Create GCP Regional Parameters

The gcp:parametermanager/regionalParameter:RegionalParameter resource, part of the Pulumi GCP provider, defines a regional parameter container that stores versioned configuration values in a specific GCP location. This guide focuses on three capabilities: parameter creation with location placement, format specification for structured data, and labels and KMS encryption.

Regional parameters are containers for configuration values; the actual data lives in parameter versions that reference the parameter. The examples are intentionally small. Combine them with parameter version resources to store and retrieve configuration data.

Create a regional parameter with minimal configuration

Most deployments start with a unique identifier and location to establish the parameter container.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const regional_parameter_basic = new gcp.parametermanager.RegionalParameter("regional-parameter-basic", {
    parameterId: "regional_parameter",
    location: "us-central1",
});

import pulumi
import pulumi_gcp as gcp

regional_parameter_basic = gcp.parametermanager.RegionalParameter("regional-parameter-basic",
    parameter_id="regional_parameter",
    location="us-central1")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := parametermanager.NewRegionalParameter(ctx, "regional-parameter-basic", &parametermanager.RegionalParameterArgs{
			ParameterId: pulumi.String("regional_parameter"),
			Location:    pulumi.String("us-central1"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var regional_parameter_basic = new Gcp.ParameterManager.RegionalParameter("regional-parameter-basic", new()
    {
        ParameterId = "regional_parameter",
        Location = "us-central1",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.parametermanager.RegionalParameter;
import com.pulumi.gcp.parametermanager.RegionalParameterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var regional_parameter_basic = new RegionalParameter("regional-parameter-basic", RegionalParameterArgs.builder()
            .parameterId("regional_parameter")
            .location("us-central1")
            .build());

    }
}

resources:
  regional-parameter-basic:
    type: gcp:parametermanager:RegionalParameter
    properties:
      parameterId: regional_parameter
      location: us-central1

The parameterId must be unique within the project and location. The location property pins the parameter to a specific region like us-central1. Without additional configuration, the parameter uses UNFORMATTED type and no encryption beyond Google’s default encryption at rest.

Specify format for structured configuration data

When storing JSON or YAML, declaring the format enables validation and helps applications parse values correctly.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const regional_parameter_with_format = new gcp.parametermanager.RegionalParameter("regional-parameter-with-format", {
    parameterId: "regional_parameter",
    location: "us-central1",
    format: "JSON",
});

import pulumi
import pulumi_gcp as gcp

regional_parameter_with_format = gcp.parametermanager.RegionalParameter("regional-parameter-with-format",
    parameter_id="regional_parameter",
    location="us-central1",
    format="JSON")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := parametermanager.NewRegionalParameter(ctx, "regional-parameter-with-format", &parametermanager.RegionalParameterArgs{
			ParameterId: pulumi.String("regional_parameter"),
			Location:    pulumi.String("us-central1"),
			Format:      pulumi.String("JSON"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var regional_parameter_with_format = new Gcp.ParameterManager.RegionalParameter("regional-parameter-with-format", new()
    {
        ParameterId = "regional_parameter",
        Location = "us-central1",
        Format = "JSON",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.parametermanager.RegionalParameter;
import com.pulumi.gcp.parametermanager.RegionalParameterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var regional_parameter_with_format = new RegionalParameter("regional-parameter-with-format", RegionalParameterArgs.builder()
            .parameterId("regional_parameter")
            .location("us-central1")
            .format("JSON")
            .build());

    }
}

resources:
  regional-parameter-with-format:
    type: gcp:parametermanager:RegionalParameter
    properties:
      parameterId: regional_parameter
      location: us-central1
      format: JSON

The format property accepts UNFORMATTED, YAML, or JSON. Setting format to JSON tells Parameter Manager to validate that parameter versions contain valid JSON, preventing malformed configuration from reaching applications.

Organize parameters with metadata labels

Teams managing many parameters use labels for organization, cost tracking, and filtering.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const regional_parameter_with_labels = new gcp.parametermanager.RegionalParameter("regional-parameter-with-labels", {
    parameterId: "regional_parameter",
    location: "us-central1",
    labels: {
        key1: "val1",
        key2: "val2",
        key3: "val3",
        key4: "val4",
        key5: "val5",
    },
});

import pulumi
import pulumi_gcp as gcp

regional_parameter_with_labels = gcp.parametermanager.RegionalParameter("regional-parameter-with-labels",
    parameter_id="regional_parameter",
    location="us-central1",
    labels={
        "key1": "val1",
        "key2": "val2",
        "key3": "val3",
        "key4": "val4",
        "key5": "val5",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := parametermanager.NewRegionalParameter(ctx, "regional-parameter-with-labels", &parametermanager.RegionalParameterArgs{
			ParameterId: pulumi.String("regional_parameter"),
			Location:    pulumi.String("us-central1"),
			Labels: pulumi.StringMap{
				"key1": pulumi.String("val1"),
				"key2": pulumi.String("val2"),
				"key3": pulumi.String("val3"),
				"key4": pulumi.String("val4"),
				"key5": pulumi.String("val5"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var regional_parameter_with_labels = new Gcp.ParameterManager.RegionalParameter("regional-parameter-with-labels", new()
    {
        ParameterId = "regional_parameter",
        Location = "us-central1",
        Labels = 
        {
            { "key1", "val1" },
            { "key2", "val2" },
            { "key3", "val3" },
            { "key4", "val4" },
            { "key5", "val5" },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.parametermanager.RegionalParameter;
import com.pulumi.gcp.parametermanager.RegionalParameterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var regional_parameter_with_labels = new RegionalParameter("regional-parameter-with-labels", RegionalParameterArgs.builder()
            .parameterId("regional_parameter")
            .location("us-central1")
            .labels(Map.ofEntries(
                Map.entry("key1", "val1"),
                Map.entry("key2", "val2"),
                Map.entry("key3", "val3"),
                Map.entry("key4", "val4"),
                Map.entry("key5", "val5")
            ))
            .build());

    }
}

resources:
  regional-parameter-with-labels:
    type: gcp:parametermanager:RegionalParameter
    properties:
      parameterId: regional_parameter
      location: us-central1
      labels:
        key1: val1
        key2: val2
        key3: val3
        key4: val4
        key5: val5

The labels property accepts up to 64 key-value pairs. Label keys and values must follow GCP’s naming rules: lowercase letters, numbers, hyphens, and underscores. Labels appear in effectiveLabels output, which includes both your configured labels and any applied by other systems.

Encrypt parameter versions with Cloud KMS

Sensitive configuration requires encryption with customer-managed keys for compliance or security requirements.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = gcp.organizations.getProject({});
const regional_parameter_with_kms_key = new gcp.parametermanager.RegionalParameter("regional-parameter-with-kms-key", {
    parameterId: "regional_parameter",
    location: "us-central1",
    kmsKey: "kms-key",
});

import pulumi
import pulumi_gcp as gcp

project = gcp.organizations.get_project()
regional_parameter_with_kms_key = gcp.parametermanager.RegionalParameter("regional-parameter-with-kms-key",
    parameter_id="regional_parameter",
    location="us-central1",
    kms_key="kms-key")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/parametermanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{}, nil)
		if err != nil {
			return err
		}
		_, err = parametermanager.NewRegionalParameter(ctx, "regional-parameter-with-kms-key", &parametermanager.RegionalParameterArgs{
			ParameterId: pulumi.String("regional_parameter"),
			Location:    pulumi.String("us-central1"),
			KmsKey:      pulumi.String("kms-key"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var project = Gcp.Organizations.GetProject.Invoke();

    var regional_parameter_with_kms_key = new Gcp.ParameterManager.RegionalParameter("regional-parameter-with-kms-key", new()
    {
        ParameterId = "regional_parameter",
        Location = "us-central1",
        KmsKey = "kms-key",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.parametermanager.RegionalParameter;
import com.pulumi.gcp.parametermanager.RegionalParameterArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var project = OrganizationsFunctions.getProject(GetProjectArgs.builder()
            .build());

        var regional_parameter_with_kms_key = new RegionalParameter("regional-parameter-with-kms-key", RegionalParameterArgs.builder()
            .parameterId("regional_parameter")
            .location("us-central1")
            .kmsKey("kms-key")
            .build());

    }
}

resources:
  regional-parameter-with-kms-key:
    type: gcp:parametermanager:RegionalParameter
    properties:
      parameterId: regional_parameter
      location: us-central1
      kmsKey: kms-key
variables:
  project:
    fn::invoke:
      function: gcp:organizations:getProject
      arguments: {}

The kmsKey property references a Cloud KMS CryptoKey by its full resource name. Parameter Manager encrypts all versions of this parameter using the specified key. You need IAM permissions to use the key, and the key must exist before creating the parameter.

Beyond these examples

These snippets focus on specific parameter-level features: parameter creation and location placement, format specification for structured data, and labeling and KMS encryption. They’re intentionally minimal rather than complete configuration management solutions.

The examples may reference pre-existing infrastructure such as a GCP project with Parameter Manager API enabled, and Cloud KMS CryptoKey for the encryption example. They focus on defining the parameter container rather than storing or retrieving actual configuration values.

To keep things focused, common parameter patterns are omitted, including:

  • Parameter version creation and management
  • IAM policy configuration (policyMembers)
  • Parameter value storage and retrieval
  • Cross-region replication or multi-region parameters

These omissions are intentional: the goal is to illustrate how each parameter feature is wired, not provide drop-in configuration management modules. See the Regional Parameter resource reference for all available configuration options.

Let's create GCP Regional Parameters

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Configuration & Immutability
What properties can't I change after creating a regional parameter?
The location, parameterId, project, and format properties are immutable and require resource recreation if changed. Plan these values carefully during initial creation.
What are the format options and can I change them later?
Regional parameters support three formats: UNFORMATTED (default), YAML, and JSON. The format is immutable and cannot be changed after creation.
Labels & Metadata
What's the difference between labels and effectiveLabels?
The labels field is non-authoritative and only manages labels in your configuration. Use effectiveLabels to see all labels on the resource, including those set by other clients and services.
What are the requirements for parameter labels?
Label keys must be 1-63 characters matching the pattern [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}-]{0,62}. Label values must be 0-63 characters matching [\p{Ll}\p{Lo}\p{N}-]{0,63}. Maximum 64 labels per resource.
Encryption & Security
How do I encrypt my regional parameter with Cloud KMS?
Set the kmsKey property to your Cloud KMS CryptoKey resource name in the format projects/{{project}}/locations/{{location}}/keyRings/{{key_ring}}/cryptoKeys/{{crypto_key}}.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides