Make explicit the Pub/Sub service account KMS role requirements for C…

…MEK. Co-Authored-By: Riley Karson <[email protected]>
GoogleCloudPlatform · Jul 2, 2019 · 9ace532 · 9ace532
1 parent bb27c84
commit 9ace532
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/products/pubsub/api.yaml b/products/pubsub/api.yaml
@@ -44,7 +44,9 @@ objects:
         name: 'kmsKeyName'
         description: |
           The resource name of the Cloud KMS CryptoKey to be used to protect access
-          to messsages published on this topic.
+          to messsages published on this topic. Your project's PubSub service account
+          (`service-{{PROJECT_NUMBER}}@gcp-sa-pubsub.iam.gserviceaccount.com`) must have
+          `roles/cloudkms.cryptoKeyEncrypterDecrypter` to use this feature.
           
           The expected format is `projects/*/locations/*/keyRings/*/cryptoKeys/*`
         input: true