@google-cloud/kms

What is @google-cloud/kms?

@google-cloud/kms is a Node.js client library for Google Cloud Key Management Service (KMS). It allows you to manage cryptographic keys for your cloud services the same way you do on-premises. You can create, use, rotate, and destroy cryptographic keys, and it supports both symmetric and asymmetric keys.

What are @google-cloud/kms's main functionalities?

Create a Key Ring

This code sample demonstrates how to create a new key ring in Google Cloud KMS. A key ring is a grouping of keys that allows you to manage them together.

const { KeyManagementServiceClient } = require('@google-cloud/kms');
const client = new KeyManagementServiceClient();

async function createKeyRing() {
  const locationId = 'global';
  const keyRingId = 'my-key-ring';
  const parent = client.locationPath('my-project', locationId);

  const [keyRing] = await client.createKeyRing({
    parent: parent,
    keyRingId: keyRingId,
    keyRing: {}
  });

  console.log(`Created key ring: ${keyRing.name}`);
}

createKeyRing();

Create a Crypto Key

This code sample demonstrates how to create a new cryptographic key within a key ring. The key can be used for encryption and decryption.

const { KeyManagementServiceClient } = require('@google-cloud/kms');
const client = new KeyManagementServiceClient();

async function createCryptoKey() {
  const locationId = 'global';
  const keyRingId = 'my-key-ring';
  const cryptoKeyId = 'my-crypto-key';
  const parent = client.keyRingPath('my-project', locationId, keyRingId);

  const [cryptoKey] = await client.createCryptoKey({
    parent: parent,
    cryptoKeyId: cryptoKeyId,
    cryptoKey: {
      purpose: 'ENCRYPT_DECRYPT',
      versionTemplate: {
        algorithm: 'GOOGLE_SYMMETRIC_ENCRYPTION'
      }
    }
  });

  console.log(`Created crypto key: ${cryptoKey.name}`);
}

createCryptoKey();

Encrypt Data

This code sample demonstrates how to encrypt data using a cryptographic key. The plaintext data is encrypted and the ciphertext is returned.

const { KeyManagementServiceClient } = require('@google-cloud/kms');
const client = new KeyManagementServiceClient();

async function encryptData() {
  const locationId = 'global';
  const keyRingId = 'my-key-ring';
  const cryptoKeyId = 'my-crypto-key';
  const name = client.cryptoKeyPath('my-project', locationId, keyRingId, cryptoKeyId);
  const plaintext = Buffer.from('my sensitive data').toString('base64');

  const [result] = await client.encrypt({
    name: name,
    plaintext: plaintext
  });

  console.log(`Encrypted data: ${result.ciphertext}`);
}

encryptData();

Decrypt Data

This code sample demonstrates how to decrypt data that was previously encrypted using a cryptographic key. The ciphertext is decrypted and the original plaintext is returned.

const { KeyManagementServiceClient } = require('@google-cloud/kms');
const client = new KeyManagementServiceClient();

async function decryptData() {
  const locationId = 'global';
  const keyRingId = 'my-key-ring';
  const cryptoKeyId = 'my-crypto-key';
  const name = client.cryptoKeyPath('my-project', locationId, keyRingId, cryptoKeyId);
  const ciphertext = '...'; // The encrypted data

  const [result] = await client.decrypt({
    name: name,
    ciphertext: ciphertext
  });

  console.log(`Decrypted data: ${Buffer.from(result.plaintext, 'base64').toString()}`);
}

decryptData();

Other packages similar to @google-cloud/kms

aws-sdk

The aws-sdk package for Node.js provides a comprehensive set of tools for interacting with AWS services, including AWS Key Management Service (KMS). It allows you to create, manage, and use cryptographic keys in a similar way to @google-cloud/kms, but within the AWS ecosystem.

azure-keyvault-keys

The azure-keyvault-keys package for Node.js provides functionality for managing cryptographic keys in Azure Key Vault. It offers similar capabilities to @google-cloud/kms, such as creating, using, and managing keys, but is designed for use with Microsoft Azure services.

node-jose

The node-jose package is a JavaScript library for JSON Object Signing and Encryption (JOSE). It provides tools for working with JSON Web Tokens (JWT), JSON Web Encryption (JWE), and JSON Web Keys (JWK). While it is not a cloud-specific service, it offers similar cryptographic functionalities for key management and data encryption/decryption.

README

Google Cloud Key Management Service: Node.js Client

Google Cloud Key Management Service (KMS) API client for Node.js

A comprehensive list of changes in each version may be found in the CHANGELOG.

• Google Cloud Key Management Service Node.js Client API Reference
• Google Cloud Key Management Service Documentation
• github.com/googleapis/nodejs-kms

Read more about the client libraries for Cloud APIs, including the older Google APIs Client Libraries, in Client Libraries Explained.

Table of contents:

• Quickstart
  • Before you begin
  • Installing the client library
  • Using the client library
• Samples
• Versioning
• Contributing
• License

Quickstart

Before you begin

1. Select or create a Cloud Platform project.
2. Enable billing for your project.
3. Enable the Google Cloud Key Management Service API.
4. Set up authentication with a service account so you can access the API from your local workstation.

Installing the client library

npm install @google-cloud/kms

Using the client library

//
// TODO(developer): Uncomment these variables before running the sample.
//
// const projectId = 'my-project';
// const locationId = 'us-east1';

// Imports the Cloud KMS library
const {KeyManagementServiceClient} = require('@google-cloud/kms');

// Instantiates a client
const client = new KeyManagementServiceClient();

// Build the location name
const locationName = client.locationPath(projectId, locationId);

async function listKeyRings() {
  const [keyRings] = await client.listKeyRings({
    parent: locationName,
  });

  for (const keyRing of keyRings) {
    console.log(keyRing.name);
  }

  return keyRings;
}

return listKeyRings();

Samples

Samples are in the samples/ directory. Each sample's README.md has instructions for running its sample.

Sample	Source Code	Try it
Create Key Asymmetric Decrypt	source code
Create Key Asymmetric Sign	source code
Create Key Hsm	source code
Create Key Labels	source code
Create Key Ring	source code
Create Key Rotation Schedule	source code
Create Key Symmetric Encrypt Decrypt	source code
Create Key Version	source code
Decrypt Asymmetric	source code
Decrypt Symmetric	source code
Destroy Key Version	source code
Disable Key Version	source code
Enable Key Version	source code
Encrypt Asymmetric	source code
Encrypt Symmetric	source code
Get Key Labels	source code
Get Key Version Attestation	source code
Get Public Key	source code
Iam Add Member	source code
Iam Get Policy	source code
Iam Remove Member	source code
Quickstart	source code
Restore Key Version	source code
Sign Asymmetric	source code
Update Key Add Rotation	source code
Update Key Remove Labels	source code
Update Key Remove Rotation	source code
Update Key Set Primary	source code
Update Key Update Labels	source code
Verify Asymmetric Ec	source code
Verify Asymmetric Rsa	source code

The Google Cloud Key Management Service Node.js Client API Reference documentation also contains samples.

Supported Node.js Versions

Our client libraries follow the Node.js release schedule. Libraries are compatible with all current active and maintenance versions of Node.js.

Client libraries targeting some end-of-life versions of Node.js are available, and can be installed via npm dist-tags. The dist-tags follow the naming convention legacy-(version).

Legacy Node.js versions are supported as a best effort:

• Legacy versions will not be tested in continuous integration.
• Some security patches may not be able to be backported.
• Dependencies will not be kept up-to-date, and features will not be backported.

Legacy tags available

• legacy-8: install client libraries from this dist-tag for versions compatible with Node.js 8.

Versioning

This library follows Semantic Versioning.

This library is considered to be General Availability (GA). This means it is stable; the code surface will not change in backwards-incompatible ways unless absolutely necessary (e.g. because of critical security issues) or with an extensive deprecation period. Issues and requests against GA libraries are addressed with the highest priority.

More Information: Google Cloud Platform Launch Stages

Contributing

Contributions welcome! See the Contributing Guide.

Please note that this README.md, the samples/README.md, and a variety of configuration files in this repository (including .nycrc and tsconfig.json) are generated from a central template. To edit one of these files, make an edit to its template in this directory.

License

Apache Version 2.0

See LICENSE