gcloud alpha kms keys versions update

NAME

gcloud alpha kms keys versions update - update a key version

SYNOPSIS

gcloud alpha kms keys versions update VERSION [--crypto-key-backend=CRYPTO_KEY_BACKEND] [--ekm-connection-key-path=EKM_CONNECTION_KEY_PATH] [--external-key-uri=EXTERNAL_KEY_URI] [--key=KEY] [--keyring=KEYRING] [--location=LOCATION] [--protection-level=PROTECTION_LEVEL] [--state=STATE] [GCLOUD_WIDE_FLAG …]

DESCRIPTION

(ALPHA) gcloud alpha kms keys versions update can be used to update the key versions. For keys of any protection level, you can update the key version's state to enable or disable it.

For external keys, you can update the protection level to transition between the external and external-vpc protection levels. For key versions with the external protection level, you can also update the external key URI. For key versions with the external-vpc protection level, you can also update the ekm connection key path or the crypto key backend.

EXAMPLES

The following command enables the key version 8 of key frodo within keyring fellowship and location us-east1:

gcloud alpha kms keys versions update 8 --location=us-east1 --keyring=fellowship --key=frodo --state=enabled

The following command disables the key version 8 of key frodo within keyring fellowship and location us-east1:

gcloud alpha kms keys versions update 8 --location=us-east1 --keyring=fellowship --key=frodo --state=disabled

The following command updates the external key URI of version 8 of key frodo within keyring fellowship and location us-east1:

gcloud alpha kms keys versions update 8 --location=us-east1 --keyring=fellowship --key=frodo --external-key-uri=https://example.kms/v0/some/key/path

The following command updates the ekm connection key path of version 8 of key bilbo within keyring fellowship and location us-east1:

gcloud alpha kms keys versions update 8 --location=us-east1 --keyring=fellowship --key=bilbo --ekm-connection-key-path=v0/some/key/path

The following command updates the protection level to external and the external key URI of version 8 of key frodo within keyring fellowship and location us-east1:

gcloud alpha kms keys versions update 8 --location=us-east1 --keyring=fellowship --key=frodo --protection-level=external --external-key-uri=https://example.kms/v0/some/key/path

The following command updates the protection level to external-vpc, sets the crypto key backend, and sets the ekm connection key path of version 8 of key bilbo within keyring fellowship and location us-east1:

gcloud alpha kms keys versions update 8 --location=us-east1 --keyring=fellowship --key=bilbo --protection-level=external-vpc --crypto-key-backend="projects/$(gcloud config get project)/locations/us-east1/ekmConnections/eagles" --ekm-connection-key-path=v0/some/key/path

POSITIONAL ARGUMENTS

VERSION

Name of the version to describe.

FLAGS

--crypto-key-backend=CRYPTO_KEY_BACKEND

For key versions in the external-vpc protection level only, the resource name of the EkmConnection to be used by this key version. Required with the --ekm-connection-key-path flag when a key version is updated to the external-vpc protection level.

--ekm-connection-key-path=EKM_CONNECTION_KEY_PATH

The path to the external key material on the EKM for keys with protection level external-vpc. Required with the --crypto-key-backend flag when a key version is updated to the external-vpc protection level.

--external-key-uri=EXTERNAL_KEY_URI

The URI of the external key for keys with protection level external.

--key=KEY

The containing key.

--keyring=KEYRING

Key ring of the key.

--location=LOCATION

Location of the keyring.

--protection-level=PROTECTION_LEVEL

Protection level of the key version. Required when a key version is updated from external to external-vpc or from external-vpc to external. PROTECTION_LEVEL must be one of: external, external-vpc.

--state=STATE

State of the key version.

GCLOUD WIDE FLAGS

These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.

Run $ gcloud help for details.

NOTES

This command is currently in alpha and might change without notice. If this command fails with API permission errors despite specifying the correct project, you might be trying to access an API with an invitation-only early access allowlist. These variants are also available:

gcloud kms keys versions update

gcloud beta kms keys versions update