existing EkmConnection resource's state with the given name and id.