1. Packages
  2. Google Cloud (GCP) Classic
  3. API Docs
  4. kms
  5. FolderKajPolicyConfig
Google Cloud v9.4.0 published on Tuesday, Nov 4, 2025 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

gcp.kms.FolderKajPolicyConfig

Get Started
gcp logo
Google Cloud v9.4.0 published on Tuesday, Nov 4, 2025 by Pulumi
Schema (JSON)
pulumi/pulumi-gcp

    Example Usage

    Kms Folder Kaj Policy Config Basic

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as random from "@pulumi/random";
import * as time from "@pulumiverse/time";

// Create Folder in GCP Organization.
const kajFolder = new gcp.organizations.Folder("kaj_folder", {
    displayName: "my-folder",
    parent: "organizations/123456789",
    deletionProtection: false,
});
const projectSuffix = new random.RandomId("project_suffix", {byteLength: 4});
// Create a project for enabling KMS API.
const kmsProject = new gcp.organizations.Project("kms_project", {
    projectId: pulumi.interpolate`kms-api-project${projectSuffix.hex}`,
    name: pulumi.interpolate`kms-api-project${projectSuffix.hex}`,
    folderId: kajFolder.folderId,
    billingAccount: "000000-0000000-0000000-000000",
    deletionPolicy: "DELETE",
}, {
    dependsOn: [kajFolder],
});
// Enable the Cloud KMS API.
const kmsApiService = new gcp.projects.Service("kms_api_service", {
    service: "cloudkms.googleapis.com",
    project: kmsProject.projectId,
    disableDependentServices: true,
}, {
    dependsOn: [kmsProject],
});
const waitEnableServiceApi = new time.Sleep("wait_enable_service_api", {createDuration: "30s"}, {
    dependsOn: [kmsApiService],
});
// Update folder level KAJ default policy
const example = new gcp.kms.FolderKajPolicyConfig("example", {
    folder: kajFolder.folderId,
    defaultKeyAccessJustificationPolicy: {
        allowedAccessReasons: [
            "CUSTOMER_INITIATED_ACCESS",
            "GOOGLE_INITIATED_SYSTEM_OPERATION",
        ],
    },
}, {
    dependsOn: [waitEnableServiceApi],
});

    import pulumi
import pulumi_gcp as gcp
import pulumi_random as random
import pulumiverse_time as time

# Create Folder in GCP Organization.
kaj_folder = gcp.organizations.Folder("kaj_folder",
    display_name="my-folder",
    parent="organizations/123456789",
    deletion_protection=False)
project_suffix = random.RandomId("project_suffix", byte_length=4)
# Create a project for enabling KMS API.
kms_project = gcp.organizations.Project("kms_project",
    project_id=project_suffix.hex.apply(lambda hex: f"kms-api-project{hex}"),
    name=project_suffix.hex.apply(lambda hex: f"kms-api-project{hex}"),
    folder_id=kaj_folder.folder_id,
    billing_account="000000-0000000-0000000-000000",
    deletion_policy="DELETE",
    opts = pulumi.ResourceOptions(depends_on=[kaj_folder]))
# Enable the Cloud KMS API.
kms_api_service = gcp.projects.Service("kms_api_service",
    service="cloudkms.googleapis.com",
    project=kms_project.project_id,
    disable_dependent_services=True,
    opts = pulumi.ResourceOptions(depends_on=[kms_project]))
wait_enable_service_api = time.Sleep("wait_enable_service_api", create_duration="30s",
opts = pulumi.ResourceOptions(depends_on=[kms_api_service]))
# Update folder level KAJ default policy
example = gcp.kms.FolderKajPolicyConfig("example",
    folder=kaj_folder.folder_id,
    default_key_access_justification_policy={
        "allowed_access_reasons": [
            "CUSTOMER_INITIATED_ACCESS",
            "GOOGLE_INITIATED_SYSTEM_OPERATION",
        ],
    },
    opts = pulumi.ResourceOptions(depends_on=[wait_enable_service_api]))

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/projects"
	"github.com/pulumi/pulumi-random/sdk/v4/go/random"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-time/sdk/go/time"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create Folder in GCP Organization.
		kajFolder, err := organizations.NewFolder(ctx, "kaj_folder", &organizations.FolderArgs{
			DisplayName:        pulumi.String("my-folder"),
			Parent:             pulumi.String("organizations/123456789"),
			DeletionProtection: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		projectSuffix, err := random.NewRandomId(ctx, "project_suffix", &random.RandomIdArgs{
			ByteLength: pulumi.Int(4),
		})
		if err != nil {
			return err
		}
		// Create a project for enabling KMS API.
		kmsProject, err := organizations.NewProject(ctx, "kms_project", &organizations.ProjectArgs{
			ProjectId: projectSuffix.Hex.ApplyT(func(hex string) (string, error) {
				return fmt.Sprintf("kms-api-project%v", hex), nil
			}).(pulumi.StringOutput),
			Name: projectSuffix.Hex.ApplyT(func(hex string) (string, error) {
				return fmt.Sprintf("kms-api-project%v", hex), nil
			}).(pulumi.StringOutput),
			FolderId:       kajFolder.FolderId,
			BillingAccount: pulumi.String("000000-0000000-0000000-000000"),
			DeletionPolicy: pulumi.String("DELETE"),
		}, pulumi.DependsOn([]pulumi.Resource{
			kajFolder,
		}))
		if err != nil {
			return err
		}
		// Enable the Cloud KMS API.
		kmsApiService, err := projects.NewService(ctx, "kms_api_service", &projects.ServiceArgs{
			Service:                  pulumi.String("cloudkms.googleapis.com"),
			Project:                  kmsProject.ProjectId,
			DisableDependentServices: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			kmsProject,
		}))
		if err != nil {
			return err
		}
		waitEnableServiceApi, err := time.NewSleep(ctx, "wait_enable_service_api", &time.SleepArgs{
			CreateDuration: pulumi.String("30s"),
		}, pulumi.DependsOn([]pulumi.Resource{
			kmsApiService,
		}))
		if err != nil {
			return err
		}
		// Update folder level KAJ default policy
		_, err = kms.NewFolderKajPolicyConfig(ctx, "example", &kms.FolderKajPolicyConfigArgs{
			Folder: kajFolder.FolderId,
			DefaultKeyAccessJustificationPolicy: &kms.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs{
				AllowedAccessReasons: pulumi.StringArray{
					pulumi.String("CUSTOMER_INITIATED_ACCESS"),
					pulumi.String("GOOGLE_INITIATED_SYSTEM_OPERATION"),
				},
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			waitEnableServiceApi,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Random = Pulumi.Random;
using Time = Pulumiverse.Time;

return await Deployment.RunAsync(() => 
{
    // Create Folder in GCP Organization.
    var kajFolder = new Gcp.Organizations.Folder("kaj_folder", new()
    {
        DisplayName = "my-folder",
        Parent = "organizations/123456789",
        DeletionProtection = false,
    });

    var projectSuffix = new Random.RandomId("project_suffix", new()
    {
        ByteLength = 4,
    });

    // Create a project for enabling KMS API.
    var kmsProject = new Gcp.Organizations.Project("kms_project", new()
    {
        ProjectId = projectSuffix.Hex.Apply(hex => $"kms-api-project{hex}"),
        Name = projectSuffix.Hex.Apply(hex => $"kms-api-project{hex}"),
        FolderId = kajFolder.FolderId,
        BillingAccount = "000000-0000000-0000000-000000",
        DeletionPolicy = "DELETE",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kajFolder,
        },
    });

    // Enable the Cloud KMS API.
    var kmsApiService = new Gcp.Projects.Service("kms_api_service", new()
    {
        ServiceName = "cloudkms.googleapis.com",
        Project = kmsProject.ProjectId,
        DisableDependentServices = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kmsProject,
        },
    });

    var waitEnableServiceApi = new Time.Sleep("wait_enable_service_api", new()
    {
        CreateDuration = "30s",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kmsApiService,
        },
    });

    // Update folder level KAJ default policy
    var example = new Gcp.Kms.FolderKajPolicyConfig("example", new()
    {
        Folder = kajFolder.FolderId,
        DefaultKeyAccessJustificationPolicy = new Gcp.Kms.Inputs.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
        {
            AllowedAccessReasons = new[]
            {
                "CUSTOMER_INITIATED_ACCESS",
                "GOOGLE_INITIATED_SYSTEM_OPERATION",
            },
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            waitEnableServiceApi,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.Folder;
import com.pulumi.gcp.organizations.FolderArgs;
import com.pulumi.random.RandomId;
import com.pulumi.random.RandomIdArgs;
import com.pulumi.gcp.organizations.Project;
import com.pulumi.gcp.organizations.ProjectArgs;
import com.pulumi.gcp.projects.Service;
import com.pulumi.gcp.projects.ServiceArgs;
import com.pulumiverse.time.Sleep;
import com.pulumiverse.time.SleepArgs;
import com.pulumi.gcp.kms.FolderKajPolicyConfig;
import com.pulumi.gcp.kms.FolderKajPolicyConfigArgs;
import com.pulumi.gcp.kms.inputs.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Create Folder in GCP Organization.
        var kajFolder = new Folder("kajFolder", FolderArgs.builder()
            .displayName("my-folder")
            .parent("organizations/123456789")
            .deletionProtection(false)
            .build());

        var projectSuffix = new RandomId("projectSuffix", RandomIdArgs.builder()
            .byteLength(4)
            .build());

        // Create a project for enabling KMS API.
        var kmsProject = new Project("kmsProject", ProjectArgs.builder()
            .projectId(projectSuffix.hex().applyValue(_hex -> String.format("kms-api-project%s", _hex)))
            .name(projectSuffix.hex().applyValue(_hex -> String.format("kms-api-project%s", _hex)))
            .folderId(kajFolder.folderId())
            .billingAccount("000000-0000000-0000000-000000")
            .deletionPolicy("DELETE")
            .build(), CustomResourceOptions.builder()
                .dependsOn(kajFolder)
                .build());

        // Enable the Cloud KMS API.
        var kmsApiService = new Service("kmsApiService", ServiceArgs.builder()
            .service("cloudkms.googleapis.com")
            .project(kmsProject.projectId())
            .disableDependentServices(true)
            .build(), CustomResourceOptions.builder()
                .dependsOn(kmsProject)
                .build());

        var waitEnableServiceApi = new Sleep("waitEnableServiceApi", SleepArgs.builder()
            .createDuration("30s")
            .build(), CustomResourceOptions.builder()
                .dependsOn(kmsApiService)
                .build());

        // Update folder level KAJ default policy
        var example = new FolderKajPolicyConfig("example", FolderKajPolicyConfigArgs.builder()
            .folder(kajFolder.folderId())
            .defaultKeyAccessJustificationPolicy(FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs.builder()
                .allowedAccessReasons(                
                    "CUSTOMER_INITIATED_ACCESS",
                    "GOOGLE_INITIATED_SYSTEM_OPERATION")
                .build())
            .build(), CustomResourceOptions.builder()
                .dependsOn(waitEnableServiceApi)
                .build());

    }
}

    resources:
  # Create Folder in GCP Organization.
  kajFolder:
    type: gcp:organizations:Folder
    name: kaj_folder
    properties:
      displayName: my-folder
      parent: organizations/123456789
      deletionProtection: false
  projectSuffix:
    type: random:RandomId
    name: project_suffix
    properties:
      byteLength: 4
  # Create a project for enabling KMS API.
  kmsProject:
    type: gcp:organizations:Project
    name: kms_project
    properties:
      projectId: kms-api-project${projectSuffix.hex}
      name: kms-api-project${projectSuffix.hex}
      folderId: ${kajFolder.folderId}
      billingAccount: 000000-0000000-0000000-000000
      deletionPolicy: DELETE
    options:
      dependsOn:
        - ${kajFolder}
  # Enable the Cloud KMS API.
  kmsApiService:
    type: gcp:projects:Service
    name: kms_api_service
    properties:
      service: cloudkms.googleapis.com
      project: ${kmsProject.projectId}
      disableDependentServices: true
    options:
      dependsOn:
        - ${kmsProject}
  waitEnableServiceApi:
    type: time:Sleep
    name: wait_enable_service_api
    properties:
      createDuration: 30s
    options:
      dependsOn:
        - ${kmsApiService}
  # Update folder level KAJ default policy
  example:
    type: gcp:kms:FolderKajPolicyConfig
    properties:
      folder: ${kajFolder.folderId}
      defaultKeyAccessJustificationPolicy:
        allowedAccessReasons:
          - CUSTOMER_INITIATED_ACCESS
          - GOOGLE_INITIATED_SYSTEM_OPERATION
    options:
      dependsOn:
        - ${waitEnableServiceApi}

    Create FolderKajPolicyConfig Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new FolderKajPolicyConfig(name: string, args: FolderKajPolicyConfigArgs, opts?: CustomResourceOptions);
    @overload
def FolderKajPolicyConfig(resource_name: str,
                          args: FolderKajPolicyConfigArgs,
                          opts: Optional[ResourceOptions] = None)

@overload
def FolderKajPolicyConfig(resource_name: str,
                          opts: Optional[ResourceOptions] = None,
                          folder: Optional[str] = None,
                          default_key_access_justification_policy: Optional[FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs] = None)
    func NewFolderKajPolicyConfig(ctx *Context, name string, args FolderKajPolicyConfigArgs, opts ...ResourceOption) (*FolderKajPolicyConfig, error)
    public FolderKajPolicyConfig(string name, FolderKajPolicyConfigArgs args, CustomResourceOptions? opts = null)
    public FolderKajPolicyConfig(String name, FolderKajPolicyConfigArgs args)
public FolderKajPolicyConfig(String name, FolderKajPolicyConfigArgs args, CustomResourceOptions options)

    type: gcp:kms:FolderKajPolicyConfig
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args FolderKajPolicyConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args FolderKajPolicyConfigArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args FolderKajPolicyConfigArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args FolderKajPolicyConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args FolderKajPolicyConfigArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var folderKajPolicyConfigResource = new Gcp.Kms.FolderKajPolicyConfig("folderKajPolicyConfigResource", new()
{
    Folder = "string",
    DefaultKeyAccessJustificationPolicy = new Gcp.Kms.Inputs.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    {
        AllowedAccessReasons = new[]
        {
            "string",
        },
    },
});

    example, err := kms.NewFolderKajPolicyConfig(ctx, "folderKajPolicyConfigResource", &kms.FolderKajPolicyConfigArgs{
	Folder: pulumi.String("string"),
	DefaultKeyAccessJustificationPolicy: &kms.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs{
		AllowedAccessReasons: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
})

    var folderKajPolicyConfigResource = new FolderKajPolicyConfig("folderKajPolicyConfigResource", FolderKajPolicyConfigArgs.builder()
    .folder("string")
    .defaultKeyAccessJustificationPolicy(FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs.builder()
        .allowedAccessReasons("string")
        .build())
    .build());

    folder_kaj_policy_config_resource = gcp.kms.FolderKajPolicyConfig("folderKajPolicyConfigResource",
    folder="string",
    default_key_access_justification_policy={
        "allowed_access_reasons": ["string"],
    })

    const folderKajPolicyConfigResource = new gcp.kms.FolderKajPolicyConfig("folderKajPolicyConfigResource", {
    folder: "string",
    defaultKeyAccessJustificationPolicy: {
        allowedAccessReasons: ["string"],
    },
});

    type: gcp:kms:FolderKajPolicyConfig
properties:
    defaultKeyAccessJustificationPolicy:
        allowedAccessReasons:
            - string
    folder: string

    FolderKajPolicyConfig Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The FolderKajPolicyConfig resource accepts the following input properties:

    Folder string
    The numeric folder number for which to retrieve config.
    DefaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    Folder string
    The numeric folder number for which to retrieve config.
    DefaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    folder String
    The numeric folder number for which to retrieve config.
    defaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    folder string
    The numeric folder number for which to retrieve config.
    defaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    folder str
    The numeric folder number for which to retrieve config.
    default_key_access_justification_policy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    folder String
    The numeric folder number for which to retrieve config.
    defaultKeyAccessJustificationPolicy Property Map
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the FolderKajPolicyConfig resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing FolderKajPolicyConfig Resource

    Get an existing FolderKajPolicyConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: FolderKajPolicyConfigState, opts?: CustomResourceOptions): FolderKajPolicyConfig
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        default_key_access_justification_policy: Optional[FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs] = None,
        folder: Optional[str] = None) -> FolderKajPolicyConfig
    func GetFolderKajPolicyConfig(ctx *Context, name string, id IDInput, state *FolderKajPolicyConfigState, opts ...ResourceOption) (*FolderKajPolicyConfig, error)
    public static FolderKajPolicyConfig Get(string name, Input<string> id, FolderKajPolicyConfigState? state, CustomResourceOptions? opts = null)
    public static FolderKajPolicyConfig get(String name, Output<String> id, FolderKajPolicyConfigState state, CustomResourceOptions options)
    resources:  _:    type: gcp:kms:FolderKajPolicyConfig    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    DefaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    Folder string
    The numeric folder number for which to retrieve config.
    DefaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    Folder string
    The numeric folder number for which to retrieve config.
    defaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    folder String
    The numeric folder number for which to retrieve config.
    defaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    folder string
    The numeric folder number for which to retrieve config.
    default_key_access_justification_policy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    folder str
    The numeric folder number for which to retrieve config.
    defaultKeyAccessJustificationPolicy Property Map
    The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    folder String
    The numeric folder number for which to retrieve config.

    Supporting Types

    FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy, FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs

    AllowedAccessReasons List<string>
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    AllowedAccessReasons []string
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    allowedAccessReasons List<String>
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    allowedAccessReasons string[]
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    allowed_access_reasons Sequence[str]
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    allowedAccessReasons List<String>
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.

    Import

    FolderKajPolicyConfig can be imported using any of these accepted formats:

    • folders/{{folder}}/kajPolicyConfig

    • {{folder}}

    When using the pulumi import command, FolderKajPolicyConfig can be imported using one of the formats above. For example:

    $ pulumi import gcp:kms/folderKajPolicyConfig:FolderKajPolicyConfig default folders/{{folder}}/kajPolicyConfig

    $ pulumi import gcp:kms/folderKajPolicyConfig:FolderKajPolicyConfig default {{folder}}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Google Cloud (GCP) Classic pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the google-beta Terraform Provider.
    gcp logo
    Google Cloud v9.4.0 published on Tuesday, Nov 4, 2025 by Pulumi
    Schema (JSON)
    pulumi/pulumi-gcp
      Meet Neo: Your AI Platform Teammate