diff options
Diffstat (limited to 'third_party/googleapis/google/cloud/kms/v1/ekm_service.proto')
| -rw-r--r-- | third_party/googleapis/google/cloud/kms/v1/ekm_service.proto | 293 |
1 files changed, 293 insertions, 0 deletions
diff --git a/third_party/googleapis/google/cloud/kms/v1/ekm_service.proto b/third_party/googleapis/google/cloud/kms/v1/ekm_service.proto new file mode 100644 index 0000000..de8669d --- /dev/null +++ b/third_party/googleapis/google/cloud/kms/v1/ekm_service.proto @@ -0,0 +1,293 @@ +// Copyright 2021 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.kms.v1; + +import "google/api/annotations.proto"; +import "google/api/client.proto"; +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; +import "google/protobuf/field_mask.proto"; +import "google/protobuf/timestamp.proto"; + +option cc_enable_arenas = true; +option csharp_namespace = "Google.Cloud.Kms.V1"; +option go_package = "google.golang.org/genproto/googleapis/cloud/kms/v1;kms"; +option java_multiple_files = true; +option java_outer_classname = "EkmServiceProto"; +option java_package = "com.google.cloud.kms.v1"; +option php_namespace = "Google\\Cloud\\Kms\\V1"; +option (google.api.resource_definition) = { + type: "servicedirectory.googleapis.com/Service" + pattern: "projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}" +}; + +// Google Cloud Key Management EKM Service +// +// Manages external cryptographic keys and operations using those keys. +// Implements a REST model with the following objects: +// * [EkmConnection][google.cloud.kms.v1.EkmConnection] +service EkmService { + option (google.api.default_host) = "cloudkms.googleapis.com"; + option (google.api.oauth_scopes) = + "https://www.googleapis.com/auth/cloud-platform," + "https://www.googleapis.com/auth/cloudkms"; + + // Lists [EkmConnections][google.cloud.kms.v1.EkmConnection]. + rpc ListEkmConnections(ListEkmConnectionsRequest) + returns (ListEkmConnectionsResponse) { + option (google.api.http) = { + get: "/v1/{parent=projects/*/locations/*}/ekmConnections" + }; + option (google.api.method_signature) = "parent"; + } + + // Returns metadata for a given + // [EkmConnection][google.cloud.kms.v1.EkmConnection]. + rpc GetEkmConnection(GetEkmConnectionRequest) returns (EkmConnection) { + option (google.api.http) = { + get: "/v1/{name=projects/*/locations/*/ekmConnections/*}" + }; + option (google.api.method_signature) = "name"; + } + + // Creates a new [EkmConnection][google.cloud.kms.v1.EkmConnection] in a given + // Project and Location. + rpc CreateEkmConnection(CreateEkmConnectionRequest) returns (EkmConnection) { + option (google.api.http) = { + post: "/v1/{parent=projects/*/locations/*}/ekmConnections" + body: "ekm_connection" + }; + option (google.api.method_signature) = + "parent,ekm_connection_id,ekm_connection"; + } + + // Updates an [EkmConnection][google.cloud.kms.v1.EkmConnection]'s metadata. + rpc UpdateEkmConnection(UpdateEkmConnectionRequest) returns (EkmConnection) { + option (google.api.http) = { + patch: "/v1/{ekm_connection.name=projects/*/locations/*/ekmConnections/*}" + body: "ekm_connection" + }; + option (google.api.method_signature) = "ekm_connection,update_mask"; + } +} + +// Request message for [KeyManagementService.ListEkmConnections][]. +message ListEkmConnectionsRequest { + // Required. The resource name of the location associated with the + // [EkmConnections][google.cloud.kms.v1.EkmConnection] to list, in the format + // `projects/*/locations/*`. + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "locations.googleapis.com/Location" + } + ]; + + // Optional. Optional limit on the number of + // [EkmConnections][google.cloud.kms.v1.EkmConnection] to include in the + // response. Further [EkmConnections][google.cloud.kms.v1.EkmConnection] can + // subsequently be obtained by including the + // [ListEkmConnectionsResponse.next_page_token][google.cloud.kms.v1.ListEkmConnectionsResponse.next_page_token] + // in a subsequent request. If unspecified, the server will pick an + // appropriate default. + int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Optional pagination token, returned earlier via + // [ListEkmConnectionsResponse.next_page_token][google.cloud.kms.v1.ListEkmConnectionsResponse.next_page_token]. + string page_token = 3 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Only include resources that match the filter in the response. For + // more information, see + // [Sorting and filtering list + // results](https://cloud.google.com/kms/docs/sorting-and-filtering). + string filter = 4 [(google.api.field_behavior) = OPTIONAL]; + + // Optional. Specify how the results should be sorted. If not specified, the + // results will be sorted in the default order. For more information, see + // [Sorting and filtering list + // results](https://cloud.google.com/kms/docs/sorting-and-filtering). + string order_by = 5 [(google.api.field_behavior) = OPTIONAL]; +} + +// Response message for [KeyManagementService.ListEkmConnections][]. +message ListEkmConnectionsResponse { + // The list of [EkmConnections][google.cloud.kms.v1.EkmConnection]. + repeated EkmConnection ekm_connections = 1; + + // A token to retrieve next page of results. Pass this value in + // [ListEkmConnectionsRequest.page_token][google.cloud.kms.v1.ListEkmConnectionsRequest.page_token] + // to retrieve the next page of results. + string next_page_token = 2; + + // The total number of [EkmConnections][google.cloud.kms.v1.EkmConnection] + // that matched the query. + int32 total_size = 3; +} + +// Request message for [KeyManagementService.GetEkmConnection][]. +message GetEkmConnectionRequest { + // Required. The [name][google.cloud.kms.v1.EkmConnection.name] of the + // [EkmConnection][google.cloud.kms.v1.EkmConnection] to get. + string name = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "cloudkms.googleapis.com/EkmConnection" + } + ]; +} + +// Request message for [KeyManagementService.CreateEkmConnection][]. +message CreateEkmConnectionRequest { + // Required. The resource name of the location associated with the + // [EkmConnection][google.cloud.kms.v1.EkmConnection], in the format + // `projects/*/locations/*`. + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "locations.googleapis.com/Location" + } + ]; + + // Required. It must be unique within a location and match the regular + // expression `[a-zA-Z0-9_-]{1,63}`. + string ekm_connection_id = 2 [(google.api.field_behavior) = REQUIRED]; + + // Required. An [EkmConnection][google.cloud.kms.v1.EkmConnection] with + // initial field values. + EkmConnection ekm_connection = 3 [(google.api.field_behavior) = REQUIRED]; +} + +// Request message for [KeyManagementService.UpdateEkmConnection][]. +message UpdateEkmConnectionRequest { + // Required. [EkmConnection][google.cloud.kms.v1.EkmConnection] with updated + // values. + EkmConnection ekm_connection = 1 [(google.api.field_behavior) = REQUIRED]; + + // Required. List of fields to be updated in this request. + google.protobuf.FieldMask update_mask = 2 + [(google.api.field_behavior) = REQUIRED]; +} + +// A [Certificate][google.cloud.kms.v1.Certificate] represents an X.509 +// certificate used to authenticate HTTPS connections to EKM replicas. +message Certificate { + // Required. The raw certificate bytes in DER format. + bytes raw_der = 1 [(google.api.field_behavior) = REQUIRED]; + + // Output only. True if the certificate was parsed successfully. + bool parsed = 2 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The issuer distinguished name in RFC 2253 format. Only present + // if [parsed][google.cloud.kms.v1.Certificate.parsed] is true. + string issuer = 3 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The subject distinguished name in RFC 2253 format. Only + // present if [parsed][google.cloud.kms.v1.Certificate.parsed] is true. + string subject = 4 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The subject Alternative DNS names. Only present if + // [parsed][google.cloud.kms.v1.Certificate.parsed] is true. + repeated string subject_alternative_dns_names = 5 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The certificate is not valid before this time. Only present if + // [parsed][google.cloud.kms.v1.Certificate.parsed] is true. + google.protobuf.Timestamp not_before_time = 6 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The certificate is not valid after this time. Only present if + // [parsed][google.cloud.kms.v1.Certificate.parsed] is true. + google.protobuf.Timestamp not_after_time = 7 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The certificate serial number as a hex string. Only present if + // [parsed][google.cloud.kms.v1.Certificate.parsed] is true. + string serial_number = 8 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The SHA-256 certificate fingerprint as a hex string. Only + // present if [parsed][google.cloud.kms.v1.Certificate.parsed] is true. + string sha256_fingerprint = 9 [(google.api.field_behavior) = OUTPUT_ONLY]; +} + +// An [EkmConnection][google.cloud.kms.v1.EkmConnection] represents an +// individual EKM connection. It can be used for creating +// [CryptoKeys][google.cloud.kms.v1.CryptoKey] and +// [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] with a +// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of +// [EXTERNAL_VPC][CryptoKeyVersion.ProtectionLevel.EXTERNAL_VPC], as well as +// performing cryptographic operations using keys created within the +// [EkmConnection][google.cloud.kms.v1.EkmConnection]. +message EkmConnection { + option (google.api.resource) = { + type: "cloudkms.googleapis.com/EkmConnection" + pattern: "projects/{project}/locations/{location}/ekmConnections/{ekm_connection}" + }; + + // A [ServiceResolver][google.cloud.kms.v1.EkmConnection.ServiceResolver] + // represents an EKM replica that can be reached within an + // [EkmConnection][google.cloud.kms.v1.EkmConnection]. + message ServiceResolver { + // Required. The resource name of the Service Directory service pointing to + // an EKM replica, in the format + // `projects/*/locations/*/namespaces/*/services/*`. + string service_directory_service = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + type: "servicedirectory.googleapis.com/Service" + } + ]; + + // Optional. The filter applied to the endpoints of the resolved service. If + // no filter is specified, all endpoints will be considered. An endpoint + // will be chosen arbitrarily from the filtered list for each request. + // + // For endpoint filter syntax and examples, see + // https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest. + string endpoint_filter = 2 [(google.api.field_behavior) = OPTIONAL]; + + // Required. The hostname of the EKM replica used at TLS and HTTP layers. + string hostname = 3 [(google.api.field_behavior) = REQUIRED]; + + // Required. A list of leaf server certificates used to authenticate HTTPS + // connections to the EKM replica. + repeated Certificate server_certificates = 4 + [(google.api.field_behavior) = REQUIRED]; + } + + // Output only. The resource name for the + // [EkmConnection][google.cloud.kms.v1.EkmConnection] in the format + // `projects/*/locations/*/ekmConnections/*`. + string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The time at which the + // [EkmConnection][google.cloud.kms.v1.EkmConnection] was created. + google.protobuf.Timestamp create_time = 2 + [(google.api.field_behavior) = OUTPUT_ONLY]; + + // A list of + // [ServiceResolvers][google.cloud.kms.v1.EkmConnection.ServiceResolver] where + // the EKM can be reached. There should be one ServiceResolver per EKM + // replica. Currently, only a single + // [ServiceResolver][google.cloud.kms.v1.EkmConnection.ServiceResolver] is + // supported. + repeated ServiceResolver service_resolvers = 3; + + // This checksum is computed by the server based on the value of other fields, + // and may be sent on update requests to ensure the client has an up-to-date + // value before proceeding. + string etag = 5; +} |