REST Resource: projects.locations.instances.keyRings

Resource: KeyRing

A KeyRing is a logical grouping of keys. Every KeyRing has its own KeyPolicy, set when the KeyRing is created, and every key created in the KeyRing follows it.

Keys cannot be moved between KeyRings, and a KeyRing can only be deleted when it contains no keys.

JSON representation 
{
  "name": string,
  "displayName": string,
  "keyPolicy": {
    object (KeyPolicy)
  },
  "createTime": string,
  "updateTime": string,
  "uid": string,
  "keyCount": integer
}
Fields
name

string

Identifier. The resource name of the KeyRing. Format: projects/{project}/locations/{location}/instances/{instance}/keyRings/{keyRing}
displayName

string

Optional. User-assigned display name for the KeyRing.
keyPolicy

object (KeyPolicy)

Required. Immutable. The KeyPolicy that every key in this KeyRing follows. Set only when the KeyRing is created. It belongs to this KeyRing alone and cannot be shared with or referenced by other KeyRings.
createTime

string (Timestamp format)

Output only. The time at which the KeyRing was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

Output only. The time at which the KeyRing was last updated.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
uid

string

Output only. The unique server-generated identifier of the KeyRing.
keyCount

integer

Output only. The number of keys in the KeyRing, including disabled keys. Because keys are never deleted, a KeyRing can be deleted only while this is 0.

KeyPolicy

A KeyPolicy defines how key shares are allocated when a key is generated: who holds them, how many are needed to sign, and where they are stored.

A KeyPolicy is a tree of threshold rules. The root is a PolicyNode that requires threshold of its children. Each child is a TeamNode, a UserNode, or a nested PolicyNode. The tree is limited to two levels: a PolicyNode nested under the root cannot contain another PolicyNode.

A KeyPolicy is not a standalone resource. It is set inline on a KeyRing when the KeyRing is created, belongs only to that KeyRing, and cannot be changed or shared. To use different rules for new keys, create a new KeyRing with a new KeyPolicy.

JSON representation 
{
  "policy": {
    object (PolicyNode)
  }
}
Fields
policy

object (PolicyNode)

Required. Immutable. The root threshold rule.

PolicyNode

A k-of-n threshold rule over child nodes.

JSON representation 
{
  "policyNodeId": string,
  "threshold": integer,
  "subKeyShares": [
    {
      object (ParticipantNode)
    }
  ]
}
Fields
policyNodeId

string

Required. An identifier for this node, unique within the KeyPolicy. Keys refer to it when they report which key shares fill which slot. Must match [a-z]([a-z0-9-]{0,61}[a-z0-9])?.
threshold

integer

Required. The number of children in subKeyShares that must be satisfied to sign. Must be between 1 and the size of subKeyShares.
subKeyShares[]

object (ParticipantNode)

Required. The child nodes. Must contain at least one node.

ParticipantNode

A child of a PolicyNode.

JSON representation 
{

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "teamNode": {
    object (TeamNode)
  },
  "userNode": {
    object (UserNode)
  },
  "policyNode": {
    object (PolicyNode)
  }
  // End of mutually exclusive fields.
}
Fields
The kind of participant. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
teamNode

object (TeamNode)

threshold of totalMembers key shares held by members of a Team.
userNode

object (UserNode)

Key shares held by a specific User.
policyNode

object (PolicyNode)

A nested threshold rule. Only allowed directly under the root.
End of mutually exclusive fields.

TeamNode

A threshold rule over members of a Team. When a key is created, totalMembers members of the Team each receive a key share, and any threshold of them can sign.

JSON representation 
{
  "team": string,
  "threshold": integer,
  "totalMembers": integer,
  "storageInfo": {
    object (StorageInfo)
  }
}
Fields
team

string

Required. The resource name of the Team. Format: projects/{project}/locations/{location}/instances/{instance}/teams/{team}
threshold

integer

Required. The number of key shares from this Team needed to sign. Must be between 1 and totalMembers.
totalMembers

integer

Required. The number of Team members that receive a key share. This is not the size of the Team: the Team may have more members than this. Key creation fails if the Team has fewer active signers than this.
storageInfo

object (StorageInfo)

Required. Where the Team's key shares are stored.

UserNode

Key shares held by a specific User. The User must have the SIGNER role.

JSON representation 
{
  "user": string,
  "shareStorage": [
    {
      object (StorageInfo)
    }
  ],
  "threshold": integer
}
Fields
user

string

Required. The resource name of the User. Format: projects/{project}/locations/{location}/instances/{instance}/users/{user}
shareStorage[]

object (StorageInfo)

Required. Where each of the User's key shares is stored, one entry per key share. Currently must contain exactly one entry with storageType set to GCP_TEE.
threshold

integer

Required. The number of this User's key shares needed to sign. Must be between 1 and the size of shareStorage. Currently must be 1.

Methods

create

 Creates a new KeyRing in an instance.

delete

 Deletes a KeyRing and its KeyPolicy.

get

 Gets details of a single KeyRing.

list

 Lists KeyRings in an instance.