googleapis · sofisl · Mar 8, 2025 · Sep 19, 2024 · Sep 19, 2024 · Oct 30, 2024
@@ -1,4 +1,4 @@
-// Copyright 2024 Google LLC
+// Copyright 2025 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -40,7 +40,7 @@ module.exports = {
     includePattern: '\\.js$'
   },
   templates: {
-    copyright: 'Copyright 2024 Google LLC',
+    copyright: 'Copyright 2025 Google LLC',
     includeDate: false,
     sourceFiles: false,
     systemName: '@google-cloud/kms',

@@ -1,4 +1,4 @@
-// Copyright 2024 Google LLC
+// Copyright 2025 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.

@@ -1,4 +1,4 @@
-// Copyright 2024 Google LLC
+// Copyright 2025 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.

@@ -44,7 +44,7 @@ Google APIs Client Libraries, in [Client Libraries Explained][explained].
 1.  [Select or create a Cloud Platform project][projects].
 1.  [Enable billing for your project][billing].
 1.  [Enable the Google Cloud Key Management Service API][enable_api].
-1.  [Set up authentication with a service account][auth] so you can access the
+1.  [Set up authentication][auth] so you can access the
     API from your local workstation.
 
 ### Installing the client library
@@ -207,4 +207,4 @@ See [LICENSE](https://github.com/googleapis/google-cloud-node/blob/main/LICENSE)
 [projects]: https://console.cloud.google.com/project
 [billing]: https://support.google.com/cloud/answer/6293499#enable-billing
 [enable_api]: https://console.cloud.google.com/flows/enableapi?apiid=cloudkms.googleapis.com
-[auth]: https://cloud.google.com/docs/authentication/getting-started
+[auth]: https://cloud.google.com/docs/authentication/external/set-up-adc-local
@@ -1,4 +1,4 @@
-// Copyright 2024 Google LLC
+// Copyright 2025 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -27,7 +27,8 @@ option java_multiple_files = true;
 option java_outer_classname = "AutokeyProto";
 option java_package = "com.google.cloud.kms.v1";
 
-// Provides interfaces for using Cloud KMS Autokey to provision new
+// Provides interfaces for using [Cloud KMS
+// Autokey](https://cloud.google.com/kms/help/autokey) to provision new
 // [CryptoKeys][google.cloud.kms.v1.CryptoKey], ready for Customer Managed
 // Encryption Key (CMEK) use, on-demand. To support certain client tooling, this
 // feature is modeled around a [KeyHandle][google.cloud.kms.v1.KeyHandle]
@@ -53,9 +54,9 @@ service Autokey {
   // Creates a new [KeyHandle][google.cloud.kms.v1.KeyHandle], triggering the
   // provisioning of a new [CryptoKey][google.cloud.kms.v1.CryptoKey] for CMEK
   // use with the given resource type in the configured key project and the same
-  // location. [GetOperation][Operations.GetOperation] should be used to resolve
-  // the resulting long-running operation and get the resulting
-  // [KeyHandle][google.cloud.kms.v1.KeyHandle] and
+  // location. [GetOperation][google.longrunning.Operations.GetOperation] should
+  // be used to resolve the resulting long-running operation and get the
+  // resulting [KeyHandle][google.cloud.kms.v1.KeyHandle] and
   // [CryptoKey][google.cloud.kms.v1.CryptoKey].
   rpc CreateKeyHandle(CreateKeyHandleRequest)
       returns (google.longrunning.Operation) {
@@ -180,6 +181,20 @@ message ListKeyHandlesRequest {
     }
   ];
 
+  // Optional. Optional limit on the number of
+  // [KeyHandles][google.cloud.kms.v1.KeyHandle] to include in the response. The
+  // service may return fewer than this value. Further
+  // [KeyHandles][google.cloud.kms.v1.KeyHandle] can subsequently be obtained by
+  // including the
+  // [ListKeyHandlesResponse.next_page_token][google.cloud.kms.v1.ListKeyHandlesResponse.next_page_token]
+  // in a subsequent request.  If unspecified, at most 100
+  // [KeyHandles][google.cloud.kms.v1.KeyHandle] will be returned.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. Optional pagination token, returned earlier via
+  // [ListKeyHandlesResponse.next_page_token][google.cloud.kms.v1.ListKeyHandlesResponse.next_page_token].
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+
   // Optional. Filter to apply when listing
   // [KeyHandles][google.cloud.kms.v1.KeyHandle], e.g.
   // `resource_type_selector="{SERVICE}.googleapis.com/{TYPE}"`.
@@ -191,4 +206,9 @@ message ListKeyHandlesRequest {
 message ListKeyHandlesResponse {
   // Resulting [KeyHandles][google.cloud.kms.v1.KeyHandle].
   repeated KeyHandle key_handles = 1;
+
+  // A token to retrieve next page of results. Pass this value in
+  // [ListKeyHandlesRequest.page_token][google.cloud.kms.v1.ListKeyHandlesRequest.page_token]
+  // to retrieve the next page of results.
+  string next_page_token = 2;
 }
@@ -1,4 +1,4 @@
-// Copyright 2024 Google LLC
+// Copyright 2025 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -27,7 +27,8 @@ option java_multiple_files = true;
 option java_outer_classname = "AutokeyAdminProto";
 option java_package = "com.google.cloud.kms.v1";
 
-// Provides interfaces for managing Cloud KMS Autokey folder-level
+// Provides interfaces for managing [Cloud KMS
+// Autokey](https://cloud.google.com/kms/help/autokey) folder-level
 // configurations. A configuration is inherited by all descendent projects. A
 // configuration at one folder overrides any other configurations in its
 // ancestry. Setting a configuration on a folder is a prerequisite for Cloud KMS
@@ -110,6 +111,23 @@ message AutokeyConfig {
     singular: "autokeyConfig"
   };
 
+  // The states AutokeyConfig can be in.
+  enum State {
+    // The state of the AutokeyConfig is unspecified.
+    STATE_UNSPECIFIED = 0;
+
+    // The AutokeyConfig is currently active.
+    ACTIVE = 1;
+
+    // A previously configured key project has been deleted and the current
+    // AutokeyConfig is unusable.
+    KEY_PROJECT_DELETED = 2;
+
+    // The AutokeyConfig is not yet initialized or has been reset to its default
+    // uninitialized state.
+    UNINITIALIZED = 3;
+  }
+
   // Identifier. Name of the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig]
   // resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`.
   string name = 1 [(google.api.field_behavior) = IDENTIFIER];
@@ -126,6 +144,9 @@ message AutokeyConfig {
   // `cloudkms.admin` role (or pertinent permissions). A request with an empty
   // key project field will clear the configuration.
   string key_project = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Output only. The state for the AutokeyConfig.
+  State state = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
 
 // Request message for

@@ -1,4 +1,4 @@
-// Copyright 2024 Google LLC
+// Copyright 2025 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -23,7 +23,6 @@ import "google/api/resource.proto";
 import "google/protobuf/field_mask.proto";
 import "google/protobuf/timestamp.proto";
 
-option cc_enable_arenas = true;
 option csharp_namespace = "Google.Cloud.Kms.V1";
 option go_package = "cloud.google.com/go/kms/apiv1/kmspb;kmspb";
 option java_multiple_files = true;
@@ -289,7 +288,7 @@ message Certificate {
 // [CryptoKeys][google.cloud.kms.v1.CryptoKey] and
 // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] with a
 // [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
-// [EXTERNAL_VPC][CryptoKeyVersion.ProtectionLevel.EXTERNAL_VPC], as well as
+// [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC], as well as
 // performing cryptographic operations using keys created within the
 // [EkmConnection][google.cloud.kms.v1.EkmConnection].
 message EkmConnection {
@@ -355,6 +354,7 @@ message EkmConnection {
     // All [CryptoKeys][google.cloud.kms.v1.CryptoKey] created with this
     // [EkmConnection][google.cloud.kms.v1.EkmConnection] use EKM-side key
     // management operations initiated from Cloud KMS. This means that:
+    //
     // * When a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
     // associated with this [EkmConnection][google.cloud.kms.v1.EkmConnection]
     // is
@@ -363,7 +363,8 @@ message EkmConnection {
     //   external key material.
     // * Destruction of external key material associated with this
     //   [EkmConnection][google.cloud.kms.v1.EkmConnection] can be requested by
-    //   calling [DestroyCryptoKeyVersion][EkmService.DestroyCryptoKeyVersion].
+    //   calling
+    //   [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion].
     // * Automatic rotation of key material is supported.
     CLOUD_KMS = 2;
   }
@@ -378,13 +379,14 @@ message EkmConnection {
   google.protobuf.Timestamp create_time = 2
       [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // A list of
+  // Optional. A list of
   // [ServiceResolvers][google.cloud.kms.v1.EkmConnection.ServiceResolver] where
   // the EKM can be reached. There should be one ServiceResolver per EKM
   // replica. Currently, only a single
   // [ServiceResolver][google.cloud.kms.v1.EkmConnection.ServiceResolver] is
   // supported.
-  repeated ServiceResolver service_resolvers = 3;
+  repeated ServiceResolver service_resolvers = 3
+      [(google.api.field_behavior) = OPTIONAL];
 
   // Optional. Etag of the currently stored
   // [EkmConnection][google.cloud.kms.v1.EkmConnection].
@@ -409,7 +411,7 @@ message EkmConnection {
 // [CryptoKeys][google.cloud.kms.v1.CryptoKey] and
 // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] with a
 // [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
-// [EXTERNAL_VPC][CryptoKeyVersion.ProtectionLevel.EXTERNAL_VPC] in a given
+// [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC] in a given
 // project and location.
 message EkmConfig {
   option (google.api.resource) = {