Google Cloud KMS
Google CloudOAuth 2.0Connection test available
Encrypt, decrypt and sign with Cloud KMS keys (Google OAuth2).
OCNORA ships 72 typed Google Cloud KMS operations. Each node has a schema-driven form, input and output tables beside its settings, and is pre-flighted by Workflow Health before your first real run.
Before you connect Google Cloud KMS
- Authentication
- OAuth 2.0
- Credential
- {"client_id", "client_secret", "refresh_token"}
- Connection test
- Available: the stored credential can be checked against the provider when you add it. This is not a record that a test was run or passed.
What you can do with Google Cloud KMS
Operations, grouped by what they do to your data.
Create and send 12
Read and search 29
Update 12
Delete and cancel 4
A sample Google Cloud KMS workflow
- 1A core triggerStart the run from a chat, form, manual, schedule, webhook, workflow trigger — no Google Cloud KMS trigger is needed.
- 2Export Trusted Key Wrapped Crypto Key Version Crypto Key Versioncloud_kms.export_trusted_key_wrapped_crypto_key_version_crypto_key_versionExports a CryptoKeyVersion with a trusted key.
- 3Approve Proposalcloud_kms.approve_proposalApproves a SingleTenantHsmInstanceProposal for a given SingleTenantHsmInstance.
An outline built from this provider’s node contracts, not a recorded run. Each step’s output fields are available to the next in the field picker.
Every node below has a reference page: what it does, the connection it needs, its config fields with types, constraints and examples, and the shapes it emits.
Operations 72
- Approve ProposalApproves a SingleTenantHsmInstanceProposal for a given SingleTenantHsmInstance.cloud_kms.approve_proposal
- Asymmetric Decrypt Crypto Key VersionDecrypts data that was encrypted with a public key retrieved from GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose ASYMMETRIC_DECRYPT.cloud_kms.asymmetric_decrypt_crypto_key_version
- Create Crypto KeyCreate a new CryptoKey within a KeyRing.cloud_kms.create_crypto_key
- Create Crypto Key VersionCreate a new CryptoKeyVersion in a CryptoKey.cloud_kms.create_crypto_key_version
- Create Ekm ConnectionCreates a new EkmConnection in a given Project and Location.cloud_kms.create_ekm_connection
- Create Import JobCreate a new ImportJob within a KeyRing.cloud_kms.create_import_job
- Create Key HandleCreates a new KeyHandle, triggering the provisioning of a new CryptoKey for CMEK use with the given resource type in the configured key project and the same location.cloud_kms.create_key_handle
- Create Key RingCreate a new KeyRing in a given Project and Location.cloud_kms.create_key_ring
- Create ProposalCreates a new SingleTenantHsmInstanceProposal for a given SingleTenantHsmInstance.cloud_kms.create_proposal
- Create Single Tenant Hsm InstanceCreates a new SingleTenantHsmInstance in a given Project and Location.cloud_kms.create_single_tenant_hsm_instance
- Decapsulate Crypto Key VersionDecapsulates data that was encapsulated with a public key retrieved from GetPublicKey corresponding to a CryptoKeyVersion with CryptoKey.purpose KEY_ENCAPSULATION.cloud_kms.decapsulate_crypto_key_version
- DecryptDecrypt base64 ciphertext with a Cloud KMS symmetric key; emits text.cloud_kms.decrypt
- Delete Crypto KeyPermanently deletes the given CryptoKey.cloud_kms.delete_crypto_key
- Delete Crypto Key VersionPermanently deletes the given CryptoKeyVersion.cloud_kms.delete_crypto_key_version
- Delete Key RingPermanently deletes the given KeyRing.cloud_kms.delete_key_ring
- Delete ProposalDeletes a SingleTenantHsmInstanceProposal.cloud_kms.delete_proposal
- Destroy Crypto Key VersionSchedule a CryptoKeyVersion for destruction.cloud_kms.destroy_crypto_key_version
- EncryptEncrypt text with a Cloud KMS symmetric key; emits base64 ciphertext.cloud_kms.encrypt
- Execute ProposalExecutes a SingleTenantHsmInstanceProposal for a given SingleTenantHsmInstance.cloud_kms.execute_proposal
- Export Trusted Key Wrapped Crypto Key Version Crypto Key VersionExports a CryptoKeyVersion with a trusted key.cloud_kms.export_trusted_key_wrapped_crypto_key_version_crypto_key_version
- Generate Random Bytes LocationGenerate random bytes using the Cloud KMS randomness source in the provided location.cloud_kms.generate_random_bytes_location
- Get Autokey Config FolderReturns the AutokeyConfig for a folder or project.cloud_kms.get_autokey_config_folder
- Get Autokey Config ProjectReturns the AutokeyConfig for a folder or project.cloud_kms.get_autokey_config_project
- Get Crypto KeyReturns metadata for a given CryptoKey, as well as its primary CryptoKeyVersion.cloud_kms.get_crypto_key
- Get Crypto Key VersionReturns metadata for a given CryptoKeyVersion.cloud_kms.get_crypto_key_version
- Get Ekm Config LocationReturns the EkmConfig singleton resource for a given project and location.cloud_kms.get_ekm_config_location
- Get Ekm ConnectionReturns metadata for a given EkmConnection.cloud_kms.get_ekm_connection
- Get Import JobReturns metadata for a given ImportJob.cloud_kms.get_import_job
- Get Kaj Policy Config FolderGets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.cloud_kms.get_kaj_policy_config_folder
- Get Kaj Policy Config OrganizationGets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.cloud_kms.get_kaj_policy_config_organization
- Get Kaj Policy Config ProjectGets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.cloud_kms.get_kaj_policy_config_project
- Get Key HandleReturns the KeyHandle.cloud_kms.get_key_handle
- Get Key RingReturns metadata for a given KeyRing.cloud_kms.get_key_ring
- Get LocationGets information about a location.cloud_kms.get_location
- Get OperationGets the latest state of a long-running operation.cloud_kms.get_operation
- Get ProposalReturns metadata for a given SingleTenantHsmInstanceProposal.cloud_kms.get_proposal
- Get Public Key Crypto Key VersionReturns the public key for the given CryptoKeyVersion.cloud_kms.get_public_key_crypto_key_version
- Get Retired ResourceRetrieves a specific RetiredResource resource, which represents the record of a deleted CryptoKey.cloud_kms.get_retired_resource
- Get Single Tenant Hsm InstanceReturns metadata for a given SingleTenantHsmInstance.cloud_kms.get_single_tenant_hsm_instance
- Import Crypto Key VersionImport wrapped key material into a CryptoKeyVersion.cloud_kms.import_crypto_key_version
- Import Trusted Key Wrapped Crypto Key Version Crypto Key VersionImport wrapped key material into a CryptoKeyVersion with a trusted key.cloud_kms.import_trusted_key_wrapped_crypto_key_version_crypto_key_version
- List Crypto Key VersionsLists CryptoKeyVersions.cloud_kms.list_crypto_key_versions
- List Ekm ConnectionsLists EkmConnections.cloud_kms.list_ekm_connections
- List Import JobsLists ImportJobs.cloud_kms.list_import_jobs
- List Key HandlesLists KeyHandles.cloud_kms.list_key_handles
- List Key RingsLists KeyRings.cloud_kms.list_key_rings
- List KeysList the crypto keys in a Cloud KMS key ring.cloud_kms.list_keys
- List LocationsLists information about the supported locations for this service.cloud_kms.list_locations
Show 24 more
- List ProposalsLists SingleTenantHsmInstanceProposals.cloud_kms.list_proposals
- List Retired ResourcesLists the RetiredResources which are the records of deleted CryptoKeys.cloud_kms.list_retired_resources
- List Single Tenant Hsm InstancesLists SingleTenantHsmInstances.cloud_kms.list_single_tenant_hsm_instances
- Mac Sign Crypto Key VersionSigns data using a CryptoKeyVersion with CryptoKey.purpose MAC, producing a tag that can be verified by another source with the same key.cloud_kms.mac_sign_crypto_key_version
- Mac Verify Crypto Key VersionVerifies MAC tag using a CryptoKeyVersion with CryptoKey.purpose MAC, and returns a response that indicates whether or not the verification was successful.cloud_kms.mac_verify_crypto_key_version
- Raw Decrypt Crypto Key VersionDecrypts data that was originally encrypted using a raw cryptographic mechanism.cloud_kms.raw_decrypt_crypto_key_version
- Raw Encrypt Crypto Key VersionEncrypts data using portable cryptographic primitives.cloud_kms.raw_encrypt_crypto_key_version
- Restore Crypto Key VersionRestore a CryptoKeyVersion in the DESTROY_SCHEDULED state.cloud_kms.restore_crypto_key_version
- Show Effective Autokey Config FolderReturns the effective Cloud KMS Autokey configuration for a given project or folder.cloud_kms.show_effective_autokey_config_folder
- Show Effective Autokey Config ProjectReturns the effective Cloud KMS Autokey configuration for a given project or folder.cloud_kms.show_effective_autokey_config_project
- Show Effective Key Access Justifications Enrollment Config ProjectReturns the KeyAccessJustificationsEnrollmentConfig of the resource closest to the given project in hierarchy.cloud_kms.show_effective_key_access_justifications_enrollment_config_project
- Show Effective Key Access Justifications Policy Config ProjectReturns the KeyAccessJustificationsPolicyConfig of the resource closest to the given project in hierarchy.cloud_kms.show_effective_key_access_justifications_policy_config_project
- SignSign the SHA-256 digest of text with an asymmetric KMS key version.cloud_kms.sign
- Update Autokey Config FolderUpdates the AutokeyConfig for a folder or a project.cloud_kms.update_autokey_config_folder
- Update Autokey Config ProjectUpdates the AutokeyConfig for a folder or a project.cloud_kms.update_autokey_config_project
- Update Crypto KeyUpdate a CryptoKey.cloud_kms.update_crypto_key
- Update Crypto Key VersionUpdate a CryptoKeyVersion's metadata.cloud_kms.update_crypto_key_version
- Update Ekm Config LocationUpdates the EkmConfig singleton resource for a given project and location.cloud_kms.update_ekm_config_location
- Update Ekm ConnectionUpdates an EkmConnection's metadata.cloud_kms.update_ekm_connection
- Update Kaj Policy Config FolderUpdates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.cloud_kms.update_kaj_policy_config_folder
- Update Kaj Policy Config OrganizationUpdates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.cloud_kms.update_kaj_policy_config_organization
- Update Kaj Policy Config ProjectUpdates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.cloud_kms.update_kaj_policy_config_project
- Update Primary Version Crypto KeyUpdate the version of a CryptoKey that will be used in Encrypt.cloud_kms.update_primary_version_crypto_key
- Verify Connectivity Ekm ConnectionVerifies that Cloud KMS can successfully connect to the external key manager specified by an EkmConnection.cloud_kms.verify_connectivity_ekm_connection
Google Cloud KMS questions
- How does OCNORA authenticate with Google Cloud KMS?
- With a stored OAuth 2.0 credential, shaped {"client_id", "client_secret", "refresh_token"}. A connection test can check it when you add it.
- What can I automate with Google Cloud KMS?
- 72 typed operations, each with a reference page listing its config fields and the shapes it emits.
- What if the Google Cloud KMS operation I need is not listed?
- Where Google Cloud KMS has an HTTP API, call it from the HTTP node with the same credential, or describe the step to the AI builder, which asks our team for a typed node when one is missing.
- Are there templates that use Google Cloud KMS?
- Not yet. Start from a blank workflow, or describe the workflow to Build with AI.
- How are Google Cloud KMS calls controlled?
- Every call and every run step is audited, runs count against the execution budget, and Workflow Health pre-flights the workflow when you save it.
See your first Google Cloud KMS workflow run.
Book a technical demo. We add the connection, pick a template or describe the workflow to Build with AI, and Workflow Health checks it before it runs.