Add protection_level for resource google_kms_crypto_key

[kawsark]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

• The GCP Terraform Provider should allow creation of KMS keys with Protection Level of HSM or Software.
• Currently the GCP Terraform Provider only supports creating keys with Software protection level.
• The GCP API does support creating keys with HSM:
  • https://godoc.org/google.golang.org/api/cloudkms/v1#CryptoKeyVersion
  • https://godoc.org/google.golang.org/api/cloudkms/v1#CryptoKeyVersionTemplate

New or Affected Resource(s)

• google_kms_crypto_key

Potential Terraform Configuration

The GCP Terraform Provider should provide a protection_level option for creating keys with a specific protection_level. E.g:

resource "google_kms_crypto_key" "my_crypto_key" {
  name            = "my-crypto-key"
  key_ring        = "${google_kms_key_ring.my_key_ring.self_link}"
  rotation_period = "100000s"
  protection_level = “hsm”
}

References

• Provider code affected: https://github.com/terraform-providers/terraform-provider-google/blob/master/google/resource_kms_crypto_key.go#L91

[Bastiat99]

This would be a great help for deploying secure architectures. Tracking for progress.

[rileykarson]

This should be released in version 2.0.0 of the provider.

[Bastiat99]

Thanks, Riley.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!