Questions tagged [google-cloud-kms]
This tag is for questions about Google Cloud KMS, a Google Cloud Platform service which allows developers to store and make use of encryption keys to secure data.
149
questions
1
vote
1answer
26 views
Tri-Secret benefits
I am wondering what the functional benefits are of applying Tri-Secret Managed Key security in Snowflake warehouses?
From what I understand:
the Tri-Secret method let's you define your own key
...
1
vote
0answers
51 views
Large amount of DecryptRequest request by DataProc for data in Cloud Storage protected by custom managed HSM key
We have transactional data in Cloud Storage encrypted with Custom Managed HSM key and when user submit jobs , a dataproc cluster spins and process some analytics on the data stored in the Cloud ...
3
votes
1answer
80 views
Can we save wrapped keys generated with cloud KMS keys in DLP deidentification templates(using Python Api)?
I am working on a PII de-identification project and using google cloud's data loss prevention api.
Use case: To encrypt a field with cloud KMS key.
Created a dlp-deidentification template, here is ...
0
votes
0answers
23 views
Gettning “Error 403 Access is forbidden” on GCP App Engine (default instance) running ASP.NET Core 3.1 Razor with Cloud MySQL
I developed a Razor based website using ASP.NET Core 3.1 and loaded it as a `GAE' default instance (with my custom domain). The initial version worked fine.
After adding Identity support (using ...
0
votes
1answer
34 views
How to manage your own Master Key in Gcloud KMS
How to have one Master key in Gcloud and create Data Keys to encrypt.
And using the Master Key to decrypt the actual data.?
This is possible in AWS KMS. How to implement the same in Gcloud?
Thanks
0
votes
1answer
50 views
GCP - DLP - Decryption failed: the ciphertext is invalid error when using KMS wrapped key
While trying out on a POC with GCP DLP, facing the below issue:
log:
Received the following error message from Cloud KMS when unwrapping KmsWrappedCryptoKey
"projects/<<PROJECT_ID>>/...
0
votes
1answer
183 views
IllegalAccessError: tried to access field com.google.protobuf.AbstractMessage.memoizedSize while using KMS decrypt
Am facing the following error while trying to decrpyt a cipher string using Google KSM SDK version 1.40.0.
Code used:
try (KeyManagementServiceClient keyManagementServiceClient = ...
0
votes
1answer
44 views
Using Google Cloud KMS on behalf of user
I have a CLI tool that interacts with Google KMS. In order for it to work, I fetch the user credentials as a JSON file which is stored on disk. Now a new requirement came along. I need to make a web ...
0
votes
1answer
32 views
C/C++ interface for Google Cloud KMS API
I find it extraordinary that there isn't a PKCS#11 interface let alone the fact there is support for C#, Go, Java, Node.JS, PHP, Python and Ruby but no direct API support for C/C++. Did I miss ...
1
vote
1answer
78 views
NoClassDefFoundError: com/google/cloud/kms/v1/KeyManagementServiceClient
I am writing for the first time here so I apologize if I should be adding more to the question. I am creating an application with java, and attempting to create a KeyManagementServiceClient connection ...
0
votes
0answers
130 views
Encrypting a large file using google KMS
I'm attempting to create a Go binary to handle encryption and decryption of secrets stored in compressed files.
Using the gcloud tool, I can simply encrypt using:
gcloud kms encrypt --plaintext-file ...
0
votes
1answer
75 views
Google Cloud Build: pip install from JFrog private repository using Cloud KMS as secretEnv
I am trying do pip install private packages in jfrog repository through Google Cloud Build. I can access jfrog repository via https:<USER>:<API_KEY>@<artifactory_url> and can also do ...
0
votes
1answer
40 views
Is it possible have client side encryptions while exporting cloudsql data to cloud storage
I am trying to export data to cloud storage buckets. I am trying to understand:
If I can leverage the client side encryption either using Customer Managed or Customer Supplied encryption keys.
I don't ...
3
votes
0answers
246 views
Digital signatures in pdf
I'm trying to digitally sign a pdf file using a PKCS#7 formatted signature in NodeJS.
The setup:
Node-forge does a great job at generating PKCS#7 format. I've already validated that the end output of ...
0
votes
0answers
50 views
Is it possible to refer KMS Key Name without leaking project id in Google Cloud?
I'm exploring Customer Managed Encryption Keys and my use case is:
Create a signed URL to upload to storage along with KMS key name query parameter
Pass it to a client of my service
Client uses ...
0
votes
1answer
36 views
How to retain private control over the encryption keys while using Cloud services?
All cloud service providers have their own Key management systems and customer keys can be imported when desired. However i want to have private control over keys such that keys are provided ...
0
votes
1answer
95 views
Is it possible to provide asymmetric keys as your own keys (BYOK) to a cloud KMS (key management service) for any cloud providers?
I want to encrypt storage/volumes using customer supplied keys. I have seen examples where symmetric customer keys can be imported and used to encrypt volumes for example in case of EBS volumes in AWS....
0
votes
0answers
42 views
GCP KMS createKey function never resolve
I am using NodeJS v10 (AngularJS MeanStack) with GCP KMS (@google-cloud/kms) to create key, encrypt & decrypt strings using those keys.
I am in a very strange issue, where createKeys function ...
0
votes
0answers
62 views
Getting error “message” : “The KMS key does not contain a location.” while using withKmsKey() option in dataflow job
I have dataflow job that is written using apache beam.Here I am loading the data from one table to another table the mode of table is write truncate and the table contains sensitive data so table ...
0
votes
0answers
20 views
Unable to use KMS using Python API
gcloud KMS support needed for Python API.
Trying to access keyring from code. The first call itself is not returning
client = kms.KeyManagementServiceClient()
I have proper authentication keys as json ...
0
votes
2answers
25 views
Google cloud KMS rest api to retrieve keyriings
Is there a rest endpoint to retrieve keyrings at a project level directly in KMS rest appi.
As of now, current API needs keyrings on a per-location basis, I would like to get all keyRings on a ...
1
vote
1answer
91 views
How to access Google KMS from Kubernetes Engine?
I had to move my .Net Core app from a Google App Engine to Google Kubernetes Engine because I need static IPs and sadly Google App Engine doesn't have that option.
I've managed to make a cluster and ...
3
votes
1answer
172 views
Mutual TLS in Python using Google Cloud KMS
Is there a way to make HTTP requests over mTLS with private keys stored in Google Cloud Key Management Service?
In this blog post what we need is done in Go. Is it possible to achieve the same in ...
0
votes
2answers
82 views
Storing Application Default Credentials securely in KMS
We have a Java app which uses Google Auth to allow uses in. The app needs to connect to a Google Cloud SQL database which is locked down behind IP restrictions.
We need to use Cloud SQL Socket ...
0
votes
1answer
165 views
gcloud kms decrypt without --ciphertext-file
am able to encrypt without --ciphertext-file file path using the below command
echo -n mytext | gcloud kms encrypt --plaintext-file=- \
--ciphertext-file=- --location=xxxx --keyring=xxx \
--key=...
0
votes
0answers
43 views
General question regarding Google Cloud KMS
I am considering to implement Google cloud KMS in a project.
I see in their pricing that there is a cost per key.
If we end up having tens of thousands of user per month, it might become extremely ...
1
vote
1answer
76 views
XAdES signature using Google Cloud KMS
Is there any way to make XAdES signature using Google Cloud KMS? I cannot find any info about it.
0
votes
1answer
255 views
Error message while deleting google_kms_crypto_key resource
I am managing kms keys and key rings with gcp terraform provider
resource "google_kms_key_ring" "vault" {
name = "vault"
location = "global"
}
resource "google_kms_crypto_key" "vault_init" {
...
1
vote
1answer
248 views
Google Cloud Platform - Dataflow doesn't decrypt data with KMS key
I have a Dataflow job that is written using Apache Beam. It looks similar to this template, but it saves data from JDBC to Cloud Storage:
https://github.com/GoogleCloudPlatform/DataflowTemplates/blob/...
1
vote
1answer
58 views
Google KMS asymmetric keys validation failure
I'm working on an OAuth server implementation for custom purposes, and tried using Google's KMS service for the signining/verification of JWT tokens.
I was able to create a signature just fine, ...
0
votes
1answer
54 views
Google Cloud KMS App Engine Encrypt not working
I want to encrypt/decrypt some sensitive data in a Google Cloud project with several AppEngine services. I enabled the Cloud KMS API and, via IAM, added the role "Cloud KMS CryptoKey Encrypter/...
0
votes
0answers
153 views
Where are certificates from Certificate Authorities stored in Google Cloud KMS?
I'm looking into Google KMS and the possibility of signing documents digitally and verifying them with Google Cloud. Keys are stored in a HSM (Hardware Security Module) in a managed Google Cloud.
I ...
0
votes
1answer
145 views
Google KMS giving error when decrypting data
When i try to decrypt my data using the Google KMS i am getting this error. Below is my code for the decryption. The error is hitting on the line where there is string plaintext. Thanks in advance
...
4
votes
2answers
588 views
Is there a way to store secrets in GCP, similar to Azure vault?
I have been trying to find a way to store secrets in GCP. I have explored Google Cloud KMS. It seems to be only for creating encryption keys, that can be used to encrypt say GCP storage elements. Or, ...
0
votes
1answer
37 views
How to keep imports at top of file while loading env vars in imported libraries?
Here is a very simple cloud function:
lib.py
import os
TOKEN = os.environ['TOKEN']
some_func(token=TOKEN):
return token
main.py - runs when function invoked and main() is entrypoint.
import ...
0
votes
2answers
269 views
Restricting encrypt/decrypt permissions for a Cloud KMS key with CMEK and Cloud Storage
I have two storage buckets in one Google cloud project, say storage-project. One bucket with default encryption, and another bucket encrypted with a Customer Managed Key (CMEK) created in another ...
1
vote
1answer
315 views
Google Cloud KMS: plaintext size limitations to encrypt by asymmetric public key
Hi Google Cloud KMS team, are there any Google Cloud KMS plaintext size limitations to encrypt by key types for asymmetric and symmetric keys ?
Because we would like to encrypt/decrypt REST flow ...
2
votes
1answer
203 views
How to create a CSR using Google Cloud KMS?
I want to use Google Cloud KMS for asymmetric signing. To complete setup with the destination provider I need to send them a CSR signed with the private key stored in Google. I've found some examples ...
0
votes
2answers
151 views
C# Hash and Verify JWT using Google KMS
We need to hash and verify the JWT token using a custom AsymmetricSecurityKey which uses Google Cloud KMS API to sign/verify the token.
The hash logic is working fine, here is implementation:
public ...
0
votes
0answers
76 views
GCP Cloud KMS Authorization failure using service account
I am following instructions as per link to use Service account authorization without OAuth to create a key ring. https://developers.google.com/identity/protocols/OAuth2ServiceAccount#jwt-auth
I am ...
0
votes
0answers
96 views
404 Error regarding unrapping KMS Crypto key
Seeing the following error when attempting to unwrap KMS key. Key ring exists in us-east1
google.api_core.exceptions.NotFound: 404 Received the following error message from Cloud KMS when unwrapping ...
1
vote
1answer
562 views
Sops unable to gcp kms decrypt file on Circleci despite GOOGLE_APPLICATION_CREDENTIALS successfully set to service account json
I am trying to configure a job on my local circleci (using docker executor, image: google/cloud-sdk:latest), and that job requires a sops gcp kms encrypted file to be decrypted. I have setup a google ...
2
votes
1answer
2k views
Access environment variables stored in Google Secret Manager from Google Cloud Build
How can I access the variables I define in Google Secret Manager from my Google Cloud Build Pipeline ?
3
votes
1answer
574 views
How to specify secretEnv to cloudbuild.yaml via gcloud cli args or environment variables
If I follow the cloud build document, I have to specify encrypted secret on cloudbuild.yaml.
secrets:
- kmsKeyName: projects/[PROJECT-ID]/locations/global/keyRings/[KEYRING-NAME]/cryptoKeys/[KEY-NAME]...
0
votes
0answers
245 views
googleapi: Error 403: Permission 'cloudkms.cryptoKeyVersions.useToEncrypt' denied on resource
I am using golang as backend language using Google Cloud KMS. I have enabled KMS service and created keyrings in Cryptographic Keys tabs.
Assigned Cloud KMS CryptoKey Encrypter/Decrypter role to ...
0
votes
0answers
72 views
Encrypting and decrypting data with a symmetric key
I have encrypted file inside the bucket in storage and now I am decrypting that file in my application using java programming like below-
public static byte[] decrypt(byte[] ciphertext) throws ...
1
vote
2answers
107 views
How to iterate thru all google cloud kms keys in an organization without running into read quotas?
I am trying to find out if there are keys which have versions that are older than one year and setting their rotation period to 24 hours from now. Unfortunately, each list keyring call is counting as ...
0
votes
1answer
159 views
NodeJs crypto key create(google kms key import) NodeJs
i try import my pem key to Google KMS(with hsm support). I have google guide how it create with openssl:
Wrap the key
Generate a temporary random AES key that is 32 bytes long.
openssl rand -out ...
1
vote
1answer
45 views
Unable to get readable encoded string
I am trying to use google-kms nodejs library.
What I was expecting is that the end result will be encrypted text but what I get is a buffer if I don't decide base64 or if I do then I get something ...
0
votes
0answers
235 views
Implementing envelope encryption on Android using Tink and Google Cloud KMS
The app I am implementing will contains highly sensitive user data and as such we want to encrypt the data before saving it, both locally and online (on Gcloud Firestore). I'd like to do this using ...