import_jobs

Creates, updates, deletes, gets or lists an import_jobs resource.

Overview

Name	import_jobs
Type	Resource
Id	google.cloudkms.import_jobs

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
name	string	Output only. The resource name for this ImportJob in the format projects/*/locations/*/keyRings/*/importJobs/*.
attestation	object	Output only. Statement that was generated and signed by the key creator (for example, an HSM) at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only present if the chosen ImportMethod is one with a protection level of HSM. (id: KeyOperationAttestation)
createTime	string (google-datetime)	Output only. The time at which this ImportJob was created.
cryptoKeyBackend	string	Immutable. The resource name of the backend environment where the key material for the wrapping key resides and where all related cryptographic operations are performed. Currently, this field is only populated for keys stored in HSM_SINGLE_TENANT. Note, this list is non-exhaustive and may apply to additional ProtectionLevels in the future. Supported resources: * "projects/*/locations/*/singleTenantHsmInstances/*"
expireEventTime	string (google-datetime)	Output only. The time this ImportJob expired. Only present if state is EXPIRED.
expireTime	string (google-datetime)	Output only. The time at which this ImportJob is scheduled for expiration and can no longer be used to import key material.
generateTime	string (google-datetime)	Output only. The time this ImportJob's key material was generated.
importMethod	string	Required. Immutable. The wrapping method to be used for incoming key material. (IMPORT_METHOD_UNSPECIFIED, RSA_OAEP_3072_SHA1_AES_256, RSA_OAEP_4096_SHA1_AES_256, RSA_OAEP_3072_SHA256_AES_256, RSA_OAEP_4096_SHA256_AES_256, RSA_OAEP_3072_SHA256, RSA_OAEP_4096_SHA256, HPKE_KEM_ML_KEM_768_HKDF_SHA256_AES_256_GCM, HPKE_KEM_ML_KEM_1024_HKDF_SHA256_AES_256_GCM, HPKE_KEM_XWING_HKDF_SHA256_AES_256_GCM)
protectionLevel	string	Required. Immutable. The protection level of the ImportJob. This must match the protection_level of the version_template on the CryptoKey you attempt to import into. (PROTECTION_LEVEL_UNSPECIFIED, SOFTWARE, HSM, EXTERNAL, EXTERNAL_VPC, HSM_SINGLE_TENANT)
publicKey	object	Output only. The public key with which to wrap key material prior to import. Only returned if state is ACTIVE. (id: WrappingPublicKey)
publicKeyFormat	string	Output only. Specifies the WrappingPublicKey format provided by the customer in the KeyManagementService.GetImportJob request. (PUBLIC_KEY_FORMAT_UNSPECIFIED, PEM, DER, NIST_PQC, XWING_RAW_BYTES)
state	string	Output only. The current state of the ImportJob, indicating if it can be used. (IMPORT_JOB_STATE_UNSPECIFIED, PENDING_GENERATION, ACTIVE, EXPIRED)

list

Name	Datatype	Description
name	string	Output only. The resource name for this ImportJob in the format projects/*/locations/*/keyRings/*/importJobs/*.
attestation	object	Output only. Statement that was generated and signed by the key creator (for example, an HSM) at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only present if the chosen ImportMethod is one with a protection level of HSM. (id: KeyOperationAttestation)
createTime	string (google-datetime)	Output only. The time at which this ImportJob was created.
cryptoKeyBackend	string	Immutable. The resource name of the backend environment where the key material for the wrapping key resides and where all related cryptographic operations are performed. Currently, this field is only populated for keys stored in HSM_SINGLE_TENANT. Note, this list is non-exhaustive and may apply to additional ProtectionLevels in the future. Supported resources: * "projects/*/locations/*/singleTenantHsmInstances/*"
expireEventTime	string (google-datetime)	Output only. The time this ImportJob expired. Only present if state is EXPIRED.
expireTime	string (google-datetime)	Output only. The time at which this ImportJob is scheduled for expiration and can no longer be used to import key material.
generateTime	string (google-datetime)	Output only. The time this ImportJob's key material was generated.
importMethod	string	Required. Immutable. The wrapping method to be used for incoming key material. (IMPORT_METHOD_UNSPECIFIED, RSA_OAEP_3072_SHA1_AES_256, RSA_OAEP_4096_SHA1_AES_256, RSA_OAEP_3072_SHA256_AES_256, RSA_OAEP_4096_SHA256_AES_256, RSA_OAEP_3072_SHA256, RSA_OAEP_4096_SHA256, HPKE_KEM_ML_KEM_768_HKDF_SHA256_AES_256_GCM, HPKE_KEM_ML_KEM_1024_HKDF_SHA256_AES_256_GCM, HPKE_KEM_XWING_HKDF_SHA256_AES_256_GCM)
protectionLevel	string	Required. Immutable. The protection level of the ImportJob. This must match the protection_level of the version_template on the CryptoKey you attempt to import into. (PROTECTION_LEVEL_UNSPECIFIED, SOFTWARE, HSM, EXTERNAL, EXTERNAL_VPC, HSM_SINGLE_TENANT)
publicKey	object	Output only. The public key with which to wrap key material prior to import. Only returned if state is ACTIVE. (id: WrappingPublicKey)
publicKeyFormat	string	Output only. Specifies the WrappingPublicKey format provided by the customer in the KeyManagementService.GetImportJob request. (PUBLIC_KEY_FORMAT_UNSPECIFIED, PEM, DER, NIST_PQC, XWING_RAW_BYTES)
state	string	Output only. The current state of the ImportJob, indicating if it can be used. (IMPORT_JOB_STATE_UNSPECIFIED, PENDING_GENERATION, ACTIVE, EXPIRED)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	projectsId, locationsId, keyRingsId, importJobsId	publicKeyFormat	Returns metadata for a given ImportJob.
list	select	projectsId, locationsId, keyRingsId	pageToken, pageSize, orderBy, filter	Lists ImportJobs.
create	insert	projectsId, locationsId, keyRingsId	importJobId	Create a new ImportJob within a KeyRing. ImportJob.import_method is required.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
importJobsId	string
keyRingsId	string
locationsId	string
projectsId	string
filter	string
importJobId	string
orderBy	string
pageSize	integer (int32)
pageToken	string
publicKeyFormat	string

SELECT examples

get

Returns metadata for a given ImportJob.

SELECT
name,
attestation,
createTime,
cryptoKeyBackend,
expireEventTime,
expireTime,
generateTime,
importMethod,
protectionLevel,
publicKey,
publicKeyFormat,
state
FROM google.cloudkms.import_jobs
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND keyRingsId = '{{ keyRingsId }}' -- required
AND importJobsId = '{{ importJobsId }}' -- required
AND publicKeyFormat = '{{ publicKeyFormat }}'
;

list

Lists ImportJobs.

SELECT
name,
attestation,
createTime,
cryptoKeyBackend,
expireEventTime,
expireTime,
generateTime,
importMethod,
protectionLevel,
publicKey,
publicKeyFormat,
state
FROM google.cloudkms.import_jobs
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND keyRingsId = '{{ keyRingsId }}' -- required
AND pageToken = '{{ pageToken }}'
AND pageSize = '{{ pageSize }}'
AND orderBy = '{{ orderBy }}'
AND filter = '{{ filter }}'
;

INSERT examples

create

Create a new ImportJob within a KeyRing. ImportJob.import_method is required.

INSERT INTO google.cloudkms.import_jobs (
data__importMethod,
data__cryptoKeyBackend,
data__protectionLevel,
projectsId,
locationsId,
keyRingsId,
importJobId
)
SELECT 
'{{ importMethod }}',
'{{ cryptoKeyBackend }}',
'{{ protectionLevel }}',
'{{ projectsId }}',
'{{ locationsId }}',
'{{ keyRingsId }}',
'{{ importJobId }}'
RETURNING
name,
attestation,
createTime,
cryptoKeyBackend,
expireEventTime,
expireTime,
generateTime,
importMethod,
protectionLevel,
publicKey,
publicKeyFormat,
state
;

Manifest

# Description fields are for documentation purposes
- name: import_jobs
props:
  - name: projectsId
    value: "{{ projectsId }}"
    description: Required parameter for the import_jobs resource.
  - name: locationsId
    value: "{{ locationsId }}"
    description: Required parameter for the import_jobs resource.
  - name: keyRingsId
    value: "{{ keyRingsId }}"
    description: Required parameter for the import_jobs resource.
  - name: importMethod
    value: "{{ importMethod }}"
    description: |
      Required. Immutable. The wrapping method to be used for incoming key material.
    valid_values: ['IMPORT_METHOD_UNSPECIFIED', 'RSA_OAEP_3072_SHA1_AES_256', 'RSA_OAEP_4096_SHA1_AES_256', 'RSA_OAEP_3072_SHA256_AES_256', 'RSA_OAEP_4096_SHA256_AES_256', 'RSA_OAEP_3072_SHA256', 'RSA_OAEP_4096_SHA256', 'HPKE_KEM_ML_KEM_768_HKDF_SHA256_AES_256_GCM', 'HPKE_KEM_ML_KEM_1024_HKDF_SHA256_AES_256_GCM', 'HPKE_KEM_XWING_HKDF_SHA256_AES_256_GCM']
  - name: cryptoKeyBackend
    value: "{{ cryptoKeyBackend }}"
    description: |
      Immutable. The resource name of the backend environment where the key material for the wrapping key resides and where all related cryptographic operations are performed. Currently, this field is only populated for keys stored in HSM_SINGLE_TENANT. Note, this list is non-exhaustive and may apply to additional ProtectionLevels in the future. Supported resources: * `"projects/*/locations/*/singleTenantHsmInstances/*"`
  - name: protectionLevel
    value: "{{ protectionLevel }}"
    description: |
      Required. Immutable. The protection level of the ImportJob. This must match the protection_level of the version_template on the CryptoKey you attempt to import into.
    valid_values: ['PROTECTION_LEVEL_UNSPECIFIED', 'SOFTWARE', 'HSM', 'EXTERNAL', 'EXTERNAL_VPC', 'HSM_SINGLE_TENANT']
  - name: importJobId
    value: "{{ importJobId }}"