mirror of https://github.com/letic/terraform-provider-google.git synced 2024-07-23 10:05:59 +00:00

Seth Vargo 96cb1fbc16 Encourage users to set lifecycle hooks on kms_crypto_key resources (#1896 )

@michaelharo suggested this would be a good best practice for this particular resource to prevent users from accidentally deleting a bunch of encryption keys on a -/+ and losing data, and I agree.

This commit adds a quick documentation blurb saying what actually happens if those crypto key versions are destroyed and also updates the snippet to showcase a lifecycle hook.

2018-09-05 09:59:41 -07:00

2.7 KiB

Raw Blame History

layout	page_title	sidebar_current	description
google	Google: google_kms_crypto_key	docs-google-kms-crypto-key-x	Allows creation of a Google Cloud Platform KMS CryptoKey.

google_kms_crypto_key

Allows creation of a Google Cloud Platform KMS CryptoKey. For more information see the official documentation and API.

A CryptoKey is an interface to key material which can be used to encrypt and decrypt data. A CryptoKey belongs to a Google Cloud KMS KeyRing.

~> Note: CryptoKeys cannot be deleted from Google Cloud Platform. Destroying a Terraform-managed CryptoKey will remove it from state and delete all CryptoKeyVersions, rendering the key unusable, but will not delete the resource on the server. When Terraform destroys these keys, any data previously encrypted with these keys will be irrecoverable. For this reason, it is strongly recommended that you add lifecycle hooks to the resource to prevent accidental destruction.

Example Usage

resource "google_kms_key_ring" "my_key_ring" {
  name     = "my-key-ring"
  project  = "my-project"
  location = "us-central1"
}

resource "google_kms_crypto_key" "my_crypto_key" {
  name            = "my-crypto-key"
  key_ring        = "${google_kms_key_ring.my_key_ring.self_link}"
  rotation_period = "100000s"

  lifecycle {
    prevent_destroy = true
  }
}

Argument Reference

The following arguments are supported:

name - (Required) The CryptoKey's name. A CryptoKey’s name must be unique within a location and match the regular expression [a-zA-Z0-9_-]{1,63}
key_ring - (Required) The id of the Google Cloud Platform KeyRing to which the key shall belong.

rotation_period - (Optional) Every time this period passes, generate a new CryptoKeyVersion and set it as the primary. The first rotation will take place after the specified period. The rotation period has the format of a decimal number with up to 9 fractional digits, followed by the letter s (seconds). It must be greater than a day (ie, 86400).

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

self_link - The self link of the created CryptoKey. Its format is projects/{projectId}/locations/{location}/keyRings/{keyRingName}/cryptoKeys/{cryptoKeyName}.

Import

CryptoKeys can be imported using the CryptoKey autogenerated id, e.g.

$ terraform import google_kms_crypto_key.my_crypto_key my-gcp-project/us-central1/my-key-ring/my-crypto-key

$ terraform import google_kms_crypto_key.my_crypto_key us-central1/my-key-ring/my-crypto-key

2.7 KiB Raw Blame History Unescape Escape