open-vault/website/content/api-docs/secret/key-management/gcpkms.mdx
Jim Kalafut 75caf59093
Replace docs references to PUT with POST (#14270)
The operations are handled identically, but ~85% of the references were
POST, and having a mix of PUT and POST was a source of questions.

A subsequent commit will update the internal use of "PUT" such as by
the API client and -output-curl-string.
2022-02-25 06:52:24 -08:00

48 lines
2.2 KiB
Plaintext
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

---
layout: api
page_title: GCP Cloud KMS - Key Management - Secrets Engines - HTTP API
description: The GCP Cloud KMS API documentation for the Key Management secrets engine.
---
# GCP Cloud KMS (API)
The Key Management secrets engine supports lifecycle management of keys in [GCP Cloud KMS](https://cloud.google.com/security-key-management)
[key rings](https://cloud.google.com/kms/docs/resource-hierarchy#key_rings). This is accomplished by
configuring a KMS provider resource with the `gcpckms` provider and other provider-specific parameter
values.
The following sections provide API documentation that is specific to GCP Cloud KMS.
## Create/Update KMS Provider
This endpoint creates or updates a KMS provider. If a KMS provider with the given `name`
does not exist, it will be created. If the KMS provider exists, it will be updated with
the given parameter values.
| Method | Path |
| :----- | :------------------- |
| `POST` | `/keymgmt/kms/:name` |
### Parameters
- `name` `(string: <required>)` Specifies the name of the KMS provider to create or update.
This is provided as part of the request URL.
- `provider` `(string: <required>)` Specifies the name of a KMS provider that's external to
Vault. Must be set to `gcpckms`. Cannot be changed after creation.
- `key_collection` `(string: <required>)` Refers to the
[resource ID](https://cloud.google.com/kms/docs/resource-hierarchy#retrieve_resource_id)
of an existing GCP Cloud KMS [key ring](https://cloud.google.com/kms/docs/resource-hierarchy#key_rings).
Cannot be changed after creation.
- `credentials` `(map<string|string>: nil)` The credentials to use for authentication with GCP
Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified
as environment variables. See the [authentication](/docs/secrets/key-management/gcpkms#authentication)
section for details on precedence.
- `service_account_file` `(string: <required>)` - The path to a Google service account key file. The
key file must be readable on the host that Vault server is running on. May also be provided by the
`GOOGLE_CREDENTIALS` environment variable or by
[application default credentials](https://cloud.google.com/docs/authentication/production).