Class ImportJob (2.0.1)

ImportJob(mapping=None,*,ignore_unknown_fields=False,**kwargs)

AnImportJob can be used to createCryptoKeys andCryptoKeyVersions usingpre-existing key material, generated outside of Cloud KMS.

When anImportJob is created, CloudKMS will generate a "wrapping key", which is a public/private keypair. You use the wrapping key to encrypt (also known as wrap) thepre-existing key material to protect it during the import process.The nature of the wrapping key depends on the choice ofimport_method. Whenthe wrapping key generation is complete, thestate will be set toACTIVE andthepublic_key can befetched. The fetched public key can then be used to wrap yourpre-existing key material.

Once the key material is wrapped, it can be imported into a newCryptoKeyVersion in anexistingCryptoKey by callingImportCryptoKeyVersion.MultipleCryptoKeyVersionscan be imported with a singleImportJob. Cloud KMS uses theprivate key portion of the wrapping key to unwrap the key material.Only Cloud KMS has access to the private key.

AnImportJob expires 3 days afterit is created. Once expired, Cloud KMS will no longer be able toimport or unwrap any key material that was wrapped with theImportJob's public key.

For more information, seeImporting akey <https://cloud.google.com/kms/docs/importing-a-key>__.

Attributes

NameDescription
namestr
Output only. The resource name for thisImportJob in the formatprojects/*/locations/*/keyRings/*/importJobs/*.
import_method.resources.ImportJob.ImportMethod
Required. Immutable. The wrapping method to be used for incoming key material.
protection_level.resources.ProtectionLevel
Required. Immutable. The protection level of theImportJob. This must match theprotection_level of theversion_template on theCryptoKey you attempt to import into.
create_time.timestamp.Timestamp
Output only. The time at which thisImportJob was created.
generate_time.timestamp.Timestamp
Output only. The time thisImportJob's key material was generated.
expire_time.timestamp.Timestamp
Output only. The time at which thisImportJob is scheduled for expiration and can no longer be used to import key material.
expire_event_time.timestamp.Timestamp
Output only. The time thisImportJob expired. Only present ifstate isEXPIRED.
state.resources.ImportJob.ImportJobState
Output only. The current state of theImportJob, indicating if it can be used.
public_key.resources.ImportJob.WrappingPublicKey
Output only. The public key with which to wrap key material prior to import. Only returned ifstate isACTIVE.
attestation.resources.KeyOperationAttestation
Output only. Statement that was generated and signed by the key creator (for example, an HSM) at key creation time. Use this statement to verify attributes of the key as stored on the HSM, independently of Google. Only present if the chosenImportMethod is one with a protection level ofHSM.

Classes

ImportJobState

ImportJobState(value)

The state of theImportJob,indicating if it can be used.

ImportMethod

ImportMethod(value)

ImportMethod describesthe key wrapping method chosen for thisImportJob.

WrappingPublicKey

WrappingPublicKey(mapping=None,*,ignore_unknown_fields=False,**kwargs)

The public key component of the wrapping key. For details of thetype of key this public key corresponds to, see theImportMethod.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-11-13 UTC.