# Cloud Key Management Service (KMS) API . projects

## Instance Methods

Returns the locations Resource.

Close httplib2 connections.

Returns the AutokeyConfig for a folder or project.

Gets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.

Returns the effective Cloud KMS Autokey configuration for a given project or folder. Note on permissions: - If called on a project (`projects/{project}`), requires `cloudkms.projects.showEffectiveAutokeyConfig`. - If called on a folder (`folders/{folder}`), requires `cloudkms.folders.showEffectiveAutokeyConfig`.

Returns the KeyAccessJustificationsEnrollmentConfig of the resource closest to the given project in hierarchy.

Returns the KeyAccessJustificationsPolicyConfig of the resource closest to the given project in hierarchy.

Updates the AutokeyConfig for a folder or a project. The caller must have both `cloudkms.autokeyConfigs.update` permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy` permission on the provided key project. A KeyHandle creation in the folder's descendant projects will use this configuration to determine where to create the resulting CryptoKey.

Updates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.

### Method Details

`close()`

    Close httplib2 connections.

`getAutokeyConfig(name, x__xgafv=None)`

    Returns the AutokeyConfig for a folder or project.

    Args:
      name: string, Required. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`, `projects/{PROJECT_NUMBER}/autokeyConfig`, or `projects/{PROJECT_ID}/autokeyConfig`. (required)
      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # Cloud KMS Autokey configuration for a project or folder.
      "etag": "A String", # Optional. A checksum computed by the server based on the value of other fields. This may be sent on update requests to ensure that the client has an up-to-date value before proceeding. The request will be rejected with an ABORTED error on a mismatched etag.
      "keyProject": "A String", # Optional. Name of the key project, e.g. `projects/{PROJECT_ID}` or `projects/{PROJECT_NUMBER}`, where Cloud KMS Autokey will provision a new CryptoKey when a KeyHandle is created. On UpdateAutokeyConfig, the caller will require `cloudkms.cryptoKeys.setIamPolicy` permission on this key project. Once configured, for Cloud KMS Autokey to function properly, this key project must have the Cloud KMS API activated and the Cloud KMS Service Agent for this key project must be granted the `cloudkms.admin` role (or pertinent permissions). A request with an empty key project field will clear the configuration.
      "keyProjectResolutionMode": "A String", # Optional. KeyProjectResolutionMode for the AutokeyConfig. Valid values are `DEDICATED_KEY_PROJECT`, `RESOURCE_PROJECT`, or `DISABLED`.
      "name": "A String", # Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`, `projects/{PROJECT_NUMBER}/autokeyConfig`, or `projects/{PROJECT_ID}/autokeyConfig`.
      "state": "A String", # Output only. The state for the AutokeyConfig.
    }

`getKajPolicyConfig(name, x__xgafv=None)`

    Gets the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.

    Args:
      name: string, Required. Specifies the name of the KeyAccessJustificationsPolicyConfig to get. (required)
      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # Represents a singleton configuration for Key Access Justifications policies.
      "defaultKeyAccessJustificationPolicy": { # A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey or KeyAccessJustificationsPolicyConfig (the default Key Access Justifications policy). # Optional. Specifies the default key access justifications (KAJ) policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. This overrides any default policies in its ancestry. If this field is unset, or is set but contains an empty allowed_access_reasons list, no default Key Access Justifications (KAJ) policy configuration is active. In this scenario, all newly created keys will default to an "allow-all" policy.
        "allowedAccessReasons": [ # The list of allowed reasons for access to a CryptoKey. Note that empty allowed_access_reasons has a different meaning depending on where this message appears. If this is under KeyAccessJustificationsPolicyConfig, it means allow-all. If this is under CryptoKey, it means deny-all.
          "A String",
        ],
      },
      "defaultPolicyAvailable": True or False, # Output only. Indicates whether this parent resource is available to default policy feature. Please consult [the prerequisite of default policy feature](https://cloud.google.com/assured-workloads/key-access-justifications/docs/set-default-policy#before) for more details.
      "name": "A String", # Identifier. Represents the resource name for this KeyAccessJustificationsPolicyConfig in the format of "{organizations|folders|projects}/*/kajPolicyConfig".
    }

`showEffectiveAutokeyConfig(parent, x__xgafv=None)`

    Returns the effective Cloud KMS Autokey configuration for a given project or folder. Note on permissions: - If called on a project (`projects/{project}`), requires `cloudkms.projects.showEffectiveAutokeyConfig`. - If called on a folder (`folders/{folder}`), requires `cloudkms.folders.showEffectiveAutokeyConfig`.

    Args:
      parent: string, Required. Name of the resource project or folder to show the effective Cloud KMS Autokey configuration for. This may be helpful for evaluating the effect of nested folder configurations on a given resource project. Format: * projects/{project} * folders/{folder} (required)
      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # Response message for ShowEffectiveAutokeyConfig
      "keyProject": "A String", # Name of the key project configured in the ancestry of the project or folder.
      "keyProjectResolutionMode": "A String", # The KeyProjectResolutionMode for the AutokeyConfig.
      "source": { # Source of the effective AutokeyConfig. # Source of the effective AutokeyConfig.
        "name": "A String", # Contains the resource name of the AutokeyConfig that is effective, for example, `folders/{FOLDER_NUMBER}` or `projects/{PROJECT_NUMBER}` or `organizations/{ORGANIZATION_NUMBER}`.
      },
    }

`showEffectiveKeyAccessJustificationsEnrollmentConfig(project, x__xgafv=None)`

    Returns the KeyAccessJustificationsEnrollmentConfig of the resource closest to the given project in hierarchy.

    Args:
      project: string, Required. Specifies the number or id of the project to get the effective KeyAccessJustificationsEnrollmentConfig for. (required)
      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # Represents a response message for KeyAccessJustificationsConfig.ShowEffectiveKeyAccessJustificationsEnrollmentConfig
      "externalConfig": { # Represents the configuration of a protection level for a project's Key Access Justifications enrollment. # Contains the effective KeyAccessJustificationsEnrollmentConfig for external keys.
        "auditLogging": True or False, # Indicates whether the project has KAJ logging enabled.
        "policyEnforcement": True or False, # Indicates whether the project is enrolled in KAJ policy enforcement.
      },
      "hardwareConfig": { # Represents the configuration of a protection level for a project's Key Access Justifications enrollment. # Contains the effective KeyAccessJustificationsEnrollmentConfig for hardware keys.
        "auditLogging": True or False, # Indicates whether the project has KAJ logging enabled.
        "policyEnforcement": True or False, # Indicates whether the project is enrolled in KAJ policy enforcement.
      },
      "softwareConfig": { # Represents the configuration of a protection level for a project's Key Access Justifications enrollment. # Contains the effective KeyAccessJustificationsEnrollmentConfig for software keys.
        "auditLogging": True or False, # Indicates whether the project has KAJ logging enabled.
        "policyEnforcement": True or False, # Indicates whether the project is enrolled in KAJ policy enforcement.
      },
    }

`showEffectiveKeyAccessJustificationsPolicyConfig(project, x__xgafv=None)`

    Returns the KeyAccessJustificationsPolicyConfig of the resource closest to the given project in hierarchy.

    Args:
      project: string, Required. Specifies the number or id of the project to get the effective KeyAccessJustificationsPolicyConfig. In the format of "projects/{|}" (required)
      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # Represents a response message for KeyAccessJustificationsConfig.ShowEffectiveKeyAccessJustificationsPolicyConfig.
      "effectiveKajPolicy": { # Represents a singleton configuration for Key Access Justifications policies. # Contains the effective KeyAccessJustificationsPolicyConfig.
        "defaultKeyAccessJustificationPolicy": { # A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey or KeyAccessJustificationsPolicyConfig (the default Key Access Justifications policy). # Optional. Specifies the default key access justifications (KAJ) policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. This overrides any default policies in its ancestry. If this field is unset, or is set but contains an empty allowed_access_reasons list, no default Key Access Justifications (KAJ) policy configuration is active. In this scenario, all newly created keys will default to an "allow-all" policy.
          "allowedAccessReasons": [ # The list of allowed reasons for access to a CryptoKey. Note that empty allowed_access_reasons has a different meaning depending on where this message appears. If this is under KeyAccessJustificationsPolicyConfig, it means allow-all. If this is under CryptoKey, it means deny-all.
            "A String",
          ],
        },
        "defaultPolicyAvailable": True or False, # Output only. Indicates whether this parent resource is available to default policy feature. Please consult [the prerequisite of default policy feature](https://cloud.google.com/assured-workloads/key-access-justifications/docs/set-default-policy#before) for more details.
        "name": "A String", # Identifier. Represents the resource name for this KeyAccessJustificationsPolicyConfig in the format of "{organizations|folders|projects}/*/kajPolicyConfig".
      },
    }

`updateAutokeyConfig(name, body=None, updateMask=None, x__xgafv=None)`

    Updates the AutokeyConfig for a folder or a project. The caller must have both `cloudkms.autokeyConfigs.update` permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy` permission on the provided key project. A KeyHandle creation in the folder's descendant projects will use this configuration to determine where to create the resulting CryptoKey.

    Args:
      name: string, Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`, `projects/{PROJECT_NUMBER}/autokeyConfig`, or `projects/{PROJECT_ID}/autokeyConfig`. (required)
      body: object, The request body.
        The object takes the form of:

    { # Cloud KMS Autokey configuration for a project or folder.
      "etag": "A String", # Optional. A checksum computed by the server based on the value of other fields. This may be sent on update requests to ensure that the client has an up-to-date value before proceeding. The request will be rejected with an ABORTED error on a mismatched etag.
      "keyProject": "A String", # Optional. Name of the key project, e.g. `projects/{PROJECT_ID}` or `projects/{PROJECT_NUMBER}`, where Cloud KMS Autokey will provision a new CryptoKey when a KeyHandle is created. On UpdateAutokeyConfig, the caller will require `cloudkms.cryptoKeys.setIamPolicy` permission on this key project. Once configured, for Cloud KMS Autokey to function properly, this key project must have the Cloud KMS API activated and the Cloud KMS Service Agent for this key project must be granted the `cloudkms.admin` role (or pertinent permissions). A request with an empty key project field will clear the configuration.
      "keyProjectResolutionMode": "A String", # Optional. KeyProjectResolutionMode for the AutokeyConfig. Valid values are `DEDICATED_KEY_PROJECT`, `RESOURCE_PROJECT`, or `DISABLED`.
      "name": "A String", # Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`, `projects/{PROJECT_NUMBER}/autokeyConfig`, or `projects/{PROJECT_ID}/autokeyConfig`.
      "state": "A String", # Output only. The state for the AutokeyConfig.
    }

      updateMask: string, Required. Masks which fields of the AutokeyConfig to update, e.g. `keyProject`.
      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # Cloud KMS Autokey configuration for a project or folder.
      "etag": "A String", # Optional. A checksum computed by the server based on the value of other fields. This may be sent on update requests to ensure that the client has an up-to-date value before proceeding. The request will be rejected with an ABORTED error on a mismatched etag.
      "keyProject": "A String", # Optional. Name of the key project, e.g. `projects/{PROJECT_ID}` or `projects/{PROJECT_NUMBER}`, where Cloud KMS Autokey will provision a new CryptoKey when a KeyHandle is created. On UpdateAutokeyConfig, the caller will require `cloudkms.cryptoKeys.setIamPolicy` permission on this key project. Once configured, for Cloud KMS Autokey to function properly, this key project must have the Cloud KMS API activated and the Cloud KMS Service Agent for this key project must be granted the `cloudkms.admin` role (or pertinent permissions). A request with an empty key project field will clear the configuration.
      "keyProjectResolutionMode": "A String", # Optional. KeyProjectResolutionMode for the AutokeyConfig. Valid values are `DEDICATED_KEY_PROJECT`, `RESOURCE_PROJECT`, or `DISABLED`.
      "name": "A String", # Identifier. Name of the AutokeyConfig resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig`, `projects/{PROJECT_NUMBER}/autokeyConfig`, or `projects/{PROJECT_ID}/autokeyConfig`.
      "state": "A String", # Output only. The state for the AutokeyConfig.
    }

`updateKajPolicyConfig(name, body=None, updateMask=None, x__xgafv=None)`

    Updates the KeyAccessJustificationsPolicyConfig for a given organization, folder, or project.

    Args:
      name: string, Identifier. Represents the resource name for this KeyAccessJustificationsPolicyConfig in the format of "{organizations|folders|projects}/*/kajPolicyConfig". (required)
      body: object, The request body.
        The object takes the form of:

    { # Represents a singleton configuration for Key Access Justifications policies.
      "defaultKeyAccessJustificationPolicy": { # A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey or KeyAccessJustificationsPolicyConfig (the default Key Access Justifications policy). # Optional. Specifies the default key access justifications (KAJ) policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. This overrides any default policies in its ancestry. If this field is unset, or is set but contains an empty allowed_access_reasons list, no default Key Access Justifications (KAJ) policy configuration is active. In this scenario, all newly created keys will default to an "allow-all" policy.
        "allowedAccessReasons": [ # The list of allowed reasons for access to a CryptoKey. Note that empty allowed_access_reasons has a different meaning depending on where this message appears. If this is under KeyAccessJustificationsPolicyConfig, it means allow-all. If this is under CryptoKey, it means deny-all.
          "A String",
        ],
      },
      "defaultPolicyAvailable": True or False, # Output only. Indicates whether this parent resource is available to default policy feature. Please consult [the prerequisite of default policy feature](https://cloud.google.com/assured-workloads/key-access-justifications/docs/set-default-policy#before) for more details.
      "name": "A String", # Identifier. Represents the resource name for this KeyAccessJustificationsPolicyConfig in the format of "{organizations|folders|projects}/*/kajPolicyConfig".
    }

      updateMask: string, Optional. Specifies the list of fields to update.
      x__xgafv: string, V1 error format.
        Allowed values
          1 - v1 error format
          2 - v2 error format

    Returns:
      An object of the form:

        { # Represents a singleton configuration for Key Access Justifications policies.
      "defaultKeyAccessJustificationPolicy": { # A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey or KeyAccessJustificationsPolicyConfig (the default Key Access Justifications policy). # Optional. Specifies the default key access justifications (KAJ) policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. This overrides any default policies in its ancestry. If this field is unset, or is set but contains an empty allowed_access_reasons list, no default Key Access Justifications (KAJ) policy configuration is active. In this scenario, all newly created keys will default to an "allow-all" policy.
        "allowedAccessReasons": [ # The list of allowed reasons for access to a CryptoKey. Note that empty allowed_access_reasons has a different meaning depending on where this message appears. If this is under KeyAccessJustificationsPolicyConfig, it means allow-all. If this is under CryptoKey, it means deny-all.
          "A String",
        ],
      },
      "defaultPolicyAvailable": True or False, # Output only. Indicates whether this parent resource is available to default policy feature. Please consult [the prerequisite of default policy feature](https://cloud.google.com/assured-workloads/key-access-justifications/docs/set-default-policy#before) for more details.
      "name": "A String", # Identifier. Represents the resource name for this KeyAccessJustificationsPolicyConfig in the format of "{organizations|folders|projects}/*/kajPolicyConfig".
    }