如何使用 java KMS API 设置密钥环的保护级别？

Question

I need to set ProtectionLevel to HSM for a key ring for both cases during creation and for an existing one.

I am trying to use the same way to set this option as any other option:

CreateKeyRingRequest.newBuilder().//I see nothing to set ProtectionLevel here.

How can I do this using this API?

Answer 1

The HSM ProtectionLevel is not specified on the Key Ring level.

When creating a Key Ring (that is meant to have HSM keys) you just need to take in consideration the regions supported by the HSM ProtectionLevel

For the Key Ring creation you just need a parent (location), keyring_id (the name), and the keyRing object, the documentation gives the following example for Java:

/**
 * Creates a new key ring with the given id.
 */
public static KeyRing createKeyRing(String projectId, String locationId, String keyRingId)
    throws IOException {
  // Create the Cloud KMS client.
  try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {

    // The resource name of the location associated with the KeyRing.
    String parent = LocationName.format(projectId, locationId);

    // Create the KeyRing for your project.
    KeyRing keyRing = client.createKeyRing(parent, keyRingId, KeyRing.newBuilder().build());

    return keyRing;
  }
}

And then you proceed to create your KMS key, to add the HSM Protection Level you will need to create a new CryptoKey Version Template and set the template to the Crypto Key Builder. This is a sample code which I have already tried and confirmed that it works:

  /**
   * Creates a new crypto key with the given id.
   */
  public static CryptoKey createCryptoKey(String projectId, String locationId, String keyRingId,
      String cryptoKeyId)
      throws IOException {

    // Create the Cloud KMS client.
    try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {
      // The resource name of the location associated with the KeyRing.
      String parent = KeyRingName.format(projectId, locationId, keyRingId);
      ProtectionLevel protectionLevel = ProtectionLevel.HSM;

      // creating the template with the right protection level
      CryptoKeyVersionTemplate template = CryptoKeyVersionTemplate.newBuilder()
            .setProtectionLevel(protectionLevel)
            .build();

      // This will allow the API access to the key for encryption and decryption and also the HSM PL.
      CryptoKey cryptoKey = CryptoKey.newBuilder()
          .setPurpose(CryptoKeyPurpose.ENCRYPT_DECRYPT)
          .setVersionTemplate(template)
          .build();

      // Create the CryptoKey for your project.
      CryptoKey createdKey = client.createCryptoKey(parent, cryptoKeyId, cryptoKey);

      return createdKey;
    }
  }

The dependencies you will need:

import com.google.cloud.kms.v1.CryptoKey;
import com.google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose;
import com.google.cloud.kms.v1.ProtectionLevel;
import com.google.cloud.kms.v1.CryptoKeyName;
import com.google.cloud.kms.v1.CryptoKeyVersionTemplate;
import com.google.cloud.kms.v1.KeyManagementServiceClient;
import com.google.cloud.kms.v1.LocationName;