gcloud kms encrypt

NAME
gcloud kms encrypt - encrypt a plaintext file using a key
SYNOPSIS
gcloud kms encrypt--ciphertext-file=CIPHERTEXT_FILE--plaintext-file=PLAINTEXT_FILE[--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE][--key=KEY][--keyring=KEYRING][--location=LOCATION][--skip-integrity-verification][--version=VERSION][GCLOUD_WIDE_FLAG …]
DESCRIPTION
Encrypts the given plaintext file using the given CryptoKey and writes theresult to the named ciphertext file. The plaintext file must not be larger than64KiB.

If an additional authenticated data file is provided, its contents must also beprovided during decryption. The file must not be larger than 64KiB.

The flag--version indicates the version of the key to use forencryption. By default, the primary version is used.

If--plaintext-file or--additional-authenticated-data-file is set to '-', that file isread from stdin. Similarly, if--ciphertext-file is set to '-', theciphertext is written to stdout.

By default, the command performs integrity verification on data sent to andreceived from Cloud KMS. Use--skip-integrity-verification todisable integrity verification.

EXAMPLES
The following command will read the file 'path/to/plaintext', encrypt it usingthe CryptoKeyfrodo with the KeyRingfellowship andLocationglobal, and write the ciphertext to 'path/to/ciphertext'.
gcloudkmsencrypt--key=frodo--keyring=fellowship--location=global--plaintext-file=path/to/input/plaintext--ciphertext-file=path/to/output/ciphertext
REQUIRED FLAGS
--ciphertext-file=CIPHERTEXT_FILE
File path of the ciphertext file to output.
--plaintext-file=PLAINTEXT_FILE
File path of the plaintext file to encrypt.
OPTIONAL FLAGS
--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE
File path to the optional file containing the additional authenticated data.
--key=KEY
The key to use for encryption.
--keyring=KEYRING
Key ring of the key.
--location=LOCATION
Location of the keyring.
--skip-integrity-verification
Skip integrity verification on request and response API fields.
--version=VERSION
Version to use for encryption.
GCLOUD WIDE FLAGS
These flags are available to all commands:--access-token-file,--account,--billing-project,--configuration,--flags-file,--flatten,--format,--help,--impersonate-service-account,--log-http,--project,--quiet,--trace-token,--user-output-enabled,--verbosity.

Run$gcloud help for details.

NOTES
These variants are also available:
gcloudalphakmsencrypt
gcloudbetakmsencrypt

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-05-07 UTC.