import("context""fmt""io"kms"cloud.google.com/go/kms/apiv1""cloud.google.com/go/kms/apiv1/kmspb")// createKeyForImport creates a new asymmetric signing key in Cloud HSM.funccreateKeyForImport(wio.Writer,parent,idstring)error{// parent := "projects/my-project/locations/us-east1/keyRings/my-key-ring"// id := "my-imported-key"// Create the client.ctx:=context.Background()client,err:=kms.NewKeyManagementClient(ctx)iferr!=nil{returnfmt.Errorf("failed to create kms client: %w",err)}deferclient.Close()// Build the request.req:=&kmspb.CreateCryptoKeyRequest{Parent:parent,CryptoKeyId:id,CryptoKey:&kmspb.CryptoKey{Purpose:kmspb.CryptoKey_ASYMMETRIC_SIGN,VersionTemplate:&kmspb.CryptoKeyVersionTemplate{ProtectionLevel:kmspb.ProtectionLevel_HSM,Algorithm:kmspb.CryptoKeyVersion_EC_SIGN_P256_SHA256,},// Ensure that only imported versions may be added to this key.ImportOnly:true,},SkipInitialVersionCreation:true,}// Call the API.result,err:=client.CreateCryptoKey(ctx,req)iferr!=nil{returnfmt.Errorf("failed to create key: %w",err)}fmt.Fprintf(w,"Created key: %s\n",result.Name)returnnil}

importcom.google.cloud.kms.v1.CreateCryptoKeyRequest;importcom.google.cloud.kms.v1.CryptoKey;importcom.google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose;importcom.google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm;importcom.google.cloud.kms.v1.CryptoKeyVersionTemplate;importcom.google.cloud.kms.v1.KeyManagementServiceClient;importcom.google.cloud.kms.v1.KeyRingName;importcom.google.cloud.kms.v1.ProtectionLevel;importjava.io.IOException;publicclassCreateKeyForImport{publicvoidcreateKeyForImport()throwsIOException{// TODO(developer): Replace these variables before running the sample.StringprojectId="your-project-id";StringlocationId="us-east1";StringkeyRingId="my-key-ring";Stringid="my-import-key";createKeyForImport(projectId,locationId,keyRingId,id);}// Create a new crypto key to hold imported key versions.publicvoidcreateKeyForImport(StringprojectId,StringlocationId,StringkeyRingId,Stringid)throwsIOException{// Initialize client that will be used to send requests. This client only// needs to be created once, and can be reused for multiple requests. After// completing all of your requests, call the "close" method on the client to// safely clean up any remaining background resources.try(KeyManagementServiceClientclient=KeyManagementServiceClient.create()){// Build the parent name from the project, location, and key ring.KeyRingNamekeyRingName=KeyRingName.of(projectId,locationId,keyRingId);// Create the crypto key.CryptoKeycreatedKey=client.createCryptoKey(CreateCryptoKeyRequest.newBuilder().setParent(keyRingName.toString()).setCryptoKeyId(id).setCryptoKey(CryptoKey.newBuilder().setPurpose(CryptoKeyPurpose.ASYMMETRIC_SIGN).setVersionTemplate(CryptoKeyVersionTemplate.newBuilder().setProtectionLevel(ProtectionLevel.HSM).setAlgorithm(CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256))// Ensure that only imported versions may be// added to this key..setImportOnly(true)).setSkipInitialVersionCreation(true).build());System.out.printf("Created crypto key %s%n",createdKey.getName());}}}

//// TODO(developer): Uncomment these variables before running the sample.//// const projectId = 'my-project';// const locationId = 'us-east1';// const keyRingId = 'my-key-ring';// const id = 'my-imported-key';// Imports the Cloud KMS libraryconst{KeyManagementServiceClient}=require('@google-cloud/kms');// Instantiates a clientconstclient=newKeyManagementServiceClient();// Build the parent key ring nameconstkeyRingName=client.keyRingPath(projectId,locationId,keyRingId);asyncfunctioncreateKeyForImport(){const[key]=awaitclient.createCryptoKey({parent:keyRingName,cryptoKeyId:id,cryptoKey:{purpose:'ENCRYPT_DECRYPT',versionTemplate:{algorithm:'GOOGLE_SYMMETRIC_ENCRYPTION',protectionLevel:'HSM',},// Optional: ensure that only imported versions may be added to this// key.importOnly:true,},// Do not allow KMS to generate an initial version of this key.skipInitialVersionCreation:true,});console.log(`Created key for import:${key.name}`);returnkey;}returncreateKeyForImport();

fromgoogle.cloudimportkmsdefcreate_key_for_import(project_id:str,location_id:str,key_ring_id:str,crypto_key_id:str)->None:"""    Sets up an empty CryptoKey within a KeyRing for import.    Args:        project_id (string): Google Cloud project ID (e.g. 'my-project').        location_id (string): Cloud KMS location (e.g. 'us-east1').        key_ring_id (string): ID of the Cloud KMS key ring (e.g. 'my-key-ring').        crypto_key_id (string): ID of the key to import (e.g. 'my-asymmetric-signing-key').    """# Create the client.client=kms.KeyManagementServiceClient()# Build the key. For more information regarding allowed values of these fields, see:# https://googleapis.dev/python/cloudkms/latest/_modules/google/cloud/kms_v1/types/resources.htmlpurpose=kms.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGNalgorithm=kms.CryptoKeyVersion.CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256protection_level=kms.ProtectionLevel.HSMkey={"purpose":purpose,"version_template":{"algorithm":algorithm,"protection_level":protection_level,},}# Build the parent key ring name.key_ring_name=client.key_ring_path(project_id,location_id,key_ring_id)# Call the API.created_key=client.create_crypto_key(request={"parent":key_ring_name,"crypto_key_id":crypto_key_id,"crypto_key":key,# Do not allow KMS to generate an initial version of this key."skip_initial_version_creation":True,})print(f"Created hsm key:{created_key.name}")

import("context""fmt""io"kms"cloud.google.com/go/kms/apiv1""cloud.google.com/go/kms/apiv1/kmspb")// createImportJob creates a new job for importing keys into KMS.funccreateImportJob(wio.Writer,parent,idstring)error{// parent := "projects/PROJECT_ID/locations/global/keyRings/my-key-ring"// id := "my-import-job"// Create the client.ctx:=context.Background()client,err:=kms.NewKeyManagementClient(ctx)iferr!=nil{returnfmt.Errorf("failed to create kms client: %w",err)}deferclient.Close()// Build the request.req:=&kmspb.CreateImportJobRequest{Parent:parent,ImportJobId:id,ImportJob:&kmspb.ImportJob{// See allowed values and their descriptions at// https://cloud.google.com/kms/docs/algorithms#protection_levelsProtectionLevel:kmspb.ProtectionLevel_HSM,// See allowed values and their descriptions at// https://cloud.google.com/kms/docs/key-wrapping#import_methodsImportMethod:kmspb.ImportJob_RSA_OAEP_3072_SHA1_AES_256,},}// Call the API.result,err:=client.CreateImportJob(ctx,req)iferr!=nil{returnfmt.Errorf("failed to create import job: %w",err)}fmt.Fprintf(w,"Created import job: %s\n",result.Name)returnnil}

importcom.google.cloud.kms.v1.ImportJob;importcom.google.cloud.kms.v1.ImportJob.ImportMethod;importcom.google.cloud.kms.v1.KeyManagementServiceClient;importcom.google.cloud.kms.v1.KeyRingName;importcom.google.cloud.kms.v1.ProtectionLevel;importjava.io.IOException;publicclassCreateImportJob{publicvoidcreateImportJob()throwsIOException{// TODO(developer): Replace these variables before running the sample.StringprojectId="your-project-id";StringlocationId="us-east1";StringkeyRingId="my-key-ring";Stringid="my-import-job";createImportJob(projectId,locationId,keyRingId,id);}// Create a new import job.publicvoidcreateImportJob(StringprojectId,StringlocationId,StringkeyRingId,Stringid)throwsIOException{// Initialize client that will be used to send requests. This client only// needs to be created once, and can be reused for multiple requests. After// completing all of your requests, call the "close" method on the client to// safely clean up any remaining background resources.try(KeyManagementServiceClientclient=KeyManagementServiceClient.create()){// Build the parent name from the project, location, and key ring.KeyRingNamekeyRingName=KeyRingName.of(projectId,locationId,keyRingId);// Build the import job to create, with parameters.ImportJobimportJob=ImportJob.newBuilder()// See allowed values and their descriptions at// https://cloud.google.com/kms/docs/algorithms#protection_levels.setProtectionLevel(ProtectionLevel.HSM)// See allowed values and their descriptions at// https://cloud.google.com/kms/docs/key-wrapping#import_methods.setImportMethod(ImportMethod.RSA_OAEP_3072_SHA1_AES_256).build();// Create the import job.ImportJobcreatedImportJob=client.createImportJob(keyRingName,id,importJob);System.out.printf("Created import job %s%n",createdImportJob.getName());}}}

//// TODO(developer): Uncomment these variables before running the sample.//// const projectId = 'my-project';// const locationId = 'us-east1';// const keyRingId = 'my-key-ring';// const id = 'my-import-job';// Imports the Cloud KMS libraryconst{KeyManagementServiceClient}=require('@google-cloud/kms');// Instantiates a clientconstclient=newKeyManagementServiceClient();// Build the parent key ring nameconstkeyRingName=client.keyRingPath(projectId,locationId,keyRingId);asyncfunctioncreateImportJob(){const[importJob]=awaitclient.createImportJob({parent:keyRingName,importJobId:id,importJob:{protectionLevel:'HSM',importMethod:'RSA_OAEP_3072_SHA256',},});console.log(`Created import job:${importJob.name}`);returnimportJob;}returncreateImportJob();

fromgoogle.cloudimportkmsdefcreate_import_job(project_id:str,location_id:str,key_ring_id:str,import_job_id:str)->None:"""    Create a new import job in Cloud KMS.    Args:        project_id (string): Google Cloud project ID (e.g. 'my-project').        location_id (string): Cloud KMS location (e.g. 'us-east1').        key_ring_id (string): ID of the Cloud KMS key ring (e.g. 'my-key-ring').        import_job_id (string): ID of the import job (e.g. 'my-import-job').    """# Create the client.client=kms.KeyManagementServiceClient()# Retrieve the fully-qualified key_ring string.key_ring_name=client.key_ring_path(project_id,location_id,key_ring_id)# Set paramaters for the import job, allowed values for ImportMethod and ProtectionLevel found here:# https://googleapis.dev/python/cloudkms/latest/_modules/google/cloud/kms_v1/types/resources.htmlimport_method=kms.ImportJob.ImportMethod.RSA_OAEP_3072_SHA1_AES_256protection_level=kms.ProtectionLevel.HSMimport_job_params={"import_method":import_method,"protection_level":protection_level,}# Call the client to create a new import job.import_job=client.create_import_job({"parent":key_ring_name,"import_job_id":import_job_id,"import_job":import_job_params,})print(f"Created import job:{import_job.name}")

import("context""fmt""io"kms"cloud.google.com/go/kms/apiv1""cloud.google.com/go/kms/apiv1/kmspb")// checkStateImportJob checks the state of an ImportJob in KMS.funccheckStateImportJob(wio.Writer,namestring)error{// name := "projects/PROJECT_ID/locations/global/keyRings/my-key-ring/importJobs/my-import-job"// Create the client.ctx:=context.Background()client,err:=kms.NewKeyManagementClient(ctx)iferr!=nil{returnfmt.Errorf("failed to create kms client: %w",err)}deferclient.Close()// Call the API.result,err:=client.GetImportJob(ctx,&kmspb.GetImportJobRequest{Name:name,})iferr!=nil{returnfmt.Errorf("failed to get import job: %w",err)}fmt.Fprintf(w,"Current state of import job %q: %s\n",result.Name,result.State)returnnil}

importcom.google.cloud.kms.v1.ImportJob;importcom.google.cloud.kms.v1.ImportJobName;importcom.google.cloud.kms.v1.KeyManagementServiceClient;importjava.io.IOException;publicclassCheckStateImportJob{publicvoidcheckStateImportJob()throwsIOException{// TODO(developer): Replace these variables before running the sample.StringprojectId="your-project-id";StringlocationId="us-east1";StringkeyRingId="my-key-ring";StringimportJobId="my-import-job";checkStateImportJob(projectId,locationId,keyRingId,importJobId);}// Check the state of an import job in Cloud KMS.publicvoidcheckStateImportJob(StringprojectId,StringlocationId,StringkeyRingId,StringimportJobId)throwsIOException{// Initialize client that will be used to send requests. This client only// needs to be created once, and can be reused for multiple requests. After// completing all of your requests, call the "close" method on the client to// safely clean up any remaining background resources.try(KeyManagementServiceClientclient=KeyManagementServiceClient.create()){// Build the parent name from the project, location, and key ring.ImportJobNameimportJobName=ImportJobName.of(projectId,locationId,keyRingId,importJobId);// Retrieve the state of an existing import job.ImportJobimportJob=client.getImportJob(importJobName);System.out.printf("Current state of import job %s: %s%n",importJob.getName(),importJob.getState());}}}

//// TODO(developer): Uncomment these variables before running the sample.//// const projectId = 'my-project';// const locationId = 'us-east1';// const keyRingId = 'my-key-ring';// const importJobId = 'my-import-job';// Imports the Cloud KMS libraryconst{KeyManagementServiceClient}=require('@google-cloud/kms');// Instantiates a clientconstclient=newKeyManagementServiceClient();// Build the import job nameconstimportJobName=client.importJobPath(projectId,locationId,keyRingId,importJobId);asyncfunctioncheckStateImportJob(){const[importJob]=awaitclient.getImportJob({name:importJobName,});console.log(`Current state of import job${importJob.name}:${importJob.state}`);returnimportJob;}returncheckStateImportJob();

fromgoogle.cloudimportkmsdefcheck_state_import_job(project_id:str,location_id:str,key_ring_id:str,import_job_id:str)->None:"""    Check the state of an import job in Cloud KMS.    Args:        project_id (string): Google Cloud project ID (e.g. 'my-project').        location_id (string): Cloud KMS location (e.g. 'us-east1').        key_ring_id (string): ID of the Cloud KMS key ring (e.g. 'my-key-ring').        import_job_id (string): ID of the import job (e.g. 'my-import-job').    """# Create the client.client=kms.KeyManagementServiceClient()# Retrieve the fully-qualified import_job string.import_job_name=client.import_job_path(project_id,location_id,key_ring_id,import_job_id)# Retrieve the state from an existing import job.import_job=client.get_import_job(name=import_job_name)print(f"Current state of import job{import_job.name}:{import_job.state}")

import("context""crypto/ecdsa""crypto/elliptic""crypto/rand""crypto/rsa""crypto/sha1""crypto/x509""encoding/pem""fmt""io"kms"cloud.google.com/go/kms/apiv1""cloud.google.com/go/kms/apiv1/kmspb""github.com/google/tink/go/kwp/subtle")// importManuallyWrappedKey wraps key material and imports it into KMS.funcimportManuallyWrappedKey(wio.Writer,importJobName,cryptoKeyNamestring)error{// importJobName := "projects/PROJECT_ID/locations/global/keyRings/my-key-ring/importJobs/my-import-job"// cryptoKeyName := "projects/PROJECT_ID/locations/global/keyRings/my-key-ring/cryptoKeys/my-imported-key"// Generate a ECDSA keypair, and format the private key as PKCS #8 DER.key,err:=ecdsa.GenerateKey(elliptic.P256(),rand.Reader)iferr!=nil{returnfmt.Errorf("failed to generate keypair: %w",err)}keyBytes,err:=x509.MarshalPKCS8PrivateKey(key)iferr!=nil{returnfmt.Errorf("failed to format private key: %w",err)}// Create the client.ctx:=context.Background()client,err:=kms.NewKeyManagementClient(ctx)iferr!=nil{returnfmt.Errorf("failed to create kms client: %w",err)}deferclient.Close()// Generate a temporary 32-byte key for AES-KWP and wrap the key material.kwpKey:=make([]byte,32)if_,err:=rand.Read(kwpKey);err!=nil{returnfmt.Errorf("failed to generate AES-KWP key: %w",err)}kwp,err:=subtle.NewKWP(kwpKey)iferr!=nil{returnfmt.Errorf("failed to create KWP cipher: %w",err)}wrappedTarget,err:=kwp.Wrap(keyBytes)iferr!=nil{returnfmt.Errorf("failed to wrap target key with KWP: %w",err)}// Retrieve the public key from the import job.importJob,err:=client.GetImportJob(ctx,&kmspb.GetImportJobRequest{Name:importJobName,})iferr!=nil{returnfmt.Errorf("failed to retrieve import job: %w",err)}pubBlock,_:=pem.Decode([]byte(importJob.PublicKey.Pem))pubAny,err:=x509.ParsePKIXPublicKey(pubBlock.Bytes)iferr!=nil{returnfmt.Errorf("failed to parse import job public key: %w",err)}pub,ok:=pubAny.(*rsa.PublicKey)if!ok{returnfmt.Errorf("unexpected public key type %T, want *rsa.PublicKey",pubAny)}// Wrap the KWP key using the import job key.wrappedWrappingKey,err:=rsa.EncryptOAEP(sha1.New(),rand.Reader,pub,kwpKey,nil)iferr!=nil{returnfmt.Errorf("failed to wrap KWP key: %w",err)}// Concatenate the wrapped KWP key and the wrapped target key.combined:=append(wrappedWrappingKey,wrappedTarget...)// Build the request.req:=&kmspb.ImportCryptoKeyVersionRequest{Parent:cryptoKeyName,ImportJob:importJobName,Algorithm:kmspb.CryptoKeyVersion_EC_SIGN_P256_SHA256,WrappedKey:combined,}// Call the API.result,err:=client.ImportCryptoKeyVersion(ctx,req)iferr!=nil{returnfmt.Errorf("failed to import crypto key version: %w",err)}fmt.Fprintf(w,"Created crypto key version: %s\n",result.Name)returnnil}

importcom.google.cloud.kms.v1.CryptoKeyName;importcom.google.cloud.kms.v1.CryptoKeyVersion;importcom.google.cloud.kms.v1.ImportCryptoKeyVersionRequest;importcom.google.cloud.kms.v1.ImportJob;importcom.google.cloud.kms.v1.ImportJobName;importcom.google.cloud.kms.v1.KeyManagementServiceClient;importcom.google.crypto.tink.subtle.Kwp;importcom.google.protobuf.ByteString;importjava.io.IOException;importjava.security.GeneralSecurityException;importjava.security.KeyFactory;importjava.security.KeyPair;importjava.security.KeyPairGenerator;importjava.security.PublicKey;importjava.security.SecureRandom;importjava.security.spec.ECGenParameterSpec;importjava.security.spec.MGF1ParameterSpec;importjava.security.spec.X509EncodedKeySpec;importjava.util.Base64;importjavax.crypto.Cipher;importjavax.crypto.spec.OAEPParameterSpec;importjavax.crypto.spec.PSource;publicclassImportManuallyWrappedKey{publicvoidimportManuallyWrappedKey()throwsGeneralSecurityException,IOException{// TODO(developer): Replace these variables before running the sample.StringprojectId="your-project-id";StringlocationId="us-east1";StringkeyRingId="my-key-ring";StringcryptoKeyId="my-crypto-key";StringimportJobId="my-import-job";importManuallyWrappedKey(projectId,locationId,keyRingId,cryptoKeyId,importJobId);}// Generates and imports local key material into Cloud KMS.publicvoidimportManuallyWrappedKey(StringprojectId,StringlocationId,StringkeyRingId,StringcryptoKeyId,StringimportJobId)throwsGeneralSecurityException,IOException{// Generate a new ECDSA keypair, and format the private key as PKCS #8 DER.KeyPairGeneratorgenerator=KeyPairGenerator.getInstance("EC");generator.initialize(newECGenParameterSpec("secp256r1"));KeyPairkp=generator.generateKeyPair();byte[]privateBytes=kp.getPrivate().getEncoded();// Initialize client that will be used to send requests. This client only// needs to be created once, and can be reused for multiple requests. After// completing all of your requests, call the "close" method on the client to// safely clean up any remaining background resources.try(KeyManagementServiceClientclient=KeyManagementServiceClient.create()){// Build the crypto key and import job names from the project, location,// key ring, and ID.finalCryptoKeyNamecryptoKeyName=CryptoKeyName.of(projectId,locationId,keyRingId,cryptoKeyId);finalImportJobNameimportJobName=ImportJobName.of(projectId,locationId,keyRingId,importJobId);// Generate a temporary 32-byte key for AES-KWP and wrap the key material.byte[]kwpKey=newbyte[32];newSecureRandom().nextBytes(kwpKey);Kwpkwp=newKwp(kwpKey);finalbyte[]wrappedTargetKey=kwp.wrap(privateBytes);// Retrieve the public key from the import job.ImportJobimportJob=client.getImportJob(importJobName);StringpublicKeyStr=importJob.getPublicKey().getPem();// Manually convert PEM to DER. :-(publicKeyStr=publicKeyStr.replace("-----BEGIN PUBLIC KEY-----","");publicKeyStr=publicKeyStr.replace("-----END PUBLIC KEY-----","");publicKeyStr=publicKeyStr.replaceAll("\n","");byte[]publicKeyBytes=Base64.getDecoder().decode(publicKeyStr);PublicKeypublicKey=KeyFactory.getInstance("RSA").generatePublic(newX509EncodedKeySpec(publicKeyBytes));// Wrap the KWP key using the import job key.Ciphercipher=Cipher.getInstance("RSA/ECB/OAEPWithSHA-1AndMGF1Padding");cipher.init(Cipher.ENCRYPT_MODE,publicKey,newOAEPParameterSpec("SHA-1","MGF1",MGF1ParameterSpec.SHA1,PSource.PSpecified.DEFAULT));byte[]wrappedWrappingKey=cipher.doFinal(kwpKey);// Concatenate the wrapped KWP key and the wrapped target key.ByteStringcombinedWrappedKeys=ByteString.copyFrom(wrappedWrappingKey).concat(ByteString.copyFrom(wrappedTargetKey));// Import the wrapped key material.CryptoKeyVersionversion=client.importCryptoKeyVersion(ImportCryptoKeyVersionRequest.newBuilder().setParent(cryptoKeyName.toString()).setImportJob(importJobName.toString()).setAlgorithm(CryptoKeyVersion.CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256).setRsaAesWrappedKey(combinedWrappedKeys).build());System.out.printf("Imported: %s%n",version.getName());}}}

//// TODO(developer): Uncomment these variables before running the sample.//// const projectId = 'my-project';// const locationId = 'us-east1';// const keyRingId = 'my-key-ring';// const cryptoKeyId = 'my-imported-key';// const importJobId = 'my-import-job';// Imports the Cloud KMS libraryconst{KeyManagementServiceClient}=require('@google-cloud/kms');// Instantiates a clientconstclient=newKeyManagementServiceClient();// Build the crypto key and importjob resource namesconstcryptoKeyName=client.cryptoKeyPath(projectId,locationId,keyRingId,cryptoKeyId);constimportJobName=client.importJobPath(projectId,locationId,keyRingId,importJobId);asyncfunctionwrapAndImportKey(){// Generate a 32-byte key to import.constcrypto=require('crypto');consttargetKey=crypto.randomBytes(32);const[importJob]=awaitclient.getImportJob({name:importJobName});// Wrap the target key using the import job keyconstwrappedTargetKey=crypto.publicEncrypt({key:importJob.publicKey.pem,oaepHash:'sha256',padding:crypto.constants.RSA_PKCS1_OAEP_PADDING,},targetKey);// Import the target key versionconst[version]=awaitclient.importCryptoKeyVersion({parent:cryptoKeyName,importJob:importJobName,algorithm:'GOOGLE_SYMMETRIC_ENCRYPTION',wrappedKey:wrappedTargetKey,});console.log(`Imported key version:${version.name}`);returnversion;}returnwrapAndImportKey();

importos# Import the client library and Python standard cryptographic libraries.fromcryptography.hazmatimportbackendsfromcryptography.hazmat.primitivesimporthashesfromcryptography.hazmat.primitivesimportkeywrapfromcryptography.hazmat.primitivesimportserializationfromcryptography.hazmat.primitives.asymmetricimportecfromcryptography.hazmat.primitives.asymmetricimportpaddingfromgoogle.cloudimportkmsdefimport_manually_wrapped_key(project_id:str,location_id:str,key_ring_id:str,crypto_key_id:str,import_job_id:str,)->None:"""    Generates and imports local key material to Cloud KMS.    Args:        project_id (string): Google Cloud project ID (e.g. 'my-project').        location_id (string): Cloud KMS location (e.g. 'us-east1').        key_ring_id (string): ID of the Cloud KMS key ring (e.g. 'my-key-ring').        crypto_key_id (string): ID of the key to import (e.g. 'my-asymmetric-signing-key').        import_job_id (string): ID of the import job (e.g. 'my-import-job').    """# Generate some key material in Python and format it in PKCS #8 DER as# required by Google Cloud KMS.key=ec.generate_private_key(ec.SECP256R1,backends.default_backend())formatted_key=key.private_bytes(serialization.Encoding.DER,serialization.PrivateFormat.PKCS8,serialization.NoEncryption(),)print(f"Generated key bytes:{formatted_key!r}")# Create the client.client=kms.KeyManagementServiceClient()# Retrieve the fully-qualified crypto_key and import_job string.crypto_key_name=client.crypto_key_path(project_id,location_id,key_ring_id,crypto_key_id)import_job_name=client.import_job_path(project_id,location_id,key_ring_id,import_job_id)# Generate a temporary 32-byte key for AES-KWP and wrap the key material.kwp_key=os.urandom(32)wrapped_target_key=keywrap.aes_key_wrap_with_padding(kwp_key,formatted_key,backends.default_backend())# Retrieve the public key from the import job.import_job=client.get_import_job(name=import_job_name)import_job_pub=serialization.load_pem_public_key(bytes(import_job.public_key.pem,"UTF-8"),backends.default_backend())# Wrap the KWP key using the import job key.wrapped_kwp_key=import_job_pub.encrypt(kwp_key,padding.OAEP(mgf=padding.MGF1(algorithm=hashes.SHA1()),algorithm=hashes.SHA1(),label=None,),)# Import the wrapped key material.client.import_crypto_key_version({"parent":crypto_key_name,"import_job":import_job_name,"algorithm":kms.CryptoKeyVersion.CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256,"rsa_aes_wrapped_key":wrapped_kwp_key+wrapped_target_key,})print(f"Imported:{import_job.name}")

import("context""fmt""io"kms"cloud.google.com/go/kms/apiv1""cloud.google.com/go/kms/apiv1/kmspb")// checkStateImportedKey checks the state of a CryptoKeyVersion in KMS.funccheckStateImportedKey(wio.Writer,namestring)error{// name := "projects/PROJECT_ID/locations/global/keyRings/my-key-ring/cryptoKeys/my-imported-key/cryptoKeyVersions/1"// Create the client.ctx:=context.Background()client,err:=kms.NewKeyManagementClient(ctx)iferr!=nil{returnfmt.Errorf("failed to create kms client: %w",err)}deferclient.Close()// Call the API.result,err:=client.GetCryptoKeyVersion(ctx,&kmspb.GetCryptoKeyVersionRequest{Name:name,})iferr!=nil{returnfmt.Errorf("failed to get crypto key version: %w",err)}fmt.Fprintf(w,"Current state of crypto key version %q: %s\n",result.Name,result.State)returnnil}

importcom.google.cloud.kms.v1.CryptoKeyVersion;importcom.google.cloud.kms.v1.CryptoKeyVersionName;importcom.google.cloud.kms.v1.KeyManagementServiceClient;importjava.io.IOException;publicclassCheckStateImportedKey{publicvoidcheckStateImportedKey()throwsIOException{// TODO(developer): Replace these variables before running the sample.StringprojectId="your-project-id";StringlocationId="us-east1";StringkeyRingId="my-key-ring";StringcryptoKeyId="my-crypto-key";StringcryptoKeyVersionId="1";checkStateImportedKey(projectId,locationId,keyRingId,cryptoKeyId,cryptoKeyVersionId);}// Check the state of an imported key in Cloud KMS.publicvoidcheckStateImportedKey(StringprojectId,StringlocationId,StringkeyRingId,StringcryptoKeyId,StringcryptoKeyVersionId)throwsIOException{// Initialize client that will be used to send requests. This client only// needs to be created once, and can be reused for multiple requests. After// completing all of your requests, call the "close" method on the client to// safely clean up any remaining background resources.try(KeyManagementServiceClientclient=KeyManagementServiceClient.create()){// Build the version name from its path components.CryptoKeyVersionNameversionName=CryptoKeyVersionName.of(projectId,locationId,keyRingId,cryptoKeyId,cryptoKeyVersionId);// Retrieve the state of an existing version.CryptoKeyVersionversion=client.getCryptoKeyVersion(versionName);System.out.printf("Current state of crypto key version %s: %s%n",version.getName(),version.getState());}}}

//// TODO(developer): Uncomment these variables before running the sample.//// const projectId = 'my-project';// const locationId = 'us-east1';// const keyRingId = 'my-key-ring';// const cryptoKeyId = 'my-imported-key';// const cryptoKeyVersionId = '1';// Imports the Cloud KMS libraryconst{KeyManagementServiceClient}=require('@google-cloud/kms');// Instantiates a clientconstclient=newKeyManagementServiceClient();// Build the key version nameconstkeyVersionName=client.cryptoKeyVersionPath(projectId,locationId,keyRingId,cryptoKeyId,cryptoKeyVersionId);asyncfunctioncheckStateCryptoKeyVersion(){const[keyVersion]=awaitclient.getCryptoKeyVersion({name:keyVersionName,});console.log(`Current state of key version${keyVersion.name}:${keyVersion.state}`);returnkeyVersion;}returncheckStateCryptoKeyVersion();

fromgoogle.cloudimportkmsdefcheck_state_imported_key(project_id:str,location_id:str,key_ring_id:str,import_job_id:str)->None:"""    Check the state of an import job in Cloud KMS.    Args:        project_id (string): Google Cloud project ID (e.g. 'my-project').        location_id (string): Cloud KMS location (e.g. 'us-east1').        key_ring_id (string): ID of the Cloud KMS key ring (e.g. 'my-key-ring').        import_job_id (string): ID of the import job (e.g. 'my-import-job').    """# Create the client.client=kms.KeyManagementServiceClient()# Retrieve the fully-qualified import_job string.import_job_name=client.import_job_path(project_id,location_id,key_ring_id,import_job_id)# Retrieve the state from an existing import job.import_job=client.get_import_job(name=import_job_name)print(f"Current state of import job{import_job.name}:{import_job.state}")