CLI

1. To create an import job, follow the steps as described below:

   1. Use the same key ring and location as the target key.

   2. Set the protection level to either software or hsm.

   3. Set the import method to either rsa-oaep-3072-sha256-aes-256 or rsa-oaep-4096-sha256-aes-256.

> gcloud kms import-jobs create <import-job> --location <location> --keyring

<key-ring-name> --import-method <import-method> --protection-level

<protection-level>

Creating import job

2. To verify that the import job is active, run the following command.

> gcloud kms import-jobs describe <import-job> --location <location> --keyring

<key-ring-name> --format="value(state)"

Verifying import job status

3. Run the following command to save the public key of the import job.

> gcloud kms import-jobs describe --location=<location> --keyring=<keyring> --format="value(publicKey.pem)" <import-job-name> > wrapping-key.pem

Downloading wrapping key