diff --git a/.changelog/6760.txt b/.changelog/6760.txt new file mode 100644 index 00000000000..3db733809c3 --- /dev/null +++ b/.changelog/6760.txt @@ -0,0 +1,6 @@ +```release-note:new-datasource +`google_logging_project_cmek_settings` +``` +```release-note:enhancement +logging: added `cmek_settings` field to `google_logging_project_bucket_config` resource +``` diff --git a/google/data_source_google_logging_project_cmek_settings.go b/google/data_source_google_logging_project_cmek_settings.go new file mode 100644 index 00000000000..0a3304a1298 --- /dev/null +++ b/google/data_source_google_logging_project_cmek_settings.go @@ -0,0 +1,103 @@ +package google + +import ( + "fmt" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" +) + +func dataSourceGoogleLoggingProjectCmekSettings() *schema.Resource { + return &schema.Resource{ + Read: dataSourceGoogleLoggingProjectCmekSettingsRead, + Schema: map[string]*schema.Schema{ + "kms_key_name": { + Type: schema.TypeString, + Optional: true, + Description: `The resource name for the configured Cloud KMS key. + KMS key name format: + "projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]" + To enable CMEK for the bucket, set this field to a valid kmsKeyName for which the associated service account has the required cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key. + The Cloud KMS key used by the bucket can be updated by changing the kmsKeyName to a new valid key name. Encryption operations that are in progress will be completed with the key that was in use when they started. Decryption operations will be completed using the key that was used at the time of encryption unless access to that key has been revoked. + See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.`, + }, + "kms_key_version_name": { + Type: schema.TypeString, + Computed: true, + Description: `The CryptoKeyVersion resource name for the configured Cloud KMS key. + KMS key name format: + "projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[VERSION]" + For example: + "projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key/cryptoKeyVersions/1" + This is a read-only field used to convey the specific configured CryptoKeyVersion of kms_key that has been configured. It will be populated in cases where the CMEK settings are bound to a single key version.`, + }, + "name": { + Type: schema.TypeString, + Computed: true, + Description: `The resource name of the CMEK settings.`, + }, + "service_account_id": { + Type: schema.TypeString, + Computed: true, + Description: `The service account associated with a project for which CMEK will apply. + Before enabling CMEK for a logging bucket, you must first assign the cloudkms.cryptoKeyEncrypterDecrypter role to the service account associated with the project for which CMEK will apply. Use [v2.getCmekSettings](https://cloud.google.com/logging/docs/reference/v2/rest/v2/TopLevel/getCmekSettings#google.logging.v2.ConfigServiceV2.GetCmekSettings) to obtain the service account ID. + See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.`, + }, + "project": { + Type: schema.TypeString, + Required: true, + }, + }, + } +} + +func dataSourceGoogleLoggingProjectCmekSettingsRead(d *schema.ResourceData, meta interface{}) error { + config := meta.(*Config) + userAgent, err := generateUserAgentString(d, config.userAgent) + if err != nil { + return err + } + + url, err := replaceVars(d, config, "{{LoggingBasePath}}projects/{{project}}/cmekSettings") + if err != nil { + return err + } + + billingProject := "" + + project, err := getProject(d, config) + if err != nil { + return fmt.Errorf("Error fetching project for ProjectCmekSettings: %s", err) + } + billingProject = project + + // err == nil indicates that the billing_project value was found + if bp, err := getBillingProject(d, config); err == nil { + billingProject = bp + } + + res, err := sendRequest(config, "GET", billingProject, url, userAgent, nil) + if err != nil { + return handleNotFoundError(err, d, fmt.Sprintf("LoggingProjectCmekSettings %q", d.Id())) + } + + d.SetId(fmt.Sprintf("projects/%s/cmekSettings", project)) + + if err := d.Set("project", project); err != nil { + return fmt.Errorf("Error reading ProjectCmekSettings: %s", err) + } + + if err := d.Set("name", res["name"]); err != nil { + return fmt.Errorf("Error reading ProjectCmekSettings: %s", err) + } + if err := d.Set("kms_key_name", res["kmsKeyName"]); err != nil { + return fmt.Errorf("Error reading ProjectCmekSettings: %s", err) + } + if err := d.Set("kms_key_version_name", res["kmsKeyVersionName"]); err != nil { + return fmt.Errorf("Error reading ProjectCmekSettings: %s", err) + } + if err := d.Set("service_account_id", res["serviceAccountId"]); err != nil { + return fmt.Errorf("Error reading ProjectCmekSettings: %s", err) + } + + return nil +} diff --git a/google/data_source_google_logging_project_cmek_settings_test.go b/google/data_source_google_logging_project_cmek_settings_test.go new file mode 100644 index 00000000000..99206272ab9 --- /dev/null +++ b/google/data_source_google_logging_project_cmek_settings_test.go @@ -0,0 +1,51 @@ +package google + +import ( + "fmt" + "testing" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" +) + +func TestAccLoggingProjectCmekSettings_basic(t *testing.T) { + t.Parallel() + + context := map[string]interface{}{ + "project_name": "tf-test-" + randString(t, 10), + "org_id": getTestOrgFromEnv(t), + "billing_account": getTestBillingAccountFromEnv(t), + } + resourceName := "data.google_logging_project_cmek_settings.cmek_settings" + + vcrTest(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + Steps: []resource.TestStep{ + { + Config: testAccLoggingProjectCmekSettings_basic(context), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr( + resourceName, "id", fmt.Sprintf("projects/%s/cmekSettings", context["project_name"])), + resource.TestCheckResourceAttr( + resourceName, "name", fmt.Sprintf("projects/%s/cmekSettings", context["project_name"])), + resource.TestCheckResourceAttrSet(resourceName, "service_account_id"), + ), + }, + }, + }) +} + +func testAccLoggingProjectCmekSettings_basic(context map[string]interface{}) string { + return Nprintf(` +resource "google_project" "default" { + project_id = "%{project_name}" + name = "%{project_name}" + org_id = "%{org_id}" + billing_account = "%{billing_account}" +} + +data "google_logging_project_cmek_settings" "cmek_settings" { + project = google_project.default.name +} +`, context) +} diff --git a/google/provider.go b/google/provider.go index 14b1db5798b..93e80f4984a 100644 --- a/google/provider.go +++ b/google/provider.go @@ -874,6 +874,7 @@ func Provider() *schema.Provider { "google_folder": dataSourceGoogleFolder(), "google_folders": dataSourceGoogleFolders(), "google_folder_organization_policy": dataSourceGoogleFolderOrganizationPolicy(), + "google_logging_project_cmek_settings": dataSourceGoogleLoggingProjectCmekSettings(), "google_monitoring_notification_channel": dataSourceMonitoringNotificationChannel(), "google_monitoring_cluster_istio_service": dataSourceMonitoringServiceClusterIstio(), "google_monitoring_istio_canonical_service": dataSourceMonitoringIstioCanonicalService(), diff --git a/google/resource_logging_bucket_config.go b/google/resource_logging_bucket_config.go index 02de26da4f3..28abf878e04 100644 --- a/google/resource_logging_bucket_config.go +++ b/google/resource_logging_bucket_config.go @@ -44,6 +44,48 @@ var loggingBucketConfigSchema = map[string]*schema.Schema{ Computed: true, Description: `The bucket's lifecycle such as active or deleted.`, }, + "cmek_settings": { + Type: schema.TypeList, + MaxItems: 1, + Optional: true, + Description: `The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed.`, + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + "name": { + Type: schema.TypeString, + Computed: true, + Description: `The resource name of the CMEK settings.`, + }, + "kms_key_name": { + Type: schema.TypeString, + Required: true, + Description: `The resource name for the configured Cloud KMS key. +KMS key name format: +"projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]" +To enable CMEK for the bucket, set this field to a valid kmsKeyName for which the associated service account has the required cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key. +The Cloud KMS key used by the bucket can be updated by changing the kmsKeyName to a new valid key name. Encryption operations that are in progress will be completed with the key that was in use when they started. Decryption operations will be completed using the key that was used at the time of encryption unless access to that key has been revoked. +See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.`, + }, + "kms_key_version_name": { + Type: schema.TypeString, + Computed: true, + Description: `The CryptoKeyVersion resource name for the configured Cloud KMS key. +KMS key name format: +"projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[VERSION]" +For example: +"projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key/cryptoKeyVersions/1" +This is a read-only field used to convey the specific configured CryptoKeyVersion of kms_key that has been configured. It will be populated in cases where the CMEK settings are bound to a single key version.`, + }, + "service_account_id": { + Type: schema.TypeString, + Computed: true, + Description: `The service account associated with a project for which CMEK will apply. +Before enabling CMEK for a logging bucket, you must first assign the cloudkms.cryptoKeyEncrypterDecrypter role to the service account associated with the project for which CMEK will apply. Use [v2.getCmekSettings](https://cloud.google.com/logging/docs/reference/v2/rest/v2/TopLevel/getCmekSettings#google.logging.v2.ConfigServiceV2.GetCmekSettings) to obtain the service account ID. +See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.`, + }, + }, + }, + }, } type loggingBucketConfigIDFunc func(d *schema.ResourceData, config *Config) (string, error) @@ -154,6 +196,7 @@ func resourceLoggingBucketConfigCreate(d *schema.ResourceData, meta interface{}, obj["description"] = d.Get("description") obj["retentionDays"] = d.Get("retention_days") obj["locked"] = d.Get("locked") + obj["cmekSettings"] = expandCmekSettings(d.Get("cmek_settings")) url, err := replaceVars(d, config, "{{LoggingBasePath}}projects/{{project}}/locations/{{location}}/buckets?bucketId={{bucket_id}}") if err != nil { @@ -221,6 +264,10 @@ func resourceLoggingBucketConfigRead(d *schema.ResourceData, meta interface{}) e return fmt.Errorf("Error setting retention_days: %s", err) } + if err := d.Set("cmek_settings", flattenCmekSettings(res["cmekSettings"])); err != nil { + return fmt.Errorf("Error setting cmek_settings: %s", err) + } + return nil } @@ -240,6 +287,7 @@ func resourceLoggingBucketConfigUpdate(d *schema.ResourceData, meta interface{}) obj["retentionDays"] = d.Get("retention_days") obj["description"] = d.Get("description") + obj["cmekSettings"] = expandCmekSettings(d.Get("cmek_settings")) updateMask := []string{} if d.HasChange("retention_days") { @@ -248,6 +296,9 @@ func resourceLoggingBucketConfigUpdate(d *schema.ResourceData, meta interface{}) if d.HasChange("description") { updateMask = append(updateMask, "description") } + if d.HasChange("cmek_settings") { + updateMask = append(updateMask, "cmekSettings") + } url, err = addQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")}) if err != nil { return err @@ -284,3 +335,41 @@ func resourceLoggingBucketConfigDelete(d *schema.ResourceData, meta interface{}) } return nil } + +func expandCmekSettings(v interface{}) interface{} { + if v == nil { + return nil + } + + l := v.([]interface{}) + if len(l) == 0 || l[0] == nil { + return nil + } + + original := l[0].(map[string]interface{}) + + transformed := map[string]interface{}{ + "name": original["name"], + "kmsKeyName": original["kms_key_name"], + "kmsKeyVersionName": original["kms_key_version_name"], + "serviceAccountId": original["service_account_id"], + } + return transformed +} + +func flattenCmekSettings(cmekSettings interface{}) []map[string]interface{} { + if cmekSettings == nil { + return nil + } + + cmekSettingsData := cmekSettings.(map[string]interface{}) + + data := map[string]interface{}{ + "name": cmekSettingsData["name"], + "kms_key_name": cmekSettingsData["kmsKeyName"], + "kms_key_version_name": cmekSettingsData["kmsKeyVersionName"], + "service_account_id": cmekSettingsData["serviceAccountId"], + } + + return []map[string]interface{}{data} +} diff --git a/google/resource_logging_bucket_config_test.go b/google/resource_logging_bucket_config_test.go index 8002cffd4c2..2f3b95d7dd9 100644 --- a/google/resource_logging_bucket_config_test.go +++ b/google/resource_logging_bucket_config_test.go @@ -86,6 +86,46 @@ func TestAccLoggingBucketConfigProject_basic(t *testing.T) { }) } +func TestAccLoggingBucketConfigProject_cmekSettings(t *testing.T) { + t.Parallel() + + context := map[string]interface{}{ + "project_name": "tf-test-" + randString(t, 10), + "org_id": getTestOrgFromEnv(t), + "billing_account": getTestBillingAccountFromEnv(t), + } + + bucketId := fmt.Sprintf("tf-test-bucket-%s", randString(t, 10)) + keyRingName := fmt.Sprintf("tf-test-key-ring-%s", randString(t, 10)) + cryptoKeyName := fmt.Sprintf("tf-test-crypto-key-%s", randString(t, 10)) + cryptoKeyNameUpdate := fmt.Sprintf("tf-test-crypto-key-%s", randString(t, 10)) + + vcrTest(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + Steps: []resource.TestStep{ + { + Config: testAccLoggingBucketConfigProject_cmekSettings(context, bucketId, keyRingName, cryptoKeyName, cryptoKeyNameUpdate), + }, + { + ResourceName: "google_logging_project_bucket_config.basic", + ImportState: true, + ImportStateVerify: true, + ImportStateVerifyIgnore: []string{"project"}, + }, + { + Config: testAccLoggingBucketConfigProject_cmekSettingsUpdate(context, bucketId, keyRingName, cryptoKeyName, cryptoKeyNameUpdate), + }, + { + ResourceName: "google_logging_project_bucket_config.basic", + ImportState: true, + ImportStateVerify: true, + ImportStateVerifyIgnore: []string{"project"}, + }, + }, + }) +} + func TestAccLoggingBucketConfigBillingAccount_basic(t *testing.T) { t.Parallel() @@ -190,6 +230,96 @@ resource "google_logging_project_bucket_config" "basic" { `, context), retention, retention) } +func testAccLoggingBucketConfigProject_preCmekSettings(context map[string]interface{}, keyRingName, cryptoKeyName, cryptoKeyNameUpdate string) string { + return fmt.Sprintf(Nprintf(` +resource "google_project" "default" { + project_id = "%{project_name}" + name = "%{project_name}" + org_id = "%{org_id}" + billing_account = "%{billing_account}" +} + +data "google_logging_project_cmek_settings" "cmek_settings" { + project = google_project.default.name +} + +resource "google_kms_key_ring" "keyring" { + name = "%s" + location = "us-central1" +} + +resource "google_kms_crypto_key" "key1" { + name = "%s" + key_ring = google_kms_key_ring.keyring.id + rotation_period = "100000s" +} + +resource "google_kms_crypto_key" "key2" { + name = "%s" + key_ring = google_kms_key_ring.keyring.id + rotation_period = "100000s" +} + +resource "google_kms_crypto_key_iam_binding" "crypto_key_binding1" { + crypto_key_id = google_kms_crypto_key.key1.id + role = "roles/cloudkms.cryptoKeyEncrypterDecrypter" + + members = [ + "serviceAccount:${data.google_logging_project_cmek_settings.cmek_settings.service_account_id}", + ] +} + +resource "google_kms_crypto_key_iam_binding" "crypto_key_binding2" { + crypto_key_id = google_kms_crypto_key.key2.id + role = "roles/cloudkms.cryptoKeyEncrypterDecrypter" + + members = [ + "serviceAccount:${data.google_logging_project_cmek_settings.cmek_settings.service_account_id}", + ] +} +`, context), keyRingName, cryptoKeyName, cryptoKeyNameUpdate) +} + +func testAccLoggingBucketConfigProject_cmekSettings(context map[string]interface{}, bucketId, keyRingName, cryptoKeyName, cryptoKeyNameUpdate string) string { + return fmt.Sprintf(` +%s + +resource "google_logging_project_bucket_config" "basic" { + project = google_project.default.name + location = "us-central1" + retention_days = 30 + description = "retention test 30 days" + bucket_id = "%s" + + cmek_settings { + kms_key_name = google_kms_crypto_key.key1.id + } + + depends_on = [google_kms_crypto_key_iam_binding.crypto_key_binding1] +} +`, testAccLoggingBucketConfigProject_preCmekSettings(context, keyRingName, cryptoKeyName, cryptoKeyNameUpdate), bucketId) +} + +func testAccLoggingBucketConfigProject_cmekSettingsUpdate(context map[string]interface{}, bucketId, keyRingName, cryptoKeyName, cryptoKeyNameUpdate string) string { + return fmt.Sprintf(` +%s + +resource "google_logging_project_bucket_config" "basic" { + project = google_project.default.name + location = "us-central1" + retention_days = 30 + description = "retention test 30 days" + bucket_id = "%s" + + cmek_settings { + kms_key_name = google_kms_crypto_key.key2.id + } + + depends_on = [google_kms_crypto_key_iam_binding.crypto_key_binding2] +} +`, testAccLoggingBucketConfigProject_preCmekSettings(context, keyRingName, cryptoKeyName, cryptoKeyNameUpdate), bucketId) +} + func TestAccLoggingBucketConfig_CreateBuckets_withCustomId(t *testing.T) { t.Parallel() diff --git a/website/docs/d/logging_project_cmek_settings.html.markdown b/website/docs/d/logging_project_cmek_settings.html.markdown new file mode 100644 index 00000000000..6f44ed932a8 --- /dev/null +++ b/website/docs/d/logging_project_cmek_settings.html.markdown @@ -0,0 +1,61 @@ +--- +subcategory: "Cloud (Stackdriver) Logging" +page_title: "Google: google_logging_project_cmek_settings" +description: |- + Describes the customer-managed encryption key (CMEK) settings associated with a project. +--- + +# google\_logging\_project\_cmek\_settings + +Describes the customer-managed encryption key (CMEK) settings associated with a project. + +To get more information about Service, see: + +* [API documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/projects/getCmekSettings) +* [Enable CMEK](https://cloud.google.com/logging/docs/routing/managed-encryption-storage#enable). + +## Example Usage - Logging Project Cmek Settings Basic + + +```hcl +data "google_logging_project_cmek_settings" "cmek_settings" { + project = "my-project-name" +} +``` + +## Argument Reference + +The following arguments are supported: + + + +- - - + +* `project` - (Required) The ID of the project. + + +## Attributes Reference + +In addition to the arguments listed above, the following computed attributes are exported: + +* `id` - an identifier for the resource with format `projects/{{project}}/cmekSettings` + +* `name` - The resource name of the CMEK settings. + +* `kms_key_name` - The resource name for the configured Cloud KMS key. +KMS key name format: +`'projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]'` +To enable CMEK for the bucket, set this field to a valid kmsKeyName for which the associated service account has the required cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key. +The Cloud KMS key used by the bucket can be updated by changing the kmsKeyName to a new valid key name. Encryption operations that are in progress will be completed with the key that was in use when they started. Decryption operations will be completed using the key that was used at the time of encryption unless access to that key has been revoked. +See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information. + +* `kms_key_version_name` - The CryptoKeyVersion resource name for the configured Cloud KMS key. +KMS key name format: +`'projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[VERSION]'` +For example: +"projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key/cryptoKeyVersions/1" +This is a read-only field used to convey the specific configured CryptoKeyVersion of kms_key that has been configured. It will be populated in cases where the CMEK settings are bound to a single key version. + +* `service_account_id` - The service account associated with a project for which CMEK will apply. +Before enabling CMEK for a logging bucket, you must first assign the cloudkms.cryptoKeyEncrypterDecrypter role to the service account associated with the project for which CMEK will apply. Use [v2.getCmekSettings](https://cloud.google.com/logging/docs/reference/v2/rest/v2/TopLevel/getCmekSettings#google.logging.v2.ConfigServiceV2.GetCmekSettings) to obtain the service account ID. +See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information. \ No newline at end of file diff --git a/website/docs/r/logging_project_bucket_config.html.markdown b/website/docs/r/logging_project_bucket_config.html.markdown index e14d8b92d95..6ac7277789f 100644 --- a/website/docs/r/logging_project_bucket_config.html.markdown +++ b/website/docs/r/logging_project_bucket_config.html.markdown @@ -41,6 +41,47 @@ resource "google_logging_project_bucket_config" "basic" { } ``` +Create logging bucket with customId and cmekSettings + +```hcl +data "google_logging_project_cmek_settings" "cmek_settings" { + project = "project_id" +} + +resource "google_kms_key_ring" "keyring" { + name = "keyring-example" + location = "us-central1" +} + +resource "google_kms_crypto_key" "key" { + name = "crypto-key-example" + key_ring = google_kms_key_ring.keyring.id + rotation_period = "100000s" +} + +resource "google_kms_crypto_key_iam_binding" "crypto_key_binding" { + crypto_key_id = google_kms_crypto_key.key.id + role = "roles/cloudkms.cryptoKeyEncrypterDecrypter" + + members = [ + "serviceAccount:${data.google_logging_project_cmek_settings.cmek_settings.service_account_id}", + ] +} + +resource "google_logging_project_bucket_config" "example-project-bucket-cmek-settings" { + project = "project_id" + location = "us-central1" + retention_days = 30 + bucket_id = "custom-bucket" + + cmek_settings { + kms_key_name = google_kms_crypto_key.key.id + } + + depends_on = [google_kms_crypto_key_iam_binding.crypto_key_binding] +} +``` + ## Argument Reference The following arguments are supported: @@ -55,6 +96,31 @@ The following arguments are supported: * `retention_days` - (Optional) Logs will be retained by default for this amount of time, after which they will automatically be deleted. The minimum retention period is 1 day. If this value is set to zero at bucket creation time, the default time of 30 days will be used. +* `cmek_settings` - (Optional) The CMEK settings of the log bucket. If present, new log entries written to this log bucket are encrypted using the CMEK key provided in this configuration. If a log bucket has CMEK settings, the CMEK settings cannot be disabled later by updating the log bucket. Changing the KMS key is allowed. Structure is [documented below](#nested_cmek_settings). + + +The `cmek_settings` block supports: + +* `name` - The resource name of the CMEK settings. + +* `kms_key_name` - The resource name for the configured Cloud KMS key. +KMS key name format: +`'projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]'` +To enable CMEK for the bucket, set this field to a valid kmsKeyName for which the associated service account has the required cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key. +The Cloud KMS key used by the bucket can be updated by changing the kmsKeyName to a new valid key name. Encryption operations that are in progress will be completed with the key that was in use when they started. Decryption operations will be completed using the key that was used at the time of encryption unless access to that key has been revoked. +See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information. + +* `kms_key_version_name` - The CryptoKeyVersion resource name for the configured Cloud KMS key. +KMS key name format: +`'projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[VERSION]'` +For example: +"projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key/cryptoKeyVersions/1" +This is a read-only field used to convey the specific configured CryptoKeyVersion of kms_key that has been configured. It will be populated in cases where the CMEK settings are bound to a single key version. + +* `service_account_id` - The service account associated with a project for which CMEK will apply. +Before enabling CMEK for a logging bucket, you must first assign the cloudkms.cryptoKeyEncrypterDecrypter role to the service account associated with the project for which CMEK will apply. Use [v2.getCmekSettings](https://cloud.google.com/logging/docs/reference/v2/rest/v2/TopLevel/getCmekSettings#google.logging.v2.ConfigServiceV2.GetCmekSettings) to obtain the service account ID. +See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information. + ## Attributes Reference In addition to the arguments listed above, the following computed attributes are