gcp.kms.getCryptoKeyVersions

Google Cloud v9.16.0, Mar 19 26

Viewing docs for Google Cloud v9.16.0
published on Thursday, Mar 19, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-gcp

Viewing docs for Google Cloud v9.16.0
published on Thursday, Mar 19, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-gcp

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const myKeyRing = gcp.kms.getKMSKeyRing({
    name: "my-key-ring",
    location: "us-central1",
});
const myCryptoKey = myKeyRing.then(myKeyRing => gcp.kms.getKMSCryptoKey({
    name: "my-crypto-key",
    keyRing: myKeyRing.id,
}));
const myCryptoKeyVersions = gcp.kms.getCryptoKeyVersions({
    cryptoKey: myKey.id,
});

import pulumi
import pulumi_gcp as gcp

my_key_ring = gcp.kms.get_kms_key_ring(name="my-key-ring",
    location="us-central1")
my_crypto_key = gcp.kms.get_kms_crypto_key(name="my-crypto-key",
    key_ring=my_key_ring.id)
my_crypto_key_versions = gcp.kms.get_crypto_key_versions(crypto_key=my_key["id"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		myKeyRing, err := kms.GetKMSKeyRing(ctx, &kms.GetKMSKeyRingArgs{
			Name:     "my-key-ring",
			Location: "us-central1",
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.GetKMSCryptoKey(ctx, &kms.GetKMSCryptoKeyArgs{
			Name:    "my-crypto-key",
			KeyRing: myKeyRing.Id,
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.GetCryptoKeyVersions(ctx, &kms.GetCryptoKeyVersionsArgs{
			CryptoKey: myKey.Id,
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var myKeyRing = Gcp.Kms.GetKMSKeyRing.Invoke(new()
    {
        Name = "my-key-ring",
        Location = "us-central1",
    });

    var myCryptoKey = Gcp.Kms.GetKMSCryptoKey.Invoke(new()
    {
        Name = "my-crypto-key",
        KeyRing = myKeyRing.Apply(getKMSKeyRingResult => getKMSKeyRingResult.Id),
    });

    var myCryptoKeyVersions = Gcp.Kms.GetCryptoKeyVersions.Invoke(new()
    {
        CryptoKey = myKey.Id,
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KmsFunctions;
import com.pulumi.gcp.kms.inputs.GetKMSKeyRingArgs;
import com.pulumi.gcp.kms.inputs.GetKMSCryptoKeyArgs;
import com.pulumi.gcp.kms.inputs.GetCryptoKeyVersionsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var myKeyRing = KmsFunctions.getKMSKeyRing(GetKMSKeyRingArgs.builder()
            .name("my-key-ring")
            .location("us-central1")
            .build());

        final var myCryptoKey = KmsFunctions.getKMSCryptoKey(GetKMSCryptoKeyArgs.builder()
            .name("my-crypto-key")
            .keyRing(myKeyRing.id())
            .build());

        final var myCryptoKeyVersions = KmsFunctions.getCryptoKeyVersions(GetCryptoKeyVersionsArgs.builder()
            .cryptoKey(myKey.id())
            .build());

    }
}

variables:
  myKeyRing:
    fn::invoke:
      function: gcp:kms:getKMSKeyRing
      arguments:
        name: my-key-ring
        location: us-central1
  myCryptoKey:
    fn::invoke:
      function: gcp:kms:getKMSCryptoKey
      arguments:
        name: my-crypto-key
        keyRing: ${myKeyRing.id}
  myCryptoKeyVersions:
    fn::invoke:
      function: gcp:kms:getCryptoKeyVersions
      arguments:
        cryptoKey: ${myKey.id}

Using getCryptoKeyVersions

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getCryptoKeyVersions(args: GetCryptoKeyVersionsArgs, opts?: InvokeOptions): Promise<GetCryptoKeyVersionsResult>
function getCryptoKeyVersionsOutput(args: GetCryptoKeyVersionsOutputArgs, opts?: InvokeOptions): Output<GetCryptoKeyVersionsResult>

def get_crypto_key_versions(crypto_key: Optional[str] = None,
                            filter: Optional[str] = None,
                            opts: Optional[InvokeOptions] = None) -> GetCryptoKeyVersionsResult
def get_crypto_key_versions_output(crypto_key: Optional[pulumi.Input[str]] = None,
                            filter: Optional[pulumi.Input[str]] = None,
                            opts: Optional[InvokeOptions] = None) -> Output[GetCryptoKeyVersionsResult]

func GetCryptoKeyVersions(ctx *Context, args *GetCryptoKeyVersionsArgs, opts ...InvokeOption) (*GetCryptoKeyVersionsResult, error)
func GetCryptoKeyVersionsOutput(ctx *Context, args *GetCryptoKeyVersionsOutputArgs, opts ...InvokeOption) GetCryptoKeyVersionsResultOutput

> Note: This function is named GetCryptoKeyVersions in the Go SDK.

public static class GetCryptoKeyVersions 
{
    public static Task<GetCryptoKeyVersionsResult> InvokeAsync(GetCryptoKeyVersionsArgs args, InvokeOptions? opts = null)
    public static Output<GetCryptoKeyVersionsResult> Invoke(GetCryptoKeyVersionsInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetCryptoKeyVersionsResult> getCryptoKeyVersions(GetCryptoKeyVersionsArgs args, InvokeOptions options)
public static Output<GetCryptoKeyVersionsResult> getCryptoKeyVersions(GetCryptoKeyVersionsArgs args, InvokeOptions options)

fn::invoke:
  function: gcp:kms/getCryptoKeyVersions:getCryptoKeyVersions
  arguments:
    # arguments dictionary

The following arguments are supported:

CryptoKey string

The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.

Filter string

The filter argument is used to add a filter query parameter that limits which versions are retrieved by the data source: ?filter={{filter}}. When no value is provided there is no filtering.

Example filter values if filtering on name. Note: names take the form projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{cryptoKey}}/cryptoKeyVersions.

"name:my-key-" will retrieve cryptoKeyVersions that contain "my-key-" anywhere in their name.
"name=projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key-1/cryptoKeyVersions/my-version-1" will only retrieve a key with that exact name.

See the documentation about using filters

CryptoKey string

The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.

Filter string

The filter argument is used to add a filter query parameter that limits which versions are retrieved by the data source: ?filter={{filter}}. When no value is provided there is no filtering.

Example filter values if filtering on name. Note: names take the form projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{cryptoKey}}/cryptoKeyVersions.

"name:my-key-" will retrieve cryptoKeyVersions that contain "my-key-" anywhere in their name.
"name=projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key-1/cryptoKeyVersions/my-version-1" will only retrieve a key with that exact name.

See the documentation about using filters

cryptoKey String

The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.

filter String

The filter argument is used to add a filter query parameter that limits which versions are retrieved by the data source: ?filter={{filter}}. When no value is provided there is no filtering.

Example filter values if filtering on name. Note: names take the form projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{cryptoKey}}/cryptoKeyVersions.

"name:my-key-" will retrieve cryptoKeyVersions that contain "my-key-" anywhere in their name.
"name=projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key-1/cryptoKeyVersions/my-version-1" will only retrieve a key with that exact name.

See the documentation about using filters

cryptoKey string

The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.

filter string

The filter argument is used to add a filter query parameter that limits which versions are retrieved by the data source: ?filter={{filter}}. When no value is provided there is no filtering.

Example filter values if filtering on name. Note: names take the form projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{cryptoKey}}/cryptoKeyVersions.

"name:my-key-" will retrieve cryptoKeyVersions that contain "my-key-" anywhere in their name.
"name=projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key-1/cryptoKeyVersions/my-version-1" will only retrieve a key with that exact name.

See the documentation about using filters

crypto_key str

The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.

filter str

The filter argument is used to add a filter query parameter that limits which versions are retrieved by the data source: ?filter={{filter}}. When no value is provided there is no filtering.

Example filter values if filtering on name. Note: names take the form projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{cryptoKey}}/cryptoKeyVersions.

"name:my-key-" will retrieve cryptoKeyVersions that contain "my-key-" anywhere in their name.
"name=projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key-1/cryptoKeyVersions/my-version-1" will only retrieve a key with that exact name.

See the documentation about using filters

cryptoKey String

The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.

filter String

The filter argument is used to add a filter query parameter that limits which versions are retrieved by the data source: ?filter={{filter}}. When no value is provided there is no filtering.

Example filter values if filtering on name. Note: names take the form projects/{{project}}/locations/{{location}}/keyRings/{{keyRing}}/cryptoKeys/{{cryptoKey}}/cryptoKeyVersions.

"name:my-key-" will retrieve cryptoKeyVersions that contain "my-key-" anywhere in their name.
"name=projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key-1/cryptoKeyVersions/my-version-1" will only retrieve a key with that exact name.

See the documentation about using filters

getCryptoKeyVersions Result

The following output properties are available:

CryptoKey string
Id string: The provider-assigned unique ID for this managed resource.
PublicKeys List<GetCryptoKeyVersionsPublicKey>
Versions List<GetCryptoKeyVersionsVersion>: A list of all the retrieved crypto key versions from the provided crypto key. This list is influenced by the provided filter argument.
Filter string

CryptoKey string
Id string: The provider-assigned unique ID for this managed resource.
PublicKeys []GetCryptoKeyVersionsPublicKey
Versions []GetCryptoKeyVersionsVersion: A list of all the retrieved crypto key versions from the provided crypto key. This list is influenced by the provided filter argument.
Filter string

cryptoKey String
id String: The provider-assigned unique ID for this managed resource.
publicKeys List<GetCryptoKeyVersionsPublicKey>
versions List<GetCryptoKeyVersionsVersion>: A list of all the retrieved crypto key versions from the provided crypto key. This list is influenced by the provided filter argument.
filter String

cryptoKey string
id string: The provider-assigned unique ID for this managed resource.
publicKeys GetCryptoKeyVersionsPublicKey[]
versions GetCryptoKeyVersionsVersion[]: A list of all the retrieved crypto key versions from the provided crypto key. This list is influenced by the provided filter argument.
filter string

crypto_key str
id str: The provider-assigned unique ID for this managed resource.
public_keys Sequence[GetCryptoKeyVersionsPublicKey]
versions Sequence[GetCryptoKeyVersionsVersion]: A list of all the retrieved crypto key versions from the provided crypto key. This list is influenced by the provided filter argument.
filter str

cryptoKey String
id String: The provider-assigned unique ID for this managed resource.
publicKeys List<Property Map>
versions List<Property Map>: A list of all the retrieved crypto key versions from the provided crypto key. This list is influenced by the provided filter argument.
filter String

Supporting Types

GetCryptoKeyVersionsPublicKey

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
Pem string: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
Pem string: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem String: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem string: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm str: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem str: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem String: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

GetCryptoKeyVersionsVersion

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
CryptoKey string: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
Id string
Name string
ProtectionLevel string
PublicKeys List<GetCryptoKeyVersionsVersionPublicKey>
State string
Version int

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
CryptoKey string: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
Id string
Name string
ProtectionLevel string
PublicKeys []GetCryptoKeyVersionsVersionPublicKey
State string
Version int

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
cryptoKey String: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
id String
name String
protectionLevel String
publicKeys List<GetCryptoKeyVersionsVersionPublicKey>
state String
version Integer

algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
cryptoKey string: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
id string
name string
protectionLevel string
publicKeys GetCryptoKeyVersionsVersionPublicKey[]
state string
version number

algorithm str: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
crypto_key str: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
id str
name str
protection_level str
public_keys Sequence[GetCryptoKeyVersionsVersionPublicKey]
state str
version int

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
cryptoKey String: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
id String
name String
protectionLevel String
publicKeys List<Property Map>
state String
version Number

GetCryptoKeyVersionsVersionPublicKey

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
Pem string: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
Pem string: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem String: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem string: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm str: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem str: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem String: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.