Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. keymgmt
  6. GcpKms
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.keymgmt.GcpKms

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages a GCP Cloud KMS provider in the Vault Key Management secrets engine. This resource configures Vault to integrate with Google Cloud Platform’s Key Management Service, allowing keys created in Vault to be distributed to GCP Cloud KMS for use in GCP services.

    Once configured, keys can be distributed to GCP Cloud KMS using the vault.keymgmt.DistributeKey resource.

    Important This resource requires Terraform 1.11+ for write-only attribute support. The credentialsWo field is write-only and will never be stored in Terraform state. See the main provider documentation for more details.

    For more information on managing GCP Cloud KMS with Vault, please refer to the Vault documentation.

    Note this feature is available only with Vault Enterprise.

    Example Usage

    Using Explicit Credentials

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const keymgmt = new vault.Mount("keymgmt", {
    path: "keymgmt",
    type: "keymgmt",
});
const production = new vault.keymgmt.GcpKms("production", {
    mount: keymgmt.path,
    name: "gcp-production",
    keyCollection: "projects/my-project/locations/us-central1/keyRings/my-keyring",
    credentialsWo: {
        service_account_file: std.file({
            input: "gcp-credentials.json",
        }).then(invoke => invoke.result),
        project: "my-project",
        location: "us-central1",
    },
    credentialsWoVersion: 1,
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

keymgmt = vault.Mount("keymgmt",
    path="keymgmt",
    type="keymgmt")
production = vault.keymgmt.GcpKms("production",
    mount=keymgmt.path,
    name="gcp-production",
    key_collection="projects/my-project/locations/us-central1/keyRings/my-keyring",
    credentials_wo={
        "service_account_file": std.file(input="gcp-credentials.json").result,
        "project": "my-project",
        "location": "us-central1",
    },
    credentials_wo_version=1)

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keymgmt2, err := vault.NewMount(ctx, "keymgmt", &vault.MountArgs{
			Path: pulumi.String("keymgmt"),
			Type: pulumi.String("keymgmt"),
		})
		if err != nil {
			return err
		}
		invokeFile, err := std.File(ctx, &std.FileArgs{
			Input: "gcp-credentials.json",
		}, nil)
		if err != nil {
			return err
		}
		_, err = keymgmt.NewGcpKms(ctx, "production", &keymgmt.GcpKmsArgs{
			Mount:         keymgmt2.Path,
			Name:          pulumi.String("gcp-production"),
			KeyCollection: pulumi.String("projects/my-project/locations/us-central1/keyRings/my-keyring"),
			CredentialsWo: pulumi.StringMap{
				"service_account_file": pulumi.String(invokeFile.Result),
				"project":              pulumi.String("my-project"),
				"location":             pulumi.String("us-central1"),
			},
			CredentialsWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var keymgmt = new Vault.Mount("keymgmt", new()
    {
        Path = "keymgmt",
        Type = "keymgmt",
    });

    var production = new Vault.KeyMgmt.GcpKms("production", new()
    {
        Mount = keymgmt.Path,
        Name = "gcp-production",
        KeyCollection = "projects/my-project/locations/us-central1/keyRings/my-keyring",
        CredentialsWo = 
        {
            { "service_account_file", Std.File.Invoke(new()
            {
                Input = "gcp-credentials.json",
            }).Apply(invoke => invoke.Result) },
            { "project", "my-project" },
            { "location", "us-central1" },
        },
        CredentialsWoVersion = 1,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.keymgmt.GcpKms;
import com.pulumi.vault.keymgmt.GcpKmsArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keymgmt = new Mount("keymgmt", MountArgs.builder()
            .path("keymgmt")
            .type("keymgmt")
            .build());

        var production = new GcpKms("production", GcpKmsArgs.builder()
            .mount(keymgmt.path())
            .name("gcp-production")
            .keyCollection("projects/my-project/locations/us-central1/keyRings/my-keyring")
            .credentialsWo(Map.ofEntries(
                Map.entry("service_account_file", StdFunctions.file(FileArgs.builder()
                    .input("gcp-credentials.json")
                    .build()).result()),
                Map.entry("project", "my-project"),
                Map.entry("location", "us-central1")
            ))
            .credentialsWoVersion(1)
            .build());

    }
}

    resources:
  keymgmt:
    type: vault:Mount
    properties:
      path: keymgmt
      type: keymgmt
  production:
    type: vault:keymgmt:GcpKms
    properties:
      mount: ${keymgmt.path}
      name: gcp-production
      keyCollection: projects/my-project/locations/us-central1/keyRings/my-keyring
      credentialsWo:
        service_account_file:
          fn::invoke:
            function: std:file
            arguments:
              input: gcp-credentials.json
            return: result
        project: my-project
        location: us-central1
      credentialsWoVersion: 1

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_mount" "keymgmt" {
  path = "keymgmt"
  type = "keymgmt"
}
resource "vault_keymgmt_gcpkms" "production" {
  mount          = vault_mount.keymgmt.path
  name           = "gcp-production"
  key_collection = "projects/my-project/locations/us-central1/keyRings/my-keyring"
  credentials_wo = {
    "service_account_file" = file("gcp-credentials.json")
    "project"              = "my-project"
    "location"             = "us-central1"
  }
  credentials_wo_version = 1
}

    Using GCP Application Default Credentials

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

// When credentials_wo is not provided, Vault uses its own environment to
// authenticate with GCP. Supported options include:
// 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault
//    server, pointing to a service account key file.
// 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure
//    with an attached service account.
const keymgmt = new vault.Mount("keymgmt", {
    path: "keymgmt",
    type: "keymgmt",
});
const production = new vault.keymgmt.GcpKms("production", {
    mount: keymgmt.path,
    name: "gcp-production",
    keyCollection: "projects/my-project/locations/us-central1/keyRings/my-keyring",
});

    import pulumi
import pulumi_vault as vault

# When credentials_wo is not provided, Vault uses its own environment to
# authenticate with GCP. Supported options include:
# 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault
#    server, pointing to a service account key file.
# 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure
#    with an attached service account.
keymgmt = vault.Mount("keymgmt",
    path="keymgmt",
    type="keymgmt")
production = vault.keymgmt.GcpKms("production",
    mount=keymgmt.path,
    name="gcp-production",
    key_collection="projects/my-project/locations/us-central1/keyRings/my-keyring")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/keymgmt"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// When credentials_wo is not provided, Vault uses its own environment to
		// authenticate with GCP. Supported options include:
		//  1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault
		//     server, pointing to a service account key file.
		//  2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure
		//     with an attached service account.
		keymgmt2, err := vault.NewMount(ctx, "keymgmt", &vault.MountArgs{
			Path: pulumi.String("keymgmt"),
			Type: pulumi.String("keymgmt"),
		})
		if err != nil {
			return err
		}
		_, err = keymgmt.NewGcpKms(ctx, "production", &keymgmt.GcpKmsArgs{
			Mount:         keymgmt2.Path,
			Name:          pulumi.String("gcp-production"),
			KeyCollection: pulumi.String("projects/my-project/locations/us-central1/keyRings/my-keyring"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    // When credentials_wo is not provided, Vault uses its own environment to
    // authenticate with GCP. Supported options include:
    // 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault
    //    server, pointing to a service account key file.
    // 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure
    //    with an attached service account.
    var keymgmt = new Vault.Mount("keymgmt", new()
    {
        Path = "keymgmt",
        Type = "keymgmt",
    });

    var production = new Vault.KeyMgmt.GcpKms("production", new()
    {
        Mount = keymgmt.Path,
        Name = "gcp-production",
        KeyCollection = "projects/my-project/locations/us-central1/keyRings/my-keyring",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.keymgmt.GcpKms;
import com.pulumi.vault.keymgmt.GcpKmsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // When credentials_wo is not provided, Vault uses its own environment to
        // authenticate with GCP. Supported options include:
        // 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault
        //    server, pointing to a service account key file.
        // 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure
        //    with an attached service account.
        var keymgmt = new Mount("keymgmt", MountArgs.builder()
            .path("keymgmt")
            .type("keymgmt")
            .build());

        var production = new GcpKms("production", GcpKmsArgs.builder()
            .mount(keymgmt.path())
            .name("gcp-production")
            .keyCollection("projects/my-project/locations/us-central1/keyRings/my-keyring")
            .build());

    }
}

    resources:
  # When credentials_wo is not provided, Vault uses its own environment to
  # authenticate with GCP. Supported options include:
  # 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault
  #    server, pointing to a service account key file.
  # 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure
  #    with an attached service account.
  keymgmt:
    type: vault:Mount
    properties:
      path: keymgmt
      type: keymgmt
  production:
    type: vault:keymgmt:GcpKms
    properties:
      mount: ${keymgmt.path}
      name: gcp-production
      keyCollection: projects/my-project/locations/us-central1/keyRings/my-keyring

    pulumi {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

# When credentials_wo is not provided, Vault uses its own environment to
# authenticate with GCP. Supported options include:
# 1. The GOOGLE_APPLICATION_CREDENTIALS environment variable set on the Vault
#    server, pointing to a service account key file.
# 2. Application Default Credentials (ADC) when Vault runs on GCP infrastructure
#    with an attached service account.
resource "vault_mount" "keymgmt" {
  path = "keymgmt"
  type = "keymgmt"
}
resource "vault_keymgmt_gcpkms" "production" {
  mount          = vault_mount.keymgmt.path
  name           = "gcp-production"
  key_collection = "projects/my-project/locations/us-central1/keyRings/my-keyring"
}

    Required GCP Permissions

    The service account must be authorized with the following minimum IAM permissions on the target key ring resource:

    • cloudkms.cryptoKeys.create
    • cloudkms.cryptoKeys.update
    • cloudkms.importJobs.create
    • cloudkms.importJobs.get
    • cloudkms.importJobs.useToImport
    • cloudkms.cryptoKeyVersions.list
    • cloudkms.cryptoKeyVersions.destroy
    • cloudkms.cryptoKeyVersions.update
    • cloudkms.cryptoKeyVersions.create

    Create GcpKms Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new GcpKms(name: string, args: GcpKmsArgs, opts?: CustomResourceOptions);
    @overload
def GcpKms(resource_name: str,
           args: GcpKmsArgs,
           opts: Optional[ResourceOptions] = None)

@overload
def GcpKms(resource_name: str,
           opts: Optional[ResourceOptions] = None,
           key_collection: Optional[str] = None,
           mount: Optional[str] = None,
           credentials_wo: Optional[Mapping[str, str]] = None,
           credentials_wo_version: Optional[int] = None,
           name: Optional[str] = None,
           namespace: Optional[str] = None)
    func NewGcpKms(ctx *Context, name string, args GcpKmsArgs, opts ...ResourceOption) (*GcpKms, error)
    public GcpKms(string name, GcpKmsArgs args, CustomResourceOptions? opts = null)
    public GcpKms(String name, GcpKmsArgs args)
public GcpKms(String name, GcpKmsArgs args, CustomResourceOptions options)

    type: vault:keymgmt:GcpKms
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_keymgmt_gcp_kms" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args GcpKmsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GcpKmsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GcpKmsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GcpKmsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GcpKmsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var gcpKmsResource = new Vault.KeyMgmt.GcpKms("gcpKmsResource", new()
{
    KeyCollection = "string",
    Mount = "string",
    CredentialsWo = 
    {
        { "string", "string" },
    },
    CredentialsWoVersion = 0,
    Name = "string",
    Namespace = "string",
});

    example, err := keymgmt.NewGcpKms(ctx, "gcpKmsResource", &keymgmt.GcpKmsArgs{
	KeyCollection: pulumi.String("string"),
	Mount:         pulumi.String("string"),
	CredentialsWo: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	CredentialsWoVersion: pulumi.Int(0),
	Name:                 pulumi.String("string"),
	Namespace:            pulumi.String("string"),
})

    resource "vault_keymgmt_gcp_kms" "gcpKmsResource" {
  lifecycle {
    create_before_destroy = true
  }
  key_collection = "string"
  mount          = "string"
  credentials_wo = {
    "string" = "string"
  }
  credentials_wo_version = 0
  name                   = "string"
  namespace              = "string"
}

    var gcpKmsResource = new GcpKms("gcpKmsResource", GcpKmsArgs.builder()
    .keyCollection("string")
    .mount("string")
    .credentialsWo(Map.of("string", "string"))
    .credentialsWoVersion(0)
    .name("string")
    .namespace("string")
    .build());

    gcp_kms_resource = vault.keymgmt.GcpKms("gcpKmsResource",
    key_collection="string",
    mount="string",
    credentials_wo={
        "string": "string",
    },
    credentials_wo_version=0,
    name="string",
    namespace="string")

    const gcpKmsResource = new vault.keymgmt.GcpKms("gcpKmsResource", {
    keyCollection: "string",
    mount: "string",
    credentialsWo: {
        string: "string",
    },
    credentialsWoVersion: 0,
    name: "string",
    namespace: "string",
});

    type: vault:keymgmt:GcpKms
properties:
    credentialsWo:
        string: string
    credentialsWoVersion: 0
    keyCollection: string
    mount: string
    name: string
    namespace: string

    GcpKms Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The GcpKms resource accepts the following input properties:

    KeyCollection string
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    CredentialsWo Dictionary<string, string>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    Name string
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    KeyCollection string
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    CredentialsWo map[string]string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    Name string
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    key_collection string
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentials_wo map(string)
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name string
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyCollection String
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentialsWo Map<String,String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Integer
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name String
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyCollection string
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentialsWo {[key: string]: string}
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name string
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    key_collection str
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentials_wo Mapping[str, str]
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name str
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    keyCollection String
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    credentialsWo Map<String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    name String
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the GcpKms resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing GcpKms Resource

    Get an existing GcpKms resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GcpKmsState, opts?: CustomResourceOptions): GcpKms
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        credentials_wo: Optional[Mapping[str, str]] = None,
        credentials_wo_version: Optional[int] = None,
        key_collection: Optional[str] = None,
        mount: Optional[str] = None,
        name: Optional[str] = None,
        namespace: Optional[str] = None) -> GcpKms
    func GetGcpKms(ctx *Context, name string, id IDInput, state *GcpKmsState, opts ...ResourceOption) (*GcpKms, error)
    public static GcpKms Get(string name, Input<string> id, GcpKmsState? state, CustomResourceOptions? opts = null)
    public static GcpKms get(String name, Output<String> id, GcpKmsState state, CustomResourceOptions options)
    resources:  _:    type: vault:keymgmt:GcpKms    get:      id: ${id}
    import {
  to = vault_keymgmt_gcp_kms.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CredentialsWo Dictionary<string, string>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    KeyCollection string
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Name string
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    CredentialsWo map[string]string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    CredentialsWoVersion int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    KeyCollection string
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    Mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    Name string
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    Namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentials_wo map(string)
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    key_collection string
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name string
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentialsWo Map<String,String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Integer
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    keyCollection String
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name String
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentialsWo {[key: string]: string}
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    keyCollection string
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount string
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name string
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace string
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentials_wo Mapping[str, str]
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentials_wo_version int
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    key_collection str
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount str
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name str
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace str
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    credentialsWo Map<String>
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The credentials to use for authentication with Google Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified through environment variables or Application Default Credentials. The order of precedence is environment variables, then the credentials provided to this parameter and Application Default Credentials. This value is write-only and will not be stored in Terraform state. The following values are supported:
    credentialsWoVersion Number
    Version number for the write-only credentials. Increment this value to trigger a credential rotation. Changing this value will cause the credentials to be re-sent to Vault during the next apply. For more info see updating write-only attributes.
    keyCollection String
    Refers to the resource ID of an existing GCP Cloud KMS key ring. Cannot be changed after creation.
    mount String
    Path of the Key Management secrets engine mount. Must match the path of a vault.Mount resource with type = "keymgmt". Use vault_mount.keymgmt.path here.
    name String
    Specifies the name of the GCP Cloud KMS provider. Cannot be changed after creation.
    namespace String
    The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

    Import

    GCP Cloud KMS providers can be imported using the format {path}/kms/{name}, e.g.

    $ pulumi import vault:keymgmt/gcpKms:GcpKms production keymgmt/kms/gcp-production

    Note: Import sets the mount attribute from the import ID. The credentialsWo and credentialsWoVersion fields will not be populated as they are not returned by the Vault API. You must supply these values in your configuration after import. The corresponding vault.Mount resource must also be present in your configuration (or separately imported).

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial