Manage GCP Parameter Manager Versions

The gcp:parametermanager/parameterVersion:ParameterVersion resource, part of the Pulumi GCP provider, stores the actual value of a Parameter Manager parameter as an immutable version. This guide focuses on three capabilities: plain text and JSON data storage, KMS encryption for sensitive values, and file-based configuration loading.

Parameter versions belong to Parameter resources and may reference Cloud KMS keys or local configuration files. The examples are intentionally small. Combine them with your own Parameter resources, KMS keys, and access policies.

Store a plain text parameter value

Most deployments start by creating a version that stores a simple string value for application configuration.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const parameter_basic = new gcp.parametermanager.Parameter("parameter-basic", {parameterId: "parameter"});
const parameter_version_basic = new gcp.parametermanager.ParameterVersion("parameter-version-basic", {
    parameter: parameter_basic.id,
    parameterVersionId: "parameter_version",
    parameterData: "app-parameter-version-data",
});

import pulumi
import pulumi_gcp as gcp

parameter_basic = gcp.parametermanager.Parameter("parameter-basic", parameter_id="parameter")
parameter_version_basic = gcp.parametermanager.ParameterVersion("parameter-version-basic",
    parameter=parameter_basic.id,
    parameter_version_id="parameter_version",
    parameter_data="app-parameter-version-data")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		parameter_basic, err := parametermanager.NewParameter(ctx, "parameter-basic", &parametermanager.ParameterArgs{
			ParameterId: pulumi.String("parameter"),
		})
		if err != nil {
			return err
		}
		_, err = parametermanager.NewParameterVersion(ctx, "parameter-version-basic", &parametermanager.ParameterVersionArgs{
			Parameter:          parameter_basic.ID(),
			ParameterVersionId: pulumi.String("parameter_version"),
			ParameterData:      pulumi.String("app-parameter-version-data"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var parameter_basic = new Gcp.ParameterManager.Parameter("parameter-basic", new()
    {
        ParameterId = "parameter",
    });

    var parameter_version_basic = new Gcp.ParameterManager.ParameterVersion("parameter-version-basic", new()
    {
        Parameter = parameter_basic.Id,
        ParameterVersionId = "parameter_version",
        ParameterData = "app-parameter-version-data",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.parametermanager.Parameter;
import com.pulumi.gcp.parametermanager.ParameterArgs;
import com.pulumi.gcp.parametermanager.ParameterVersion;
import com.pulumi.gcp.parametermanager.ParameterVersionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var parameter_basic = new Parameter("parameter-basic", ParameterArgs.builder()
            .parameterId("parameter")
            .build());

        var parameter_version_basic = new ParameterVersion("parameter-version-basic", ParameterVersionArgs.builder()
            .parameter(parameter_basic.id())
            .parameterVersionId("parameter_version")
            .parameterData("app-parameter-version-data")
            .build());

    }
}

resources:
  parameter-basic:
    type: gcp:parametermanager:Parameter
    properties:
      parameterId: parameter
  parameter-version-basic:
    type: gcp:parametermanager:ParameterVersion
    properties:
      parameter: ${["parameter-basic"].id}
      parameterVersionId: parameter_version
      parameterData: app-parameter-version-data

The parameter property references the parent Parameter resource. The parameterVersionId must be unique within that parameter. The parameterData holds the actual configuration value; this property is immutable once created.

Store structured JSON configuration data

Applications often need multi-key configuration like feature flags or service endpoints. JSON format enables validation and structured access.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const parameter_basic = new gcp.parametermanager.Parameter("parameter-basic", {
    parameterId: "parameter",
    format: "JSON",
});
const parameter_version_with_json_format = new gcp.parametermanager.ParameterVersion("parameter-version-with-json-format", {
    parameter: parameter_basic.id,
    parameterVersionId: "parameter_version",
    parameterData: JSON.stringify({
        key1: "val1",
        key2: "val2",
    }),
});

import pulumi
import json
import pulumi_gcp as gcp

parameter_basic = gcp.parametermanager.Parameter("parameter-basic",
    parameter_id="parameter",
    format="JSON")
parameter_version_with_json_format = gcp.parametermanager.ParameterVersion("parameter-version-with-json-format",
    parameter=parameter_basic.id,
    parameter_version_id="parameter_version",
    parameter_data=json.dumps({
        "key1": "val1",
        "key2": "val2",
    }))

package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		parameter_basic, err := parametermanager.NewParameter(ctx, "parameter-basic", &parametermanager.ParameterArgs{
			ParameterId: pulumi.String("parameter"),
			Format:      pulumi.String("JSON"),
		})
		if err != nil {
			return err
		}
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"key1": "val1",
			"key2": "val2",
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		_, err = parametermanager.NewParameterVersion(ctx, "parameter-version-with-json-format", &parametermanager.ParameterVersionArgs{
			Parameter:          parameter_basic.ID(),
			ParameterVersionId: pulumi.String("parameter_version"),
			ParameterData:      pulumi.String(json0),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var parameter_basic = new Gcp.ParameterManager.Parameter("parameter-basic", new()
    {
        ParameterId = "parameter",
        Format = "JSON",
    });

    var parameter_version_with_json_format = new Gcp.ParameterManager.ParameterVersion("parameter-version-with-json-format", new()
    {
        Parameter = parameter_basic.Id,
        ParameterVersionId = "parameter_version",
        ParameterData = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["key1"] = "val1",
            ["key2"] = "val2",
        }),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.parametermanager.Parameter;
import com.pulumi.gcp.parametermanager.ParameterArgs;
import com.pulumi.gcp.parametermanager.ParameterVersion;
import com.pulumi.gcp.parametermanager.ParameterVersionArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var parameter_basic = new Parameter("parameter-basic", ParameterArgs.builder()
            .parameterId("parameter")
            .format("JSON")
            .build());

        var parameter_version_with_json_format = new ParameterVersion("parameter-version-with-json-format", ParameterVersionArgs.builder()
            .parameter(parameter_basic.id())
            .parameterVersionId("parameter_version")
            .parameterData(serializeJson(
                jsonObject(
                    jsonProperty("key1", "val1"),
                    jsonProperty("key2", "val2")
                )))
            .build());

    }
}

resources:
  parameter-basic:
    type: gcp:parametermanager:Parameter
    properties:
      parameterId: parameter
      format: JSON
  parameter-version-with-json-format:
    type: gcp:parametermanager:ParameterVersion
    properties:
      parameter: ${["parameter-basic"].id}
      parameterVersionId: parameter_version
      parameterData:
        fn::toJSON:
          key1: val1
          key2: val2

Setting format to JSON on the parent Parameter enables validation. The parameterData accepts a JSON string; use JSON.stringify to convert objects. Parameter Manager validates the structure when you create the version.

Encrypt parameter data with Cloud KMS

Sensitive configuration like API keys requires encryption at rest with customer-managed keys.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = gcp.organizations.getProject({});
const parameter_basic = new gcp.parametermanager.Parameter("parameter-basic", {
    parameterId: "parameter",
    kmsKey: "kms-key",
});
const parameter_version_with_kms_key = new gcp.parametermanager.ParameterVersion("parameter-version-with-kms-key", {
    parameter: parameter_basic.id,
    parameterVersionId: "parameter_version",
    parameterData: "app-parameter-version-data",
});

import pulumi
import pulumi_gcp as gcp

project = gcp.organizations.get_project()
parameter_basic = gcp.parametermanager.Parameter("parameter-basic",
    parameter_id="parameter",
    kms_key="kms-key")
parameter_version_with_kms_key = gcp.parametermanager.ParameterVersion("parameter-version-with-kms-key",
    parameter=parameter_basic.id,
    parameter_version_id="parameter_version",
    parameter_data="app-parameter-version-data")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{}, nil)
		if err != nil {
			return err
		}
		parameter_basic, err := parametermanager.NewParameter(ctx, "parameter-basic", &parametermanager.ParameterArgs{
			ParameterId: pulumi.String("parameter"),
			KmsKey:      pulumi.String("kms-key"),
		})
		if err != nil {
			return err
		}
		_, err = parametermanager.NewParameterVersion(ctx, "parameter-version-with-kms-key", &parametermanager.ParameterVersionArgs{
			Parameter:          parameter_basic.ID(),
			ParameterVersionId: pulumi.String("parameter_version"),
			ParameterData:      pulumi.String("app-parameter-version-data"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var project = Gcp.Organizations.GetProject.Invoke();

    var parameter_basic = new Gcp.ParameterManager.Parameter("parameter-basic", new()
    {
        ParameterId = "parameter",
        KmsKey = "kms-key",
    });

    var parameter_version_with_kms_key = new Gcp.ParameterManager.ParameterVersion("parameter-version-with-kms-key", new()
    {
        Parameter = parameter_basic.Id,
        ParameterVersionId = "parameter_version",
        ParameterData = "app-parameter-version-data",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.parametermanager.Parameter;
import com.pulumi.gcp.parametermanager.ParameterArgs;
import com.pulumi.gcp.parametermanager.ParameterVersion;
import com.pulumi.gcp.parametermanager.ParameterVersionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var project = OrganizationsFunctions.getProject(GetProjectArgs.builder()
            .build());

        var parameter_basic = new Parameter("parameter-basic", ParameterArgs.builder()
            .parameterId("parameter")
            .kmsKey("kms-key")
            .build());

        var parameter_version_with_kms_key = new ParameterVersion("parameter-version-with-kms-key", ParameterVersionArgs.builder()
            .parameter(parameter_basic.id())
            .parameterVersionId("parameter_version")
            .parameterData("app-parameter-version-data")
            .build());

    }
}

resources:
  parameter-basic:
    type: gcp:parametermanager:Parameter
    properties:
      parameterId: parameter
      kmsKey: kms-key
  parameter-version-with-kms-key:
    type: gcp:parametermanager:ParameterVersion
    properties:
      parameter: ${["parameter-basic"].id}
      parameterVersionId: parameter_version
      parameterData: app-parameter-version-data
variables:
  project:
    fn::invoke:
      function: gcp:organizations:getProject
      arguments: {}

The kmsKey property on the parent Parameter specifies which Cloud KMS key encrypts the data. Parameter Manager encrypts parameterData automatically; the kmsKeyVersion output shows which key version was used. You need encrypt and decrypt permissions on the KMS key.

Load JSON configuration from a file

Large configuration often lives in separate files managed by version control, keeping infrastructure code clean.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as std from "@pulumi/std";

const parameter_basic = new gcp.parametermanager.Parameter("parameter-basic", {
    parameterId: "parameter",
    format: "JSON",
});
const parameter_version_with_json_format_with_file = new gcp.parametermanager.ParameterVersion("parameter-version-with-json-format-with-file", {
    parameter: parameter_basic.id,
    parameterVersionId: "parameter_version",
    parameterData: std.file({
        input: "parameter-json-data.json",
    }).then(invoke => invoke.result),
});

import pulumi
import pulumi_gcp as gcp
import pulumi_std as std

parameter_basic = gcp.parametermanager.Parameter("parameter-basic",
    parameter_id="parameter",
    format="JSON")
parameter_version_with_json_format_with_file = gcp.parametermanager.ParameterVersion("parameter-version-with-json-format-with-file",
    parameter=parameter_basic.id,
    parameter_version_id="parameter_version",
    parameter_data=std.file(input="parameter-json-data.json").result)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		parameter_basic, err := parametermanager.NewParameter(ctx, "parameter-basic", &parametermanager.ParameterArgs{
			ParameterId: pulumi.String("parameter"),
			Format:      pulumi.String("JSON"),
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "parameter-json-data.json",
		}, nil)
		if err != nil {
			return err
		}
		_, err = parametermanager.NewParameterVersion(ctx, "parameter-version-with-json-format-with-file", &parametermanager.ParameterVersionArgs{
			Parameter:          parameter_basic.ID(),
			ParameterVersionId: pulumi.String("parameter_version"),
			ParameterData:      pulumi.String(invokeFile.Result),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Std = Pulumi.Std;

return await Deployment.RunAsync(() => 
{
    var parameter_basic = new Gcp.ParameterManager.Parameter("parameter-basic", new()
    {
        ParameterId = "parameter",
        Format = "JSON",
    });

    var parameter_version_with_json_format_with_file = new Gcp.ParameterManager.ParameterVersion("parameter-version-with-json-format-with-file", new()
    {
        Parameter = parameter_basic.Id,
        ParameterVersionId = "parameter_version",
        ParameterData = Std.File.Invoke(new()
        {
            Input = "parameter-json-data.json",
        }).Apply(invoke => invoke.Result),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.parametermanager.Parameter;
import com.pulumi.gcp.parametermanager.ParameterArgs;
import com.pulumi.gcp.parametermanager.ParameterVersion;
import com.pulumi.gcp.parametermanager.ParameterVersionArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var parameter_basic = new Parameter("parameter-basic", ParameterArgs.builder()
            .parameterId("parameter")
            .format("JSON")
            .build());

        var parameter_version_with_json_format_with_file = new ParameterVersion("parameter-version-with-json-format-with-file", ParameterVersionArgs.builder()
            .parameter(parameter_basic.id())
            .parameterVersionId("parameter_version")
            .parameterData(StdFunctions.file(FileArgs.builder()
                .input("parameter-json-data.json")
                .build()).result())
            .build());

    }
}

resources:
  parameter-basic:
    type: gcp:parametermanager:Parameter
    properties:
      parameterId: parameter
      format: JSON
  parameter-version-with-json-format-with-file:
    type: gcp:parametermanager:ParameterVersion
    properties:
      parameter: ${["parameter-basic"].id}
      parameterVersionId: parameter_version
      parameterData:
        fn::invoke:
          function: std:file
          arguments:
            input: parameter-json-data.json
          return: result

The std.file function reads local files at deployment time. This pattern works for JSON or YAML formats; set the parent Parameter’s format property to match. The file must exist when you run pulumi up.

Beyond these examples

These snippets focus on specific parameter version features: plain text and structured data storage, KMS encryption integration, and file-based configuration loading. They’re intentionally minimal rather than full configuration management solutions.

The examples reference pre-existing infrastructure such as Parameter resources (parent container), Cloud KMS keys for encryption, and JSON/YAML configuration files. They focus on storing parameter values rather than provisioning the surrounding infrastructure.

To keep things focused, common parameter version patterns are omitted, including:

Version disabling (disabled property)
Version lifecycle management and rotation
Access control and IAM permissions
Version retrieval and application integration

These omissions are intentional: the goal is to illustrate how each parameter version feature is wired, not provide drop-in configuration modules. See the ParameterVersion resource reference for all available configuration options.

Let's manage GCP Parameter Manager Versions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Lifecycle & Updates

What can I change after creating a parameter version?

Only the disabled field can be updated. The parameter, parameterData, and parameterVersionId properties are immutable and require creating a new version to change.

How do I update parameter data?

You can’t update parameterData on an existing version. Create a new parameter version with the updated data and a new parameterVersionId.

What's the purpose of the disabled field?

The disabled field controls the state of a parameter version and is the only property you can update after creation without creating a new version.

Data Formats & Loading

How do I store structured data like JSON or YAML?

Set the parent parameter’s format to JSON or YAML, then provide the data as a string. For JSON, use JSON.stringify() to convert objects.

Can I load parameter data from a file?

Yes, use std.file() to read file contents into parameterData. This works for any format including JSON and YAML files.

Why isn't my parameter data showing in the Pulumi plan?

The parameterData property is marked as sensitive and won’t be displayed in plan output or state for security reasons. This is expected behavior.

Encryption & Security

How do I encrypt parameter data with Cloud KMS?

Configure the kmsKey property on the parent Parameter resource before creating the version. The version will automatically use that key for encryption.

Where can I find which KMS key version was used?

Check the kmsKeyVersion output property, which contains the full resource name of the Cloud KMS CryptoKeyVersion used to encrypt the parameter data.

Resource Relationships

What's the relationship between Parameter and ParameterVersion?

A ParameterVersion stores the actual parameter value and belongs to a parent Parameter resource. Each version must have a unique parameterVersionId within its parameter.

Can I create multiple versions of the same parameter?

Yes, create multiple ParameterVersion resources with the same parameter reference but different parameterVersionId values.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides