{"id":495,"library":"google-cloud-kms","title":"Google Cloud Key Management Service","description":"The `google-cloud-kms` client library provides an interface for interacting with Google Cloud Key Management Service (KMS). KMS is a cloud-hosted key management service that allows you to manage cryptographic keys for your cloud services. It enables generation, usage, rotation, and destruction of various cryptographic keys (AES256, RSA, EC) and integrates with Cloud IAM and Cloud Audit Logging. The library is actively maintained with frequent releases, currently at version 3.12.0, supporting Python 3.9 and higher.","status":"active","version":"3.12.0","language":"python","source_language":"en","source_url":"https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-kms","tags":["google cloud","kms","key management","cryptography","security"],"install":[{"cmd":"pip install google-cloud-kms","lang":"bash","label":"Install stable version"}],"dependencies":[],"imports":[{"wrong":"from google.cloud import kms","symbol":"KeyManagementServiceClient","correct":"from google.cloud import kms"}],"quickstart":{"code":"import os\nfrom google.cloud import kms\nimport base64\n\nproject_id = os.environ.get('GCP_PROJECT_ID', 'your-project-id')\nlocation_id = os.environ.get('KMS_KEY_LOCATION', 'global') # e.g., 'global', 'us-central1'\nkey_ring_id = os.environ.get('KMS_KEY_RING_ID', 'my-key-ring')\nkey_id = os.environ.get('KMS_KEY_ID', 'my-symmetric-key')\n\n# Construct the key resource name\nkey_name = (\n    f\"projects/{project_id}/locations/{location_id}/keyRings/\"\n    f\"{key_ring_id}/cryptoKeys/{key_id}\"\n)\n\n# Initialize the KMS client\ntry:\n    client = kms.KeyManagementServiceClient()\n    print(\"KMS client initialized.\")\nexcept Exception as e:\n    print(f\"Error initializing KMS client: {e}\")\n    print(\"Ensure GOOGLE_APPLICATION_CREDENTIALS is set or running in a GCP environment.\")\n    exit(1)\n\n# Data to encrypt\nplaintext = b\"This is a super secret message.\"\n\ntry:\n    # Encrypt the plaintext\n    encrypt_response = client.encrypt(request={'name': key_name, 'plaintext': plaintext})\n    ciphertext = encrypt_response.ciphertext\n    print(f\"Plaintext encrypted. Ciphertext (base64): {base64.b64encode(ciphertext).decode('utf-8')}\")\n\n    # Decrypt the ciphertext\n    decrypt_response = client.decrypt(request={'name': key_name, 'ciphertext': ciphertext})\n    decrypted_text = decrypt_response.plaintext\n    print(f\"Ciphertext decrypted. Decrypted text: {decrypted_text.decode('utf-8')}\")\n\n    assert plaintext == decrypted_text\n    print(\"Encryption and decryption successful!\")\n\nexcept Exception as e:\n    print(f\"An error occurred during KMS operation: {e}\")\n    print(\"Make sure the key exists, has appropriate IAM permissions, and billing is enabled.\")\n","lang":"python","description":"This quickstart demonstrates how to initialize the `google-cloud-kms` client and perform a symmetric encryption and decryption operation. Ensure your GCP project ID, KMS key location, key ring ID, and key ID are set as environment variables or replaced. You also need to authenticate to Google Cloud, for example, by setting the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to a service account key file path or by running in a GCP environment with appropriate permissions."},"warnings":[{"fix":"Review your application's error handling for KMS API calls. Implement custom retry logic using `google.api_core.retry` if automatic retries are needed for resilience against transient failures.","message":"Starting with version 3.0.0 (released 2024-09-23), the default retry policy has been removed from all API calls. This affects both synchronous and asynchronous clients, meaning calls will no longer automatically retry on transient errors unless a custom retry policy is explicitly configured.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"For data larger than 64 KiB, use envelope encryption. This involves generating a data encryption key (DEK) locally, encrypting your large data with the DEK, and then encrypting only the DEK with Cloud KMS. The DEK can then be stored alongside the encrypted data.","message":"Cloud KMS has a plaintext size limit of 64 KiB (65,536 bytes) for direct encryption operations. Attempting to encrypt larger data directly will result in an error.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Verify that the principal making the API call has the `Cloud KMS CryptoKey Encrypter/Decrypter` role (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) on the specific cryptographic key being used. Use `gcloud iam roles describe roles/cloudkms.cryptoKeyEncrypterDecrypter` to see the contained permissions.","message":"Incorrect IAM permissions are a frequent source of `Permission Denied` errors. Ensure the service account or user calling KMS has the necessary roles (e.g., `roles/cloudkms.viewer`, `roles/cloudkms.cryptoKeyEncrypterDecrypter`) on the specific key, key ring, or project, and that roles are applied to the correct resource type (e.g., KMS keys, not a GCS bucket when encrypting GCS objects with a CMEK).","severity":"gotcha","affected_versions":"All versions"},{"fix":"Always construct resource names carefully, preferably using variables for the project, location, key ring, and key IDs, and ensure they match your existing Cloud KMS resources. Double-check the region for your key ring/key.","message":"Resource names (key paths) must be precisely formatted using `projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING_ID/cryptoKeys/KEY_ID`. Mismatched IDs or incorrect segment ordering will result in `NOT_FOUND` or `INVALID_ARGUMENT` errors. The location can be global or a specific region.","severity":"gotcha","affected_versions":"All versions"},{"fix":"It is recommended to use automatic key wrapping if possible. If manual wrapping is necessary, carefully review the key formatting requirements and ensure the correct wrapping key from the import job is used.","message":"When manually importing key material, issues with key formatting or wrapping can lead to the imported key version having an `IMPORT_FAILED` status.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Ensure that Application Default Credentials are configured correctly. If running locally, set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to the path of your service account key file, or run `gcloud auth application-default login`. If deploying to Google Cloud, ensure the service has an associated service account with appropriate roles.","message":"The client failed to initialize because Application Default Credentials (ADC) were not found. This occurs when the `GOOGLE_APPLICATION_CREDENTIALS` environment variable is not set, or when the application is not running in a Google Cloud environment (e.g., GCE, GKE, Cloud Run, Cloud Functions) with an associated service account.","severity":"breaking","affected_versions":"All versions"},{"fix":"Ensure your environment is correctly set up for Application Default Credentials. This typically involves: 1. Setting the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to the path of a service account key file. 2. Running your application in a Google Cloud environment (e.g., Compute Engine, Cloud Run, GKE) where an appropriate service account is attached to the resource. Refer to https://cloud.google.com/docs/authentication/external/set-up-adc for detailed setup instructions.","message":"The client failed to initialize due to missing or improperly configured Application Default Credentials (ADC). This error ('Your default credentials were not found') indicates the client could not locate any credentials to authenticate with Google Cloud services.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'3.12.0':79 '3.9':82 'activ':71 'aes256':56 'allow':35 'audit':66 'client':11 'cloud':2,9,20,29,43,62,65,86 'cloud-host':28 'cryptograph':39,54 'cryptographi':90 'current':76 'destruct':51 'ec':58 'enabl':46 'frequent':74 'generat':47 'googl':1,8,19,85 'google-cloud-km':7 'higher':84 'host':30 'iam':63 'integr':60 'interact':17 'interfac':15 'key':3,21,31,40,55,88 'kms':10,24,25,87 'librari':12,69 'log':67 'maintain':72 'manag':4,22,32,38,89 'provid':13 'python':81 'releas':75 'rotat':49 'rsa':57 'secur':91 'servic':5,23,33,44 'support':80 'usag':48 'various':53 'version':78","created_at":"2026-03-28T15:16:04.090669+00:00","updated_at":"2026-04-16T15:22:13.674540+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":95,"quickstart_score":0,"quickstart_tag":"stale","pypi_latest":"3.13.0","cli_name":"","cli_version":null,"type":"library","homepage":"https://cloud.google.com/kms","github":"https://github.com/googleapis/google-cloud-python","docs":null,"changelog":null,"pypi":"https://pypi.org/project/google-cloud-kms/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["gcp","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-08-02","install_tag":"verified"}}