gcp

Documentation

Overview

Package gcp implements a KMS backend for Google Cloud KMS.

The following permissions are required for the service account used to authenticate with GCP:

• cloudkms.cryptoKeys.get
• cloudkms.cryptoKeys.encrypt
• cloudkms.cryptoKeys.decrypt

Index

• type KMSClient
  • func New(_ context.Context, store kmsInterface.Storage, cfg uri.GCPConfig) (*KMSClient, error)
  • func (c *KMSClient) Close()
  • func (c *KMSClient) GetDEK(ctx context.Context, keyID string, dekSize int) ([]byte, error)

Types

type KMSClient

type KMSClient struct {
	// contains filtered or unexported fields
}

KMSClient implements the CloudKMS interface for Google Cloud Platform.

func New

func New(_ context.Context, store kmsInterface.Storage, cfg uri.GCPConfig) (*KMSClient, error)

New initializes a KMS client for Google Cloud Platform.

func (*KMSClient) Close

func (c *KMSClient) Close()

Close closes the KMS client.

func (*KMSClient) GetDEK

func (c *KMSClient) GetDEK(ctx context.Context, keyID string, dekSize int) ([]byte, error)

GetDEK fetches an encrypted Data Encryption Key from storage and decrypts it using a KEK stored in Google's KMS.