Breadcrumbs

CLI: Importing Wrapped Key to GCP KMS


  1. To import your WrappedKey.byok into GCP KMS, use the following command.

›_ Console 

> gcloud kms keys versions import --import-job <import-job> --location
<location> --keyring <key-ring-name> --key <KEY_NAME> --algorithm <algorithm-name> --wrapped-key-file <path-to- WrappedKey.byok>
tmpmjh3q_ji.jpg

Importing wrapped key file

The key-import request is initiated. The initial state for an imported key is PENDING_IMPORT. When the state is ENABLED, the key has been imported successfully. If the import fails, the status is IMPORT_FAILED.

  1. List the version of the key and verify its status.

›_ Console 

> gcloud kms keys versions list --keyring <key-ring-name> --location
<location> --key <KEY_NAME>


tmpzto3ct57.jpg

Verifying key version and status

  1. You can set this key version as Primary by using below command.

›_ Console 

> gcloud kms keys set-primary-version <KEY_NAME> --location=<location> --keyring=<key-ring-name> --version=<version_number>
tmpkh0uutpy.jpg

Setting imported key version as primary