gcp.kms.getKMSCryptoKeyVersion

Google Cloud v9.18.0, Apr 1 26

Viewing docs for Google Cloud v9.18.0
published on Wednesday, Apr 1, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-gcp

Viewing docs for Google Cloud v9.18.0
published on Wednesday, Apr 1, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-gcp

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const myKeyRing = gcp.kms.getKMSKeyRing({
    name: "my-key-ring",
    location: "us-central1",
});
const myCryptoKey = myKeyRing.then(myKeyRing => gcp.kms.getKMSCryptoKey({
    name: "my-crypto-key",
    keyRing: myKeyRing.id,
}));
const myCryptoKeyVersion = gcp.kms.getKMSCryptoKeyVersion({
    cryptoKey: myKey.id,
});

import pulumi
import pulumi_gcp as gcp

my_key_ring = gcp.kms.get_kms_key_ring(name="my-key-ring",
    location="us-central1")
my_crypto_key = gcp.kms.get_kms_crypto_key(name="my-crypto-key",
    key_ring=my_key_ring.id)
my_crypto_key_version = gcp.kms.get_kms_crypto_key_version(crypto_key=my_key["id"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		myKeyRing, err := kms.GetKMSKeyRing(ctx, &kms.GetKMSKeyRingArgs{
			Name:     "my-key-ring",
			Location: "us-central1",
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.GetKMSCryptoKey(ctx, &kms.GetKMSCryptoKeyArgs{
			Name:    "my-crypto-key",
			KeyRing: myKeyRing.Id,
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.GetKMSCryptoKeyVersion(ctx, &kms.GetKMSCryptoKeyVersionArgs{
			CryptoKey: myKey.Id,
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var myKeyRing = Gcp.Kms.GetKMSKeyRing.Invoke(new()
    {
        Name = "my-key-ring",
        Location = "us-central1",
    });

    var myCryptoKey = Gcp.Kms.GetKMSCryptoKey.Invoke(new()
    {
        Name = "my-crypto-key",
        KeyRing = myKeyRing.Apply(getKMSKeyRingResult => getKMSKeyRingResult.Id),
    });

    var myCryptoKeyVersion = Gcp.Kms.GetKMSCryptoKeyVersion.Invoke(new()
    {
        CryptoKey = myKey.Id,
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KmsFunctions;
import com.pulumi.gcp.kms.inputs.GetKMSKeyRingArgs;
import com.pulumi.gcp.kms.inputs.GetKMSCryptoKeyArgs;
import com.pulumi.gcp.kms.inputs.GetKMSCryptoKeyVersionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var myKeyRing = KmsFunctions.getKMSKeyRing(GetKMSKeyRingArgs.builder()
            .name("my-key-ring")
            .location("us-central1")
            .build());

        final var myCryptoKey = KmsFunctions.getKMSCryptoKey(GetKMSCryptoKeyArgs.builder()
            .name("my-crypto-key")
            .keyRing(myKeyRing.id())
            .build());

        final var myCryptoKeyVersion = KmsFunctions.getKMSCryptoKeyVersion(GetKMSCryptoKeyVersionArgs.builder()
            .cryptoKey(myKey.id())
            .build());

    }
}

variables:
  myKeyRing:
    fn::invoke:
      function: gcp:kms:getKMSKeyRing
      arguments:
        name: my-key-ring
        location: us-central1
  myCryptoKey:
    fn::invoke:
      function: gcp:kms:getKMSCryptoKey
      arguments:
        name: my-crypto-key
        keyRing: ${myKeyRing.id}
  myCryptoKeyVersion:
    fn::invoke:
      function: gcp:kms:getKMSCryptoKeyVersion
      arguments:
        cryptoKey: ${myKey.id}

Using getKMSCryptoKeyVersion

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getKMSCryptoKeyVersion(args: GetKMSCryptoKeyVersionArgs, opts?: InvokeOptions): Promise<GetKMSCryptoKeyVersionResult>
function getKMSCryptoKeyVersionOutput(args: GetKMSCryptoKeyVersionOutputArgs, opts?: InvokeOptions): Output<GetKMSCryptoKeyVersionResult>

def get_kms_crypto_key_version(crypto_key: Optional[str] = None,
                               version: Optional[int] = None,
                               opts: Optional[InvokeOptions] = None) -> GetKMSCryptoKeyVersionResult
def get_kms_crypto_key_version_output(crypto_key: Optional[pulumi.Input[str]] = None,
                               version: Optional[pulumi.Input[int]] = None,
                               opts: Optional[InvokeOptions] = None) -> Output[GetKMSCryptoKeyVersionResult]

func GetKMSCryptoKeyVersion(ctx *Context, args *GetKMSCryptoKeyVersionArgs, opts ...InvokeOption) (*GetKMSCryptoKeyVersionResult, error)
func GetKMSCryptoKeyVersionOutput(ctx *Context, args *GetKMSCryptoKeyVersionOutputArgs, opts ...InvokeOption) GetKMSCryptoKeyVersionResultOutput

> Note: This function is named GetKMSCryptoKeyVersion in the Go SDK.

public static class GetKMSCryptoKeyVersion 
{
    public static Task<GetKMSCryptoKeyVersionResult> InvokeAsync(GetKMSCryptoKeyVersionArgs args, InvokeOptions? opts = null)
    public static Output<GetKMSCryptoKeyVersionResult> Invoke(GetKMSCryptoKeyVersionInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetKMSCryptoKeyVersionResult> getKMSCryptoKeyVersion(GetKMSCryptoKeyVersionArgs args, InvokeOptions options)
public static Output<GetKMSCryptoKeyVersionResult> getKMSCryptoKeyVersion(GetKMSCryptoKeyVersionArgs args, InvokeOptions options)

fn::invoke:
  function: gcp:kms/getKMSCryptoKeyVersion:getKMSCryptoKeyVersion
  arguments:
    # arguments dictionary

The following arguments are supported:

CryptoKey string: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
Version int: The version number for this CryptoKeyVersion. Defaults to 1.

CryptoKey string: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
Version int: The version number for this CryptoKeyVersion. Defaults to 1.

cryptoKey String: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
version Integer: The version number for this CryptoKeyVersion. Defaults to 1.

cryptoKey string: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
version number: The version number for this CryptoKeyVersion. Defaults to 1.

crypto_key str: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
version int: The version number for this CryptoKeyVersion. Defaults to 1.

cryptoKey String: The id of the Google Cloud Platform CryptoKey to which the key version belongs. This is also the id field of the gcp.kms.CryptoKey resource/datasource.
version Number: The version number for this CryptoKeyVersion. Defaults to 1.

getKMSCryptoKeyVersion Result

The following output properties are available:

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
CryptoKey string
Id string: The provider-assigned unique ID for this managed resource.
Name string: The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*
ProtectionLevel string: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. See the protectionLevel reference for possible outputs.
PublicKeys List<GetKMSCryptoKeyVersionPublicKey>: If the enclosing CryptoKey has purpose ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT, this block contains details about the public key associated to this CryptoKeyVersion. Structure is documented below.
State string: The current state of the CryptoKeyVersion. See the state reference for possible outputs.
Version int

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
CryptoKey string
Id string: The provider-assigned unique ID for this managed resource.
Name string: The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*
ProtectionLevel string: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. See the protectionLevel reference for possible outputs.
PublicKeys []GetKMSCryptoKeyVersionPublicKey: If the enclosing CryptoKey has purpose ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT, this block contains details about the public key associated to this CryptoKeyVersion. Structure is documented below.
State string: The current state of the CryptoKeyVersion. See the state reference for possible outputs.
Version int

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
cryptoKey String
id String: The provider-assigned unique ID for this managed resource.
name String: The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*
protectionLevel String: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. See the protectionLevel reference for possible outputs.
publicKeys List<GetKMSCryptoKeyVersionPublicKey>: If the enclosing CryptoKey has purpose ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT, this block contains details about the public key associated to this CryptoKeyVersion. Structure is documented below.
state String: The current state of the CryptoKeyVersion. See the state reference for possible outputs.
version Integer

algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
cryptoKey string
id string: The provider-assigned unique ID for this managed resource.
name string: The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*
protectionLevel string: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. See the protectionLevel reference for possible outputs.
publicKeys GetKMSCryptoKeyVersionPublicKey[]: If the enclosing CryptoKey has purpose ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT, this block contains details about the public key associated to this CryptoKeyVersion. Structure is documented below.
state string: The current state of the CryptoKeyVersion. See the state reference for possible outputs.
version number

algorithm str: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
crypto_key str
id str: The provider-assigned unique ID for this managed resource.
name str: The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*
protection_level str: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. See the protectionLevel reference for possible outputs.
public_keys Sequence[GetKMSCryptoKeyVersionPublicKey]: If the enclosing CryptoKey has purpose ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT, this block contains details about the public key associated to this CryptoKeyVersion. Structure is documented below.
state str: The current state of the CryptoKeyVersion. See the state reference for possible outputs.
version int

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
cryptoKey String
id String: The provider-assigned unique ID for this managed resource.
name String: The resource name for this CryptoKeyVersion in the format projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*
protectionLevel String: The ProtectionLevel describing how crypto operations are performed with this CryptoKeyVersion. See the protectionLevel reference for possible outputs.
publicKeys List<Property Map>: If the enclosing CryptoKey has purpose ASYMMETRIC_SIGN or ASYMMETRIC_DECRYPT, this block contains details about the public key associated to this CryptoKeyVersion. Structure is documented below.
state String: The current state of the CryptoKeyVersion. See the state reference for possible outputs.
version Number

Supporting Types

GetKMSCryptoKeyVersionPublicKey

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
Pem string: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

Algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
Pem string: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem String: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm string: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem string: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm str: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem str: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.

algorithm String: The CryptoKeyVersionAlgorithm that this CryptoKeyVersion supports.
pem String: The public key, encoded in PEM format. For more information, see the RFC 7468 sections for General Considerations and Textual Encoding of Subject Public Key Info.