Create GCP Regional Parameters

The gcp:parametermanager/regionalParameter:RegionalParameter resource, part of the Pulumi GCP provider, defines a regional parameter container: its identifier, location, format type, and encryption settings. This guide focuses on three capabilities: basic parameter creation, format specification for structured data, and labeling and KMS encryption.

Regional parameters are containers for versioned configuration values. The examples show how to configure the container itself; storing actual configuration data requires creating parameter versions separately. Combine these with your own version management and access policies.

Create a regional parameter with minimal configuration

Most deployments start with a unique identifier and location to establish the parameter container.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const regional_parameter_basic = new gcp.parametermanager.RegionalParameter("regional-parameter-basic", {
    parameterId: "regional_parameter",
    location: "us-central1",
});

import pulumi
import pulumi_gcp as gcp

regional_parameter_basic = gcp.parametermanager.RegionalParameter("regional-parameter-basic",
    parameter_id="regional_parameter",
    location="us-central1")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := parametermanager.NewRegionalParameter(ctx, "regional-parameter-basic", &parametermanager.RegionalParameterArgs{
			ParameterId: pulumi.String("regional_parameter"),
			Location:    pulumi.String("us-central1"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var regional_parameter_basic = new Gcp.ParameterManager.RegionalParameter("regional-parameter-basic", new()
    {
        ParameterId = "regional_parameter",
        Location = "us-central1",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.parametermanager.RegionalParameter;
import com.pulumi.gcp.parametermanager.RegionalParameterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var regional_parameter_basic = new RegionalParameter("regional-parameter-basic", RegionalParameterArgs.builder()
            .parameterId("regional_parameter")
            .location("us-central1")
            .build());

    }
}

resources:
  regional-parameter-basic:
    type: gcp:parametermanager:RegionalParameter
    properties:
      parameterId: regional_parameter
      location: us-central1

The parameterId must be unique within the project. The location property places the parameter in a specific region (e.g., us-central1). Without additional configuration, the parameter uses UNFORMATTED type and Google-managed encryption.

Specify format for structured configuration data

Applications storing JSON or YAML benefit from declaring the format explicitly for validation and parsing.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const regional_parameter_with_format = new gcp.parametermanager.RegionalParameter("regional-parameter-with-format", {
    parameterId: "regional_parameter",
    location: "us-central1",
    format: "JSON",
});

import pulumi
import pulumi_gcp as gcp

regional_parameter_with_format = gcp.parametermanager.RegionalParameter("regional-parameter-with-format",
    parameter_id="regional_parameter",
    location="us-central1",
    format="JSON")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := parametermanager.NewRegionalParameter(ctx, "regional-parameter-with-format", &parametermanager.RegionalParameterArgs{
			ParameterId: pulumi.String("regional_parameter"),
			Location:    pulumi.String("us-central1"),
			Format:      pulumi.String("JSON"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var regional_parameter_with_format = new Gcp.ParameterManager.RegionalParameter("regional-parameter-with-format", new()
    {
        ParameterId = "regional_parameter",
        Location = "us-central1",
        Format = "JSON",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.parametermanager.RegionalParameter;
import com.pulumi.gcp.parametermanager.RegionalParameterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var regional_parameter_with_format = new RegionalParameter("regional-parameter-with-format", RegionalParameterArgs.builder()
            .parameterId("regional_parameter")
            .location("us-central1")
            .format("JSON")
            .build());

    }
}

resources:
  regional-parameter-with-format:
    type: gcp:parametermanager:RegionalParameter
    properties:
      parameterId: regional_parameter
      location: us-central1
      format: JSON

The format property tells Parameter Manager to expect structured data. Setting it to JSON or YAML enables validation when you create parameter versions. The default UNFORMATTED type accepts any payload without validation.

Tag parameters for organization and filtering

Teams managing many parameters use labels to group them by environment, application, or cost center.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const regional_parameter_with_labels = new gcp.parametermanager.RegionalParameter("regional-parameter-with-labels", {
    parameterId: "regional_parameter",
    location: "us-central1",
    labels: {
        key1: "val1",
        key2: "val2",
        key3: "val3",
        key4: "val4",
        key5: "val5",
    },
});

import pulumi
import pulumi_gcp as gcp

regional_parameter_with_labels = gcp.parametermanager.RegionalParameter("regional-parameter-with-labels",
    parameter_id="regional_parameter",
    location="us-central1",
    labels={
        "key1": "val1",
        "key2": "val2",
        "key3": "val3",
        "key4": "val4",
        "key5": "val5",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := parametermanager.NewRegionalParameter(ctx, "regional-parameter-with-labels", &parametermanager.RegionalParameterArgs{
			ParameterId: pulumi.String("regional_parameter"),
			Location:    pulumi.String("us-central1"),
			Labels: pulumi.StringMap{
				"key1": pulumi.String("val1"),
				"key2": pulumi.String("val2"),
				"key3": pulumi.String("val3"),
				"key4": pulumi.String("val4"),
				"key5": pulumi.String("val5"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var regional_parameter_with_labels = new Gcp.ParameterManager.RegionalParameter("regional-parameter-with-labels", new()
    {
        ParameterId = "regional_parameter",
        Location = "us-central1",
        Labels = 
        {
            { "key1", "val1" },
            { "key2", "val2" },
            { "key3", "val3" },
            { "key4", "val4" },
            { "key5", "val5" },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.parametermanager.RegionalParameter;
import com.pulumi.gcp.parametermanager.RegionalParameterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var regional_parameter_with_labels = new RegionalParameter("regional-parameter-with-labels", RegionalParameterArgs.builder()
            .parameterId("regional_parameter")
            .location("us-central1")
            .labels(Map.ofEntries(
                Map.entry("key1", "val1"),
                Map.entry("key2", "val2"),
                Map.entry("key3", "val3"),
                Map.entry("key4", "val4"),
                Map.entry("key5", "val5")
            ))
            .build());

    }
}

resources:
  regional-parameter-with-labels:
    type: gcp:parametermanager:RegionalParameter
    properties:
      parameterId: regional_parameter
      location: us-central1
      labels:
        key1: val1
        key2: val2
        key3: val3
        key4: val4
        key5: val5

The labels property accepts key-value pairs for metadata tagging. Labels help with discovery, cost allocation, and policy enforcement. You can attach up to 64 labels per parameter.

Encrypt parameter versions with customer-managed keys

Compliance requirements often mandate encryption with keys you control rather than Google-managed keys.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = gcp.organizations.getProject({});
const regional_parameter_with_kms_key = new gcp.parametermanager.RegionalParameter("regional-parameter-with-kms-key", {
    parameterId: "regional_parameter",
    location: "us-central1",
    kmsKey: "kms-key",
});

import pulumi
import pulumi_gcp as gcp

project = gcp.organizations.get_project()
regional_parameter_with_kms_key = gcp.parametermanager.RegionalParameter("regional-parameter-with-kms-key",
    parameter_id="regional_parameter",
    location="us-central1",
    kms_key="kms-key")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{}, nil)
		if err != nil {
			return err
		}
		_, err = parametermanager.NewRegionalParameter(ctx, "regional-parameter-with-kms-key", &parametermanager.RegionalParameterArgs{
			ParameterId: pulumi.String("regional_parameter"),
			Location:    pulumi.String("us-central1"),
			KmsKey:      pulumi.String("kms-key"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var project = Gcp.Organizations.GetProject.Invoke();

    var regional_parameter_with_kms_key = new Gcp.ParameterManager.RegionalParameter("regional-parameter-with-kms-key", new()
    {
        ParameterId = "regional_parameter",
        Location = "us-central1",
        KmsKey = "kms-key",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.parametermanager.RegionalParameter;
import com.pulumi.gcp.parametermanager.RegionalParameterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var project = OrganizationsFunctions.getProject(GetProjectArgs.builder()
            .build());

        var regional_parameter_with_kms_key = new RegionalParameter("regional-parameter-with-kms-key", RegionalParameterArgs.builder()
            .parameterId("regional_parameter")
            .location("us-central1")
            .kmsKey("kms-key")
            .build());

    }
}

resources:
  regional-parameter-with-kms-key:
    type: gcp:parametermanager:RegionalParameter
    properties:
      parameterId: regional_parameter
      location: us-central1
      kmsKey: kms-key
variables:
  project:
    fn::invoke:
      function: gcp:organizations:getProject
      arguments: {}

The kmsKey property specifies a Cloud KMS CryptoKey resource name. Parameter Manager uses this key to encrypt all version payloads at rest. You must have permissions to use the specified key for encryption operations.

Beyond these examples

These snippets focus on specific parameter container features: parameter creation and location placement, format specification for structured data, and labeling and KMS encryption. They’re intentionally minimal rather than complete configuration management solutions.

The examples assume pre-existing infrastructure such as a GCP project with Parameter Manager API enabled, and a Cloud KMS key ring and crypto key for the encryption example. They focus on configuring the parameter container rather than storing actual configuration values.

To keep things focused, common parameter patterns are omitted, including:

Parameter version creation and payload storage
IAM policy bindings (policyMembers)
Version lifecycle and rotation
Integration with Secret Manager or other services

These omissions are intentional: the goal is to illustrate how each parameter feature is wired, not provide drop-in configuration management modules. See the Regional Parameter resource reference for all available configuration options.

Let's create GCP Regional Parameters

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Configuration & Immutability

What properties can't I change after creating a regional parameter?

The location, parameterId, project, and format properties are immutable. Changing any of these after creation will trigger resource replacement.

What parameter formats are supported?

Regional parameters support three formats: UNFORMATTED (default), YAML, and JSON. The format is immutable after creation.

Labels & Metadata

Why don't I see all labels in my Pulumi state?

The labels field is non-authoritative and only manages labels defined in your configuration. Use effectiveLabels to see all labels present on the resource, including those set by other clients and services.

What are the requirements for parameter labels?

Label keys must be 1-63 characters matching the pattern [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}-]{0,62}. Label values must be 0-63 characters matching [\p{Ll}\p{Lo}\p{N}-]{0,63}. You can assign a maximum of 64 labels per resource.

Security & Encryption

How do I encrypt my parameters with Cloud KMS?

Set the kmsKey property to your Cloud KMS CryptoKey resource name using the format projects/{{project}}/locations/{{location}}/keyRings/{{key_ring}}/cryptoKeys/{{crypto_key}}.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides