getKmsVerify

HashiCorp Vault v7.12.0, Aug 15 26

Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-vault

Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-vault

Example Usage

Basic Signature Verification

import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const gcpkms = new vault.gcp.KmsSecretBackend("gcpkms", {
    path: "gcpkms",
    credentialsWo: std.file({
        input: "gcp-credentials.json",
    }).then(invoke => invoke.result),
    credentialsWoVersion: 1,
});
const signingKey = new vault.gcp.KmsSecretBackendKey("signing_key", {
    mount: gcpkms.path,
    keyName: "signing-key",
    keyRing: "projects/my-project/locations/us-central1/keyRings/my-keyring",
    purpose: "asymmetric_sign",
    algorithm: "rsa_sign_pss_2048_sha256",
});
const signatureCheck = vault.gcp.getKmsVerifyOutput({
    mount: gcpkms.path,
    keyName: signingKey.keyName,
    digest: std.base64encode({
        input: "my message digest",
    }).then(invoke => invoke.result),
    signature: "BASE64_ENCODED_SIGNATURE",
    keyVersion: 1,
});
export const signatureIsValid = signatureCheck.valid;

import pulumi
import pulumi_std as std
import pulumi_vault as vault

gcpkms = vault.gcp.KmsSecretBackend("gcpkms",
    path="gcpkms",
    credentials_wo=std.file(input="gcp-credentials.json").result,
    credentials_wo_version=1)
signing_key = vault.gcp.KmsSecretBackendKey("signing_key",
    mount=gcpkms.path,
    key_name="signing-key",
    key_ring="projects/my-project/locations/us-central1/keyRings/my-keyring",
    purpose="asymmetric_sign",
    algorithm="rsa_sign_pss_2048_sha256")
signature_check = vault.gcp.get_kms_verify_output(mount=gcpkms.path,
    key_name=signing_key.key_name,
    digest=std.base64encode(input="my message digest").result,
    signature="BASE64_ENCODED_SIGNATURE",
    key_version=1)
pulumi.export("signatureIsValid", signature_check.valid)

package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "gcp-credentials.json",
		}, nil)
		if err != nil {
			return err
		}
		gcpkms, err := gcp.NewKmsSecretBackend(ctx, "gcpkms", &gcp.KmsSecretBackendArgs{
			Path:                 pulumi.String("gcpkms"),
			CredentialsWo:        pulumi.String(invokeFile.Result),
			CredentialsWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		signingKey, err := gcp.NewKmsSecretBackendKey(ctx, "signing_key", &gcp.KmsSecretBackendKeyArgs{
			Mount:     gcpkms.Path,
			KeyName:   pulumi.String("signing-key"),
			KeyRing:   pulumi.String("projects/my-project/locations/us-central1/keyRings/my-keyring"),
			Purpose:   pulumi.String("asymmetric_sign"),
			Algorithm: pulumi.String("rsa_sign_pss_2048_sha256"),
		})
		if err != nil {
			return err
		}
		invokeBase64encode1, err := std.Base64encode(ctx, &std.Base64encodeArgs{
			Input: "my message digest",
		}, nil)
		if err != nil {
			return err
		}
		signatureCheck := gcp.GetKmsVerifyOutput(ctx, gcp.GetKmsVerifyOutputArgs{
			Mount:      gcpkms.Path,
			KeyName:    signingKey.KeyName,
			Digest:     pulumi.String(invokeBase64encode1.Result),
			Signature:  pulumi.String("BASE64_ENCODED_SIGNATURE"),
			KeyVersion: pulumi.Int(1),
		}, nil)
		ctx.Export("signatureIsValid", signatureCheck.Valid())
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var gcpkms = new Vault.Gcp.KmsSecretBackend("gcpkms", new()
    {
        Path = "gcpkms",
        CredentialsWo = Std.File.Invoke(new()
        {
            Input = "gcp-credentials.json",
        }).Apply(invoke => invoke.Result),
        CredentialsWoVersion = 1,
    });

    var signingKey = new Vault.Gcp.KmsSecretBackendKey("signing_key", new()
    {
        Mount = gcpkms.Path,
        KeyName = "signing-key",
        KeyRing = "projects/my-project/locations/us-central1/keyRings/my-keyring",
        Purpose = "asymmetric_sign",
        Algorithm = "rsa_sign_pss_2048_sha256",
    });

    var signatureCheck = Vault.Gcp.GetKmsVerify.Invoke(new()
    {
        Mount = gcpkms.Path,
        KeyName = signingKey.KeyName,
        Digest = Std.Base64encode.Invoke(new()
        {
            Input = "my message digest",
        }).Result,
        Signature = "BASE64_ENCODED_SIGNATURE",
        KeyVersion = 1,
    });

    return new Dictionary<string, object?>
    {
        ["signatureIsValid"] = signatureCheck.Apply(getKmsVerifyResult => getKmsVerifyResult.Valid),
    };
});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.KmsSecretBackend;
import com.pulumi.vault.gcp.KmsSecretBackendArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import com.pulumi.vault.gcp.KmsSecretBackendKey;
import com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;
import com.pulumi.std.inputs.Base64encodeArgs;
import com.pulumi.vault.gcp.GcpFunctions;
import com.pulumi.vault.gcp.inputs.GetKmsVerifyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var gcpkms = new KmsSecretBackend("gcpkms", KmsSecretBackendArgs.builder()
            .path("gcpkms")
            .credentialsWo(StdFunctions.file(FileArgs.builder()
                .input("gcp-credentials.json")
                .build()).result())
            .credentialsWoVersion(1)
            .build());

        var signingKey = new KmsSecretBackendKey("signingKey", KmsSecretBackendKeyArgs.builder()
            .mount(gcpkms.path())
            .keyName("signing-key")
            .keyRing("projects/my-project/locations/us-central1/keyRings/my-keyring")
            .purpose("asymmetric_sign")
            .algorithm("rsa_sign_pss_2048_sha256")
            .build());

        final var signatureCheck = GcpFunctions.getKmsVerify(GetKmsVerifyArgs.builder()
            .mount(gcpkms.path())
            .keyName(signingKey.keyName())
            .digest(StdFunctions.base64encode(Base64encodeArgs.builder()
                .input("my message digest")
                .build()).result())
            .signature("BASE64_ENCODED_SIGNATURE")
            .keyVersion(1)
            .build());

        ctx.export("signatureIsValid", signatureCheck.applyValue(_signatureCheck -> _signatureCheck.valid()));
    }
}

resources:
  gcpkms:
    type: vault:gcp:KmsSecretBackend
    properties:
      path: gcpkms
      credentialsWo:
        fn::invoke:
          function: std:file
          arguments:
            input: gcp-credentials.json
          return: result
      credentialsWoVersion: 1
  signingKey:
    type: vault:gcp:KmsSecretBackendKey
    name: signing_key
    properties:
      mount: ${gcpkms.path}
      keyName: signing-key
      keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring
      purpose: asymmetric_sign
      algorithm: rsa_sign_pss_2048_sha256
variables:
  signatureCheck:
    fn::invoke:
      function: vault:gcp:getKmsVerify
      arguments:
        mount: ${gcpkms.path}
        keyName: ${signingKey.keyName}
        digest:
          fn::invoke:
            function: std:base64encode
            arguments:
              input: my message digest
            return: result
        signature: BASE64_ENCODED_SIGNATURE
        keyVersion: 1
outputs:
  signatureIsValid: ${signatureCheck.valid}

pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

data "vault_gcp_getkmsverify" "signatureCheck" {
  mount       = vault_gcp_kmssecretbackend.gcpkms.path
  key_name    = vault_gcp_kmssecretbackendkey.signing_key.key_name
  digest      = base64encode("my message digest")
  signature   = "BASE64_ENCODED_SIGNATURE"
  key_version = 1
}

resource "vault_gcp_kmssecretbackend" "gcpkms" {
  path                   = "gcpkms"
  credentials_wo         = file("gcp-credentials.json")
  credentials_wo_version = 1
}
resource "vault_gcp_kmssecretbackendkey" "signing_key" {
  mount     = vault_gcp_kmssecretbackend.gcpkms.path
  key_name  = "signing-key"
  key_ring  = "projects/my-project/locations/us-central1/keyRings/my-keyring"
  purpose   = "asymmetric_sign"
  algorithm = "rsa_sign_pss_2048_sha256"
}
output "signatureIsValid" {
  value = data.vault_gcp_getkmsverify.signatureCheck.valid
}

Using getKmsVerify

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getKmsVerify(args: GetKmsVerifyArgs, opts?: InvokeOptions): Promise<GetKmsVerifyResult>
function getKmsVerifyOutput(args: GetKmsVerifyOutputArgs, opts?: InvokeOutputOptions): Output<GetKmsVerifyResult>

def get_kms_verify(digest: Optional[str] = None,
                   key_name: Optional[str] = None,
                   key_version: Optional[int] = None,
                   mount: Optional[str] = None,
                   namespace: Optional[str] = None,
                   signature: Optional[str] = None,
                   opts: Optional[InvokeOptions] = None) -> GetKmsVerifyResult
def get_kms_verify_output(digest: pulumi.Input[Optional[str]] = None,
                   key_name: pulumi.Input[Optional[str]] = None,
                   key_version: pulumi.Input[Optional[int]] = None,
                   mount: pulumi.Input[Optional[str]] = None,
                   namespace: pulumi.Input[Optional[str]] = None,
                   signature: pulumi.Input[Optional[str]] = None,
                   opts: Optional[InvokeOutputOptions] = None) -> Output[GetKmsVerifyResult]

func GetKmsVerify(ctx *Context, args *GetKmsVerifyArgs, opts ...InvokeOption) (*GetKmsVerifyResult, error)
func GetKmsVerifyOutput(ctx *Context, args *GetKmsVerifyOutputArgs, opts ...InvokeOption) GetKmsVerifyResultOutput

> Note: This function is named GetKmsVerify in the Go SDK.

public static class GetKmsVerify 
{
    public static Task<GetKmsVerifyResult> InvokeAsync(GetKmsVerifyArgs args, InvokeOptions? opts = null)
    public static Output<GetKmsVerifyResult> Invoke(GetKmsVerifyInvokeArgs args, InvokeOptions? opts = null)
    public static Output<GetKmsVerifyResult> Invoke(GetKmsVerifyInvokeArgs args, InvokeOutputOptions opts)
}

public static CompletableFuture<GetKmsVerifyResult> getKmsVerify(GetKmsVerifyArgs args, InvokeOptions options)
public static Output<GetKmsVerifyResult> getKmsVerify(GetKmsVerifyArgs args, InvokeOptions options)
public static Output<GetKmsVerifyResult> getKmsVerify(GetKmsVerifyArgs args, InvokeOutputOptions options)

fn::invoke:
  function: vault:gcp/getKmsVerify:getKmsVerify
  arguments:
    # arguments dictionary

data "vault_gcp_get_kms_verify" "name" {
    # arguments
}

The following arguments are supported:

Digest string: Base64-encoded digest to verify. The digest should be created using the hash algorithm specified in the key's algorithm (e.g., SHA256 for RSA_SIGN_PSS_2048_SHA256).
KeyName string: Name of the signing key to use for verification. This must reference a key with purpose ASYMMETRIC_SIGN.
KeyVersion int: Specific version of the key to use for verification.
Mount string: Path where the GCP KMS secrets engine is mounted.
Signature string: Base64-encoded signature to verify against the digest.
Namespace string: The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

Digest string: Base64-encoded digest to verify. The digest should be created using the hash algorithm specified in the key's algorithm (e.g., SHA256 for RSA_SIGN_PSS_2048_SHA256).
KeyName string: Name of the signing key to use for verification. This must reference a key with purpose ASYMMETRIC_SIGN.
KeyVersion int: Specific version of the key to use for verification.
Mount string: Path where the GCP KMS secrets engine is mounted.
Signature string: Base64-encoded signature to verify against the digest.
Namespace string: The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

digest string: Base64-encoded digest to verify. The digest should be created using the hash algorithm specified in the key's algorithm (e.g., SHA256 for RSA_SIGN_PSS_2048_SHA256).
key_name string: Name of the signing key to use for verification. This must reference a key with purpose ASYMMETRIC_SIGN.
key_version number: Specific version of the key to use for verification.
mount string: Path where the GCP KMS secrets engine is mounted.
signature string: Base64-encoded signature to verify against the digest.
namespace string: The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

digest String: Base64-encoded digest to verify. The digest should be created using the hash algorithm specified in the key's algorithm (e.g., SHA256 for RSA_SIGN_PSS_2048_SHA256).
keyName String: Name of the signing key to use for verification. This must reference a key with purpose ASYMMETRIC_SIGN.
keyVersion Integer: Specific version of the key to use for verification.
mount String: Path where the GCP KMS secrets engine is mounted.
signature String: Base64-encoded signature to verify against the digest.
namespace String: The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

digest string: Base64-encoded digest to verify. The digest should be created using the hash algorithm specified in the key's algorithm (e.g., SHA256 for RSA_SIGN_PSS_2048_SHA256).
keyName string: Name of the signing key to use for verification. This must reference a key with purpose ASYMMETRIC_SIGN.
keyVersion number: Specific version of the key to use for verification.
mount string: Path where the GCP KMS secrets engine is mounted.
signature string: Base64-encoded signature to verify against the digest.
namespace string: The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

digest str: Base64-encoded digest to verify. The digest should be created using the hash algorithm specified in the key's algorithm (e.g., SHA256 for RSA_SIGN_PSS_2048_SHA256).
key_name str: Name of the signing key to use for verification. This must reference a key with purpose ASYMMETRIC_SIGN.
key_version int: Specific version of the key to use for verification.
mount str: Path where the GCP KMS secrets engine is mounted.
signature str: Base64-encoded signature to verify against the digest.
namespace str: The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

digest String: Base64-encoded digest to verify. The digest should be created using the hash algorithm specified in the key's algorithm (e.g., SHA256 for RSA_SIGN_PSS_2048_SHA256).
keyName String: Name of the signing key to use for verification. This must reference a key with purpose ASYMMETRIC_SIGN.
keyVersion Number: Specific version of the key to use for verification.
mount String: Path where the GCP KMS secrets engine is mounted.
signature String: Base64-encoded signature to verify against the digest.
namespace String: The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

getKmsVerify Result

The following output properties are available:

Digest string
KeyName string
KeyVersion int
Mount string
Signature string
Valid bool: Boolean indicating whether the signature is valid (true) or invalid (false).
Namespace string

Digest string
KeyName string
KeyVersion int
Mount string
Signature string
Valid bool: Boolean indicating whether the signature is valid (true) or invalid (false).
Namespace string

digest string
key_name string
key_version number
mount string
signature string
valid bool: Boolean indicating whether the signature is valid (true) or invalid (false).
namespace string

digest String
keyName String
keyVersion Integer
mount String
signature String
valid Boolean: Boolean indicating whether the signature is valid (true) or invalid (false).
namespace String

digest string
keyName string
keyVersion number
mount string
signature string
valid boolean: Boolean indicating whether the signature is valid (true) or invalid (false).
namespace string

digest str
key_name str
key_version int
mount str
signature str
valid bool: Boolean indicating whether the signature is valid (true) or invalid (false).
namespace str

digest String
keyName String
keyVersion Number
mount String
signature String
valid Boolean: Boolean indicating whether the signature is valid (true) or invalid (false).
namespace String

Package Details

Repository: Vault pulumi/pulumi-vault
License: Apache-2.0
Notes: This Pulumi package is based on the vault Terraform Provider.

Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-vault

vault.gcp.getKmsVerify

On this page

On this page

Example Usage

Basic Signature Verification

Using getKmsVerify

getKmsVerify Result

Package Details

On this page

On this page

Try Pulumi Cloud free.
Your team will thank you.

vault.gcp.getKmsVerify

On this page

On this page

Example Usage

Basic Signature Verification

Using getKmsVerify

getKmsVerify Result

Package Details

On this page

On this page

Try Pulumi Cloud free.Your team will thank you.

Try Pulumi Cloud free.
Your team will thank you.