Robert Main
18f469105c
* Update website folder to indicate deprecation Adds an alert banner to the top of all MDX files within `/website` to indicate deprecation * Update website README
76 lines
3.0 KiB
Plaintext
76 lines
3.0 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: GCP Cloud KMS configuration
|
|
description: >-
|
|
Learn about using the GCP Cloud KMS for key management and configuring parameters and authentication. View an example gcpkms configuration.
|
|
---
|
|
|
|
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
|
|
> [!IMPORTANT]
|
|
> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com.
|
|
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
|
|
|
|
# `gcpckms` KMS
|
|
|
|
The GCP Cloud KMS configures Boundary to use GCP Cloud KMS for key management.
|
|
|
|
The GCP Cloud KMS seal is activated by the presence of a `seal "gcpckms"` block in Boundary's configuration file.
|
|
|
|
## `gcpckms` example
|
|
|
|
This example shows configuring GCP Cloud KMS through the Boundary
|
|
configuration file by providing all the required values:
|
|
|
|
```hcl
|
|
kms "gcpckms" {
|
|
purpose = "root"
|
|
credentials = "/usr/boundary/boundary-project-user-creds.json"
|
|
project = "boundary-project"
|
|
region = "global"
|
|
key_ring = "boundary-keyring"
|
|
crypto_key = "boundary-key"
|
|
key_id = "global_worker-auth"
|
|
}
|
|
```
|
|
|
|
## `gcpckms` parameters
|
|
|
|
These parameters apply to the `kms` stanza in the Boundary configuration file:
|
|
|
|
- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`,
|
|
`root`, `previous-root`, `recovery`, `bsr`, or `config`.
|
|
|
|
- `credentials` `(string: <required>)`: The path to the credentials JSON file
|
|
to use. May be also specified by the `GOOGLE_CREDENTIALS` or
|
|
`GOOGLE_APPLICATION_CREDENTIALS` environment variable or set automatically if
|
|
running under Google App Engine, Google Compute Engine or Google Kubernetes
|
|
Engine.
|
|
|
|
- `project` `(string: <required>)`: The GCP project ID to use. May also be
|
|
specified by the `GOOGLE_PROJECT` environment variable.
|
|
|
|
- `region` `(string: "us-east-1")`: The GCP region/location where the key ring
|
|
lives. May also be specified by the `GOOGLE_REGION` environment variable.
|
|
|
|
- `key_ring` `(string: <required>)`: The GCP CKMS key ring to use. May also be specified
|
|
by the `GCPCKMS_WRAPPER_KEY_RING` environment variable.
|
|
|
|
- `crypto_key` `(string: <required>)`: The GCP CKMS crypto key to use for
|
|
encryption and decryption. May also be specified by the `GCPCKMS_WRAPPER_CRYPTO_KEY`
|
|
environment variable.
|
|
|
|
- `key_id` - The unique name of this key.
|
|
It is used to identify the key when you perform a root key migration.
|
|
You can use the `key_id` field with all KMS stanzas.
|
|
|
|
## Authentication & permissions
|
|
|
|
Authentication-related values must be provided, either as environment
|
|
variables or as configuration parameters.
|
|
|
|
GCP authentication values:
|
|
|
|
- `GOOGLE_CREDENTIALS` or `GOOGLE_APPLICATION_CREDENTIALS`
|
|
- `GOOGLE_PROJECT`
|
|
- `GOOGLE_REGION`
|