CLI: Create Cryptographic Key on GCP KMS

1. Create the target key ring.

> gcloud kms keyrings create <key-ring-name> --location <location>

Google Cloud Keyring creation

2. Create the target key.

   1. Set the key's purpose:

      1. For a symmetric key, set the purpose to "encryption".

      2. For an asymmetric key, set the purpose to either "asymmetric-signing" or "asymmetric-encryption".

   2. Prevent an initial version from being created by using the --skip-initial-version-creation flag.

   3. Do not set the protection level.

   4. Do not specify an algorithm for the target key. Specify the algorithm of the imported key as a part of the import request.

> gcloud kms keys create <key-name> --location <location> --keyring <key-ring-name> --purpose <purpose> --import-only --skip-initial-version-creation

Creating imported key