Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. gcp
  6. KmsSecretBackendKey
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.gcp.KmsSecretBackendKey

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages keys in the GCP KMS secrets engine. This resource creates or registers GCP KMS crypto keys within a Vault-managed key ring, making them available for cryptographic operations (encryption, decryption, signing, verification) through Vault.

    Important All data provided in the resource configuration will be written in cleartext to state and plan files generated by Terraform, and will appear in the console output when Terraform runs. Protect these artifacts accordingly. See the main provider documentation for more details.

    Example Usage

    Symmetric Encryption Key

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const gcpkms = new vault.gcp.KmsSecretBackend("gcpkms", {
    path: "gcpkms",
    credentialsWo: std.file({
        input: "gcp-credentials.json",
    }).then(invoke => invoke.result),
    credentialsWoVersion: 1,
});
const encryption = new vault.gcp.KmsSecretBackendKey("encryption", {
    mount: gcpkms.path,
    keyName: "my-encryption-key",
    keyRing: "projects/my-project/locations/us-central1/keyRings/my-keyring",
    purpose: "encrypt_decrypt",
    algorithm: "symmetric_encryption",
    protectionLevel: "software",
    rotationPeriod: "2592000s",
    labels: {
        env: "production",
        managed_by: "terraform",
    },
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

gcpkms = vault.gcp.KmsSecretBackend("gcpkms",
    path="gcpkms",
    credentials_wo=std.file(input="gcp-credentials.json").result,
    credentials_wo_version=1)
encryption = vault.gcp.KmsSecretBackendKey("encryption",
    mount=gcpkms.path,
    key_name="my-encryption-key",
    key_ring="projects/my-project/locations/us-central1/keyRings/my-keyring",
    purpose="encrypt_decrypt",
    algorithm="symmetric_encryption",
    protection_level="software",
    rotation_period="2592000s",
    labels={
        "env": "production",
        "managed_by": "terraform",
    })

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "gcp-credentials.json",
		}, nil)
		if err != nil {
			return err
		}
		gcpkms, err := gcp.NewKmsSecretBackend(ctx, "gcpkms", &gcp.KmsSecretBackendArgs{
			Path:                 pulumi.String("gcpkms"),
			CredentialsWo:        pulumi.String(invokeFile.Result),
			CredentialsWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		_, err = gcp.NewKmsSecretBackendKey(ctx, "encryption", &gcp.KmsSecretBackendKeyArgs{
			Mount:           gcpkms.Path,
			KeyName:         pulumi.String("my-encryption-key"),
			KeyRing:         pulumi.String("projects/my-project/locations/us-central1/keyRings/my-keyring"),
			Purpose:         pulumi.String("encrypt_decrypt"),
			Algorithm:       pulumi.String("symmetric_encryption"),
			ProtectionLevel: pulumi.String("software"),
			RotationPeriod:  pulumi.String("2592000s"),
			Labels: pulumi.StringMap{
				"env":        pulumi.String("production"),
				"managed_by": pulumi.String("terraform"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var gcpkms = new Vault.Gcp.KmsSecretBackend("gcpkms", new()
    {
        Path = "gcpkms",
        CredentialsWo = Std.File.Invoke(new()
        {
            Input = "gcp-credentials.json",
        }).Apply(invoke => invoke.Result),
        CredentialsWoVersion = 1,
    });

    var encryption = new Vault.Gcp.KmsSecretBackendKey("encryption", new()
    {
        Mount = gcpkms.Path,
        KeyName = "my-encryption-key",
        KeyRing = "projects/my-project/locations/us-central1/keyRings/my-keyring",
        Purpose = "encrypt_decrypt",
        Algorithm = "symmetric_encryption",
        ProtectionLevel = "software",
        RotationPeriod = "2592000s",
        Labels = 
        {
            { "env", "production" },
            { "managed_by", "terraform" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.KmsSecretBackend;
import com.pulumi.vault.gcp.KmsSecretBackendArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import com.pulumi.vault.gcp.KmsSecretBackendKey;
import com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var gcpkms = new KmsSecretBackend("gcpkms", KmsSecretBackendArgs.builder()
            .path("gcpkms")
            .credentialsWo(StdFunctions.file(FileArgs.builder()
                .input("gcp-credentials.json")
                .build()).result())
            .credentialsWoVersion(1)
            .build());

        var encryption = new KmsSecretBackendKey("encryption", KmsSecretBackendKeyArgs.builder()
            .mount(gcpkms.path())
            .keyName("my-encryption-key")
            .keyRing("projects/my-project/locations/us-central1/keyRings/my-keyring")
            .purpose("encrypt_decrypt")
            .algorithm("symmetric_encryption")
            .protectionLevel("software")
            .rotationPeriod("2592000s")
            .labels(Map.ofEntries(
                Map.entry("env", "production"),
                Map.entry("managed_by", "terraform")
            ))
            .build());

    }
}

    resources:
  gcpkms:
    type: vault:gcp:KmsSecretBackend
    properties:
      path: gcpkms
      credentialsWo:
        fn::invoke:
          function: std:file
          arguments:
            input: gcp-credentials.json
          return: result
      credentialsWoVersion: 1
  encryption:
    type: vault:gcp:KmsSecretBackendKey
    properties:
      mount: ${gcpkms.path}
      keyName: my-encryption-key
      keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring
      purpose: encrypt_decrypt
      algorithm: symmetric_encryption
      protectionLevel: software
      rotationPeriod: 2592000s
      labels:
        env: production
        managed_by: terraform

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_gcp_kmssecretbackend" "gcpkms" {
  path                   = "gcpkms"
  credentials_wo         = file("gcp-credentials.json")
  credentials_wo_version = 1
}
resource "vault_gcp_kmssecretbackendkey" "encryption" {
  mount            = vault_gcp_kmssecretbackend.gcpkms.path
  key_name         = "my-encryption-key"
  key_ring         = "projects/my-project/locations/us-central1/keyRings/my-keyring"
  purpose          = "encrypt_decrypt"
  algorithm        = "symmetric_encryption"
  protection_level = "software"
  rotation_period  = "2592000s"
  labels = {
    "env"        = "production"
    "managed_by" = "terraform"
  }
}

    Asymmetric Signing Key

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const signing = new vault.gcp.KmsSecretBackendKey("signing", {
    mount: gcpkms.path,
    keyName: "my-signing-key",
    keyRing: "projects/my-project/locations/us-central1/keyRings/my-keyring",
    purpose: "asymmetric_sign",
    algorithm: "rsa_sign_pss_2048_sha256",
});

    import pulumi
import pulumi_vault as vault

signing = vault.gcp.KmsSecretBackendKey("signing",
    mount=gcpkms["path"],
    key_name="my-signing-key",
    key_ring="projects/my-project/locations/us-central1/keyRings/my-keyring",
    purpose="asymmetric_sign",
    algorithm="rsa_sign_pss_2048_sha256")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := gcp.NewKmsSecretBackendKey(ctx, "signing", &gcp.KmsSecretBackendKeyArgs{
			Mount:     pulumi.Any(gcpkms.Path),
			KeyName:   pulumi.String("my-signing-key"),
			KeyRing:   pulumi.String("projects/my-project/locations/us-central1/keyRings/my-keyring"),
			Purpose:   pulumi.String("asymmetric_sign"),
			Algorithm: pulumi.String("rsa_sign_pss_2048_sha256"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var signing = new Vault.Gcp.KmsSecretBackendKey("signing", new()
    {
        Mount = gcpkms.Path,
        KeyName = "my-signing-key",
        KeyRing = "projects/my-project/locations/us-central1/keyRings/my-keyring",
        Purpose = "asymmetric_sign",
        Algorithm = "rsa_sign_pss_2048_sha256",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.KmsSecretBackendKey;
import com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var signing = new KmsSecretBackendKey("signing", KmsSecretBackendKeyArgs.builder()
            .mount(gcpkms.path())
            .keyName("my-signing-key")
            .keyRing("projects/my-project/locations/us-central1/keyRings/my-keyring")
            .purpose("asymmetric_sign")
            .algorithm("rsa_sign_pss_2048_sha256")
            .build());

    }
}

    resources:
  signing:
    type: vault:gcp:KmsSecretBackendKey
    properties:
      mount: ${gcpkms.path}
      keyName: my-signing-key
      keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring
      purpose: asymmetric_sign
      algorithm: rsa_sign_pss_2048_sha256

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_gcp_kmssecretbackendkey" "signing" {
  mount     = gcpkms.path
  key_name  = "my-signing-key"
  key_ring  = "projects/my-project/locations/us-central1/keyRings/my-keyring"
  purpose   = "asymmetric_sign"
  algorithm = "rsa_sign_pss_2048_sha256"
}

    Asymmetric Decryption Key

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const decrypt = new vault.gcp.KmsSecretBackendKey("decrypt", {
    mount: gcpkms.path,
    keyName: "my-decrypt-key",
    keyRing: "projects/my-project/locations/us-central1/keyRings/my-keyring",
    purpose: "asymmetric_decrypt",
    algorithm: "rsa_decrypt_oaep_2048_sha256",
});

    import pulumi
import pulumi_vault as vault

decrypt = vault.gcp.KmsSecretBackendKey("decrypt",
    mount=gcpkms["path"],
    key_name="my-decrypt-key",
    key_ring="projects/my-project/locations/us-central1/keyRings/my-keyring",
    purpose="asymmetric_decrypt",
    algorithm="rsa_decrypt_oaep_2048_sha256")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := gcp.NewKmsSecretBackendKey(ctx, "decrypt", &gcp.KmsSecretBackendKeyArgs{
			Mount:     pulumi.Any(gcpkms.Path),
			KeyName:   pulumi.String("my-decrypt-key"),
			KeyRing:   pulumi.String("projects/my-project/locations/us-central1/keyRings/my-keyring"),
			Purpose:   pulumi.String("asymmetric_decrypt"),
			Algorithm: pulumi.String("rsa_decrypt_oaep_2048_sha256"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var decrypt = new Vault.Gcp.KmsSecretBackendKey("decrypt", new()
    {
        Mount = gcpkms.Path,
        KeyName = "my-decrypt-key",
        KeyRing = "projects/my-project/locations/us-central1/keyRings/my-keyring",
        Purpose = "asymmetric_decrypt",
        Algorithm = "rsa_decrypt_oaep_2048_sha256",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.KmsSecretBackendKey;
import com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var decrypt = new KmsSecretBackendKey("decrypt", KmsSecretBackendKeyArgs.builder()
            .mount(gcpkms.path())
            .keyName("my-decrypt-key")
            .keyRing("projects/my-project/locations/us-central1/keyRings/my-keyring")
            .purpose("asymmetric_decrypt")
            .algorithm("rsa_decrypt_oaep_2048_sha256")
            .build());

    }
}

    resources:
  decrypt:
    type: vault:gcp:KmsSecretBackendKey
    properties:
      mount: ${gcpkms.path}
      keyName: my-decrypt-key
      keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring
      purpose: asymmetric_decrypt
      algorithm: rsa_decrypt_oaep_2048_sha256

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_gcp_kmssecretbackendkey" "decrypt" {
  mount     = gcpkms.path
  key_name  = "my-decrypt-key"
  key_ring  = "projects/my-project/locations/us-central1/keyRings/my-keyring"
  purpose   = "asymmetric_decrypt"
  algorithm = "rsa_decrypt_oaep_2048_sha256"
}

    HSM-Protected Key

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const hsm = new vault.gcp.KmsSecretBackendKey("hsm", {
    mount: gcpkms.path,
    keyName: "hsm-key",
    keyRing: "projects/my-project/locations/us-central1/keyRings/hsm-keyring",
    purpose: "encrypt_decrypt",
    algorithm: "symmetric_encryption",
    protectionLevel: "hsm",
    rotationPeriod: "7776000s",
});

    import pulumi
import pulumi_vault as vault

hsm = vault.gcp.KmsSecretBackendKey("hsm",
    mount=gcpkms["path"],
    key_name="hsm-key",
    key_ring="projects/my-project/locations/us-central1/keyRings/hsm-keyring",
    purpose="encrypt_decrypt",
    algorithm="symmetric_encryption",
    protection_level="hsm",
    rotation_period="7776000s")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := gcp.NewKmsSecretBackendKey(ctx, "hsm", &gcp.KmsSecretBackendKeyArgs{
			Mount:           pulumi.Any(gcpkms.Path),
			KeyName:         pulumi.String("hsm-key"),
			KeyRing:         pulumi.String("projects/my-project/locations/us-central1/keyRings/hsm-keyring"),
			Purpose:         pulumi.String("encrypt_decrypt"),
			Algorithm:       pulumi.String("symmetric_encryption"),
			ProtectionLevel: pulumi.String("hsm"),
			RotationPeriod:  pulumi.String("7776000s"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var hsm = new Vault.Gcp.KmsSecretBackendKey("hsm", new()
    {
        Mount = gcpkms.Path,
        KeyName = "hsm-key",
        KeyRing = "projects/my-project/locations/us-central1/keyRings/hsm-keyring",
        Purpose = "encrypt_decrypt",
        Algorithm = "symmetric_encryption",
        ProtectionLevel = "hsm",
        RotationPeriod = "7776000s",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.KmsSecretBackendKey;
import com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var hsm = new KmsSecretBackendKey("hsm", KmsSecretBackendKeyArgs.builder()
            .mount(gcpkms.path())
            .keyName("hsm-key")
            .keyRing("projects/my-project/locations/us-central1/keyRings/hsm-keyring")
            .purpose("encrypt_decrypt")
            .algorithm("symmetric_encryption")
            .protectionLevel("hsm")
            .rotationPeriod("7776000s")
            .build());

    }
}

    resources:
  hsm:
    type: vault:gcp:KmsSecretBackendKey
    properties:
      mount: ${gcpkms.path}
      keyName: hsm-key
      keyRing: projects/my-project/locations/us-central1/keyRings/hsm-keyring
      purpose: encrypt_decrypt
      algorithm: symmetric_encryption
      protectionLevel: hsm
      rotationPeriod: 7776000s

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_gcp_kmssecretbackendkey" "hsm" {
  mount            = gcpkms.path
  key_name         = "hsm-key"
  key_ring         = "projects/my-project/locations/us-central1/keyRings/hsm-keyring"
  purpose          = "encrypt_decrypt"
  algorithm        = "symmetric_encryption"
  protection_level = "hsm"
  rotation_period  = "7776000s"
}

    Custom GCP Crypto Key Name

    By default, the GCP KMS crypto key uses the same name as the Vault key. Override it with cryptoKey:

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const custom = new vault.gcp.KmsSecretBackendKey("custom", {
    mount: gcpkms.path,
    keyName: "vault-key-name",
    keyRing: "projects/my-project/locations/us-central1/keyRings/my-keyring",
    cryptoKey: "different-gcp-key-name",
    purpose: "encrypt_decrypt",
});

    import pulumi
import pulumi_vault as vault

custom = vault.gcp.KmsSecretBackendKey("custom",
    mount=gcpkms["path"],
    key_name="vault-key-name",
    key_ring="projects/my-project/locations/us-central1/keyRings/my-keyring",
    crypto_key="different-gcp-key-name",
    purpose="encrypt_decrypt")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := gcp.NewKmsSecretBackendKey(ctx, "custom", &gcp.KmsSecretBackendKeyArgs{
			Mount:     pulumi.Any(gcpkms.Path),
			KeyName:   pulumi.String("vault-key-name"),
			KeyRing:   pulumi.String("projects/my-project/locations/us-central1/keyRings/my-keyring"),
			CryptoKey: pulumi.String("different-gcp-key-name"),
			Purpose:   pulumi.String("encrypt_decrypt"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var custom = new Vault.Gcp.KmsSecretBackendKey("custom", new()
    {
        Mount = gcpkms.Path,
        KeyName = "vault-key-name",
        KeyRing = "projects/my-project/locations/us-central1/keyRings/my-keyring",
        CryptoKey = "different-gcp-key-name",
        Purpose = "encrypt_decrypt",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.KmsSecretBackendKey;
import com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var custom = new KmsSecretBackendKey("custom", KmsSecretBackendKeyArgs.builder()
            .mount(gcpkms.path())
            .keyName("vault-key-name")
            .keyRing("projects/my-project/locations/us-central1/keyRings/my-keyring")
            .cryptoKey("different-gcp-key-name")
            .purpose("encrypt_decrypt")
            .build());

    }
}

    resources:
  custom:
    type: vault:gcp:KmsSecretBackendKey
    properties:
      mount: ${gcpkms.path}
      keyName: vault-key-name
      keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring
      cryptoKey: different-gcp-key-name
      purpose: encrypt_decrypt

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_gcp_kmssecretbackendkey" "custom" {
  mount      = gcpkms.path
  key_name   = "vault-key-name"
  key_ring   = "projects/my-project/locations/us-central1/keyRings/my-keyring"
  crypto_key = "different-gcp-key-name"
  purpose    = "encrypt_decrypt"
}

    Updating Rotation Period

    Only rotationPeriod and labels can be updated in-place. All other fields require resource replacement.

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const updatable = new vault.gcp.KmsSecretBackendKey("updatable", {
    mount: gcpkms.path,
    keyName: "my-key",
    keyRing: "projects/my-project/locations/us-central1/keyRings/my-keyring",
    rotationPeriod: "72h",
    labels: {
        version: "v2",
    },
});

    import pulumi
import pulumi_vault as vault

updatable = vault.gcp.KmsSecretBackendKey("updatable",
    mount=gcpkms["path"],
    key_name="my-key",
    key_ring="projects/my-project/locations/us-central1/keyRings/my-keyring",
    rotation_period="72h",
    labels={
        "version": "v2",
    })

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/gcp"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := gcp.NewKmsSecretBackendKey(ctx, "updatable", &gcp.KmsSecretBackendKeyArgs{
			Mount:          pulumi.Any(gcpkms.Path),
			KeyName:        pulumi.String("my-key"),
			KeyRing:        pulumi.String("projects/my-project/locations/us-central1/keyRings/my-keyring"),
			RotationPeriod: pulumi.String("72h"),
			Labels: pulumi.StringMap{
				"version": pulumi.String("v2"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var updatable = new Vault.Gcp.KmsSecretBackendKey("updatable", new()
    {
        Mount = gcpkms.Path,
        KeyName = "my-key",
        KeyRing = "projects/my-project/locations/us-central1/keyRings/my-keyring",
        RotationPeriod = "72h",
        Labels = 
        {
            { "version", "v2" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.gcp.KmsSecretBackendKey;
import com.pulumi.vault.gcp.KmsSecretBackendKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var updatable = new KmsSecretBackendKey("updatable", KmsSecretBackendKeyArgs.builder()
            .mount(gcpkms.path())
            .keyName("my-key")
            .keyRing("projects/my-project/locations/us-central1/keyRings/my-keyring")
            .rotationPeriod("72h")
            .labels(Map.of("version", "v2"))
            .build());

    }
}

    resources:
  updatable:
    type: vault:gcp:KmsSecretBackendKey
    properties:
      mount: ${gcpkms.path}
      keyName: my-key
      keyRing: projects/my-project/locations/us-central1/keyRings/my-keyring
      rotationPeriod: 72h
      labels:
        version: v2

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_gcp_kmssecretbackendkey" "updatable" {
  mount           = gcpkms.path
  key_name        = "my-key"
  key_ring        = "projects/my-project/locations/us-central1/keyRings/my-keyring"
  rotation_period = "72h"
  labels = {
    "version" = "v2"
  }
}

    Key Purposes and Algorithms

    Encryption Keys (encryptDecrypt)

    Used for symmetric encryption and decryption operations. These keys use the symmetricEncryption algorithm and support automatic key rotation via rotationPeriod. Use them with the vaultGcpkmsEncrypt and vaultGcpkmsDecrypt ephemeral resources.

    Supported algorithms:

    • symmetricEncryption (default and only option)

    Signing Keys (asymmetricSign)

    Used for digital signing and verification. These keys do not support rotation. Use them with the vaultGcpkmsSign ephemeral resource and vault.gcp.getKmsVerify data source.

    Supported algorithms:

    AlgorithmKey typeHash
    rsaSignPss2048Sha256RSA 2048-bitSHA-256
    rsaSignPss3072Sha256RSA 3072-bitSHA-256
    rsaSignPss4096Sha256RSA 4096-bitSHA-256
    rsaSignPkcs12048Sha256RSA 2048-bit (PKCS#1)SHA-256
    rsaSignPkcs13072Sha256RSA 3072-bit (PKCS#1)SHA-256
    rsaSignPkcs14096Sha256RSA 4096-bit (PKCS#1)SHA-256
    ecSignP256Sha256EC P-256SHA-256
    ecSignP384Sha384EC P-384SHA-384

    Asymmetric Decryption Keys (asymmetricDecrypt)

    Used for asymmetric encryption where data is encrypted with the public key and decrypted with the private key via Vault. These keys do not support rotation.

    Supported algorithms:

    AlgorithmKey typeHash
    rsaDecryptOaep2048Sha256RSA 2048-bitSHA-256
    rsaDecryptOaep3072Sha256RSA 3072-bitSHA-256
    rsaDecryptOaep4096Sha256RSA 4096-bitSHA-256

    Version Management

    GCP KMS keys support multiple versions for key rotation:

    • primaryVersion — The version used by default for new cryptographic operations. Only changes when a key rotation occurs in GCP KMS (triggered by rotationPeriod). Preserved in state between applies using UseStateForUnknown.
    • rotationScheduleSeconds — The rotation interval in seconds exactly as stored by Vault. Refreshed from the API on every read.
    • nextRotationTimeSeconds — Unix timestamp of the next scheduled rotation. Refreshed from the API on every read. Useful for alerting or audit purposes.

    Create KmsSecretBackendKey Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KmsSecretBackendKey(name: string, args: KmsSecretBackendKeyArgs, opts?: CustomResourceOptions);
    @overload
def KmsSecretBackendKey(resource_name: str,
                        args: KmsSecretBackendKeyArgs,
                        opts: Optional[ResourceOptions] = None)

@overload
def KmsSecretBackendKey(resource_name: str,
                        opts: Optional[ResourceOptions] = None,
                        key_name: Optional[str] = None,
                        key_ring: Optional[str] = None,
                        mount: Optional[str] = None,
                        algorithm: Optional[str] = None,
                        crypto_key: Optional[str] = None,
                        labels: Optional[Mapping[str, str]] = None,
                        namespace: Optional[str] = None,
                        protection_level: Optional[str] = None,
                        purpose: Optional[str] = None,
                        rotation_period: Optional[str] = None)
    func NewKmsSecretBackendKey(ctx *Context, name string, args KmsSecretBackendKeyArgs, opts ...ResourceOption) (*KmsSecretBackendKey, error)
    public KmsSecretBackendKey(string name, KmsSecretBackendKeyArgs args, CustomResourceOptions? opts = null)
    public KmsSecretBackendKey(String name, KmsSecretBackendKeyArgs args)
public KmsSecretBackendKey(String name, KmsSecretBackendKeyArgs args, CustomResourceOptions options)

    type: vault:gcp:KmsSecretBackendKey
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_gcp_kms_secret_backend_key" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KmsSecretBackendKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KmsSecretBackendKeyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KmsSecretBackendKeyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KmsSecretBackendKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KmsSecretBackendKeyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kmsSecretBackendKeyResource = new Vault.Gcp.KmsSecretBackendKey("kmsSecretBackendKeyResource", new()
{
    KeyName = "string",
    KeyRing = "string",
    Mount = "string",
    Algorithm = "string",
    CryptoKey = "string",
    Labels = 
    {
        { "string", "string" },
    },
    Namespace = "string",
    ProtectionLevel = "string",
    Purpose = "string",
    RotationPeriod = "string",
});

    example, err := gcp.NewKmsSecretBackendKey(ctx, "kmsSecretBackendKeyResource", &gcp.KmsSecretBackendKeyArgs{
	KeyName:   pulumi.String("string"),
	KeyRing:   pulumi.String("string"),
	Mount:     pulumi.String("string"),
	Algorithm: pulumi.String("string"),
	CryptoKey: pulumi.String("string"),
	Labels: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Namespace:       pulumi.String("string"),
	ProtectionLevel: pulumi.String("string"),
	Purpose:         pulumi.String("string"),
	RotationPeriod:  pulumi.String("string"),
})

    resource "vault_gcp_kms_secret_backend_key" "kmsSecretBackendKeyResource" {
  lifecycle {
    create_before_destroy = true
  }
  key_name   = "string"
  key_ring   = "string"
  mount      = "string"
  algorithm  = "string"
  crypto_key = "string"
  labels = {
    "string" = "string"
  }
  namespace        = "string"
  protection_level = "string"
  purpose          = "string"
  rotation_period  = "string"
}

    var kmsSecretBackendKeyResource = new KmsSecretBackendKey("kmsSecretBackendKeyResource", KmsSecretBackendKeyArgs.builder()
    .keyName("string")
    .keyRing("string")
    .mount("string")
    .algorithm("string")
    .cryptoKey("string")
    .labels(Map.of("string", "string"))
    .namespace("string")
    .protectionLevel("string")
    .purpose("string")
    .rotationPeriod("string")
    .build());

    kms_secret_backend_key_resource = vault.gcp.KmsSecretBackendKey("kmsSecretBackendKeyResource",
    key_name="string",
    key_ring="string",
    mount="string",
    algorithm="string",
    crypto_key="string",
    labels={
        "string": "string",
    },
    namespace="string",
    protection_level="string",
    purpose="string",
    rotation_period="string")

    const kmsSecretBackendKeyResource = new vault.gcp.KmsSecretBackendKey("kmsSecretBackendKeyResource", {
    keyName: "string",
    keyRing: "string",
    mount: "string",
    algorithm: "string",
    cryptoKey: "string",
    labels: {
        string: "string",
    },
    namespace: "string",
    protectionLevel: "string",
    purpose: "string",
    rotationPeriod: "string",
});

    type: vault:gcp:KmsSecretBackendKey
properties:
    algorithm: string
    cryptoKey: string
    keyName: string
    keyRing: string
    labels:
        string: string
    mount: string
    namespace: string
    protectionLevel: string
    purpose: string
    rotationPeriod: string

    KmsSecretBackendKey Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KmsSecretBackendKey resource accepts the following input properties:

    KeyName string
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    KeyRing string
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    Mount string
    Path where the GCP KMS secrets engine is mounted.
    Algorithm string

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    CryptoKey string
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    Labels Dictionary<string, string>
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ProtectionLevel string
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    Purpose string
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    RotationPeriod string

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    KeyName string
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    KeyRing string
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    Mount string
    Path where the GCP KMS secrets engine is mounted.
    Algorithm string

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    CryptoKey string
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    Labels map[string]string
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    ProtectionLevel string
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    Purpose string
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    RotationPeriod string

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    key_name string
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    key_ring string
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    mount string
    Path where the GCP KMS secrets engine is mounted.
    algorithm string

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    crypto_key string
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    labels map(string)
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection_level string
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose string
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotation_period string

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    keyName String
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    keyRing String
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    mount String
    Path where the GCP KMS secrets engine is mounted.
    algorithm String

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    cryptoKey String
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    labels Map<String,String>
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protectionLevel String
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose String
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotationPeriod String

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    keyName string
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    keyRing string
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    mount string
    Path where the GCP KMS secrets engine is mounted.
    algorithm string

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    cryptoKey string
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    labels {[key: string]: string}
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protectionLevel string
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose string
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotationPeriod string

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    key_name str
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    key_ring str
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    mount str
    Path where the GCP KMS secrets engine is mounted.
    algorithm str

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    crypto_key str
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    labels Mapping[str, str]
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protection_level str
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose str
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotation_period str

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    keyName String
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    keyRing String
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    mount String
    Path where the GCP KMS secrets engine is mounted.
    algorithm String

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    cryptoKey String
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    labels Map<String>
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    protectionLevel String
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose String
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotationPeriod String

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KmsSecretBackendKey resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    NextRotationTimeSeconds int
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    PrimaryVersion int
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    RotationScheduleSeconds int
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    Id string
    The provider-assigned unique ID for this managed resource.
    NextRotationTimeSeconds int
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    PrimaryVersion int
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    RotationScheduleSeconds int
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    id string
    The provider-assigned unique ID for this managed resource.
    next_rotation_time_seconds number
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primary_version number
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    rotation_schedule_seconds number
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    id String
    The provider-assigned unique ID for this managed resource.
    nextRotationTimeSeconds Integer
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primaryVersion Integer
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    rotationScheduleSeconds Integer
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    id string
    The provider-assigned unique ID for this managed resource.
    nextRotationTimeSeconds number
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primaryVersion number
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    rotationScheduleSeconds number
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    id str
    The provider-assigned unique ID for this managed resource.
    next_rotation_time_seconds int
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primary_version int
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    rotation_schedule_seconds int
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    id String
    The provider-assigned unique ID for this managed resource.
    nextRotationTimeSeconds Number
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primaryVersion Number
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    rotationScheduleSeconds Number
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.

    Look up Existing KmsSecretBackendKey Resource

    Get an existing KmsSecretBackendKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KmsSecretBackendKeyState, opts?: CustomResourceOptions): KmsSecretBackendKey
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        algorithm: Optional[str] = None,
        crypto_key: Optional[str] = None,
        key_name: Optional[str] = None,
        key_ring: Optional[str] = None,
        labels: Optional[Mapping[str, str]] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        next_rotation_time_seconds: Optional[int] = None,
        primary_version: Optional[int] = None,
        protection_level: Optional[str] = None,
        purpose: Optional[str] = None,
        rotation_period: Optional[str] = None,
        rotation_schedule_seconds: Optional[int] = None) -> KmsSecretBackendKey
    func GetKmsSecretBackendKey(ctx *Context, name string, id IDInput, state *KmsSecretBackendKeyState, opts ...ResourceOption) (*KmsSecretBackendKey, error)
    public static KmsSecretBackendKey Get(string name, Input<string> id, KmsSecretBackendKeyState? state, CustomResourceOptions? opts = null)
    public static KmsSecretBackendKey get(String name, Output<String> id, KmsSecretBackendKeyState state, CustomResourceOptions options)
    resources:  _:    type: vault:gcp:KmsSecretBackendKey    get:      id: ${id}
    import {
  to = vault_gcp_kms_secret_backend_key.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Algorithm string

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    CryptoKey string
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    KeyName string
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    KeyRing string
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    Labels Dictionary<string, string>
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    Mount string
    Path where the GCP KMS secrets engine is mounted.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NextRotationTimeSeconds int
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    PrimaryVersion int
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    ProtectionLevel string
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    Purpose string
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    RotationPeriod string

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    RotationScheduleSeconds int
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    Algorithm string

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    CryptoKey string
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    KeyName string
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    KeyRing string
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    Labels map[string]string
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    Mount string
    Path where the GCP KMS secrets engine is mounted.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NextRotationTimeSeconds int
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    PrimaryVersion int
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    ProtectionLevel string
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    Purpose string
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    RotationPeriod string

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    RotationScheduleSeconds int
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    algorithm string

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    crypto_key string
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    key_name string
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    key_ring string
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    labels map(string)
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    mount string
    Path where the GCP KMS secrets engine is mounted.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    next_rotation_time_seconds number
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primary_version number
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    protection_level string
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose string
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotation_period string

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    rotation_schedule_seconds number
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    algorithm String

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    cryptoKey String
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    keyName String
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    keyRing String
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    labels Map<String,String>
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    mount String
    Path where the GCP KMS secrets engine is mounted.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    nextRotationTimeSeconds Integer
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primaryVersion Integer
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    protectionLevel String
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose String
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotationPeriod String

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    rotationScheduleSeconds Integer
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    algorithm string

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    cryptoKey string
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    keyName string
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    keyRing string
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    labels {[key: string]: string}
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    mount string
    Path where the GCP KMS secrets engine is mounted.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    nextRotationTimeSeconds number
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primaryVersion number
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    protectionLevel string
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose string
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotationPeriod string

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    rotationScheduleSeconds number
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    algorithm str

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    crypto_key str
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    key_name str
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    key_ring str
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    labels Mapping[str, str]
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    mount str
    Path where the GCP KMS secrets engine is mounted.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    next_rotation_time_seconds int
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primary_version int
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    protection_level str
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose str
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotation_period str

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    rotation_schedule_seconds int
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.
    algorithm String

    Algorithm for the key. Vault stores and returns this value in lowercase. Defaults to symmetricEncryption for encryptDecrypt keys. Valid values depend on purpose:

    For encryptDecrypt:

    cryptoKey String
    Name of the crypto key in GCP KMS. Defaults to the Vault key name if not specified. If the crypto key does not exist in GCP, Vault will create it.
    keyName String
    Name of the key in Vault. Used to reference the key for cryptographic operations.
    keyRing String
    Full resource name of the GCP KMS key ring where the crypto key will be created. Format: projects/{project}/locations/{location}/keyRings/{keyring}
    labels Map<String>
    Map of labels to apply to the GCP KMS crypto key. Can be updated after creation without replacing the resource.
    mount String
    Path where the GCP KMS secrets engine is mounted.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    nextRotationTimeSeconds Number
    Unix timestamp (seconds since epoch) of the next scheduled key rotation. Only set for encryptDecrypt keys that have a rotationPeriod configured. Set to null for asymmetric keys and symmetric keys without rotation. Always refreshed from the API.
    primaryVersion Number
    The primary version number of the GCP KMS crypto key used for new cryptographic operations. Increments only when a key rotation occurs in GCP.
    protectionLevel String
    Protection level for the key. Vault stores and returns this value in lowercase. Valid values:
    purpose String
    Purpose of the key. Vault stores and returns this value in lowercase. Valid values:
    rotationPeriod String

    Rotation period for the key. Accepts Go duration strings (e.g. "72h", "30m") or explicit second strings (e.g. "2592000s"). Only valid for encryptDecrypt keys. Can be updated after creation without replacing the resource.

    The value you set here is preserved exactly in state to avoid format drift. Use the computed rotationScheduleSeconds attribute to read the canonical numeric value that Vault stores.

    rotationScheduleSeconds Number
    The rotation period in seconds as stored and returned by Vault. For example, if rotationPeriod = "72h" then this will be 259200. Always refreshed from the API on each read. Set to null for asymmetric keys.

    Import

    GCP KMS keys can be imported using the format {mount}/keys/{name}:

    $ pulumi import vault:gcp/kmsSecretBackendKey:KmsSecretBackendKey encryption gcpkms/keys/my-encryption-key

    Note: After import, rotationPeriod will be populated from the API as "{N}s" (e.g. "2592000s"). If your configuration uses a different format (e.g. "720h"), Terraform will show a diff on the next plan. Update your configuration to match, or leave rotationPeriod unset to accept the API-formatted value.

    Note: The Vault API does not return keyRing or cryptoKey on read. After import, both fields will be null in state. Ensure your Terraform configuration includes the correct keyRing (and cryptoKey if applicable) values before running pulumi preview after an import — otherwise, because both fields have RequiresReplace, Terraform will plan a destroy and recreate of the key.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial