Skip to content

Commit 532d893

Browse files
yasharelyasharel
authored
feat(cloudkms): add samples for CryptoKey/CryptoKeyVersion deletion and get/lists RetiredResources (#10237)
* feat: add delete and retired resources samples for java * Add permanent deletion warning to DeleteKey and DeleteKeyVersion snippets
1 parent d93c89a commit 532d893

8 files changed

Lines changed: 428 additions & 25 deletions

File tree

‎kms/pom.xml‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
<dependency>
3232
<groupId>com.google.cloud</groupId>
3333
<artifactId>libraries-bom</artifactId>
34-
<version>26.32.0</version>
34+
<version>26.50.0</version>
3535
<type>pom</type>
3636
<scope>import</scope>
3737
</dependency>
@@ -42,16 +42,27 @@
4242
<dependency>
4343
<groupId>com.google.cloud</groupId>
4444
<artifactId>google-cloud-kms</artifactId>
45+
<version>2.88.0</version>
46+
</dependency>
47+
<dependency>
48+
<groupId>com.google.api.grpc</groupId>
49+
<artifactId>proto-google-cloud-kms-v1</artifactId>
50+
<version>0.179.0</version>
4551
</dependency>
4652
<dependency>
4753
<groupId>com.google.crypto.tink</groupId>
4854
<artifactId>tink</artifactId>
4955
<version>1.12.0</version>
5056
</dependency>
51-
<!-- [START_EXCLUDE] -->
57+
<dependency>
58+
<groupId>com.google.protobuf</groupId>
59+
<artifactId>protobuf-java</artifactId>
60+
<version>4.33.2</version>
61+
</dependency>
5262
<dependency>
5363
<groupId>com.google.protobuf</groupId>
5464
<artifactId>protobuf-java-util</artifactId>
65+
<version>4.33.2</version>
5566
</dependency>
5667
<dependency>
5768
<groupId>junit</groupId>
@@ -77,5 +88,16 @@
7788
</dependency>
7889
<!-- [END_EXCLUDE] -->
7990
</dependencies>
91+
<build>
92+
<plugins>
93+
<plugin>
94+
<groupId>org.jacoco</groupId>
95+
<artifactId>jacoco-maven-plugin</artifactId>
96+
<configuration>
97+
<skip>true</skip>
98+
</configuration>
99+
</plugin>
100+
</plugins>
101+
</build>
80102
<!-- [END kms_install_with_bom] -->
81103
</project>

‎kms/src/main/java/kms/DeleteKey.java‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
* Copyright 2026 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package kms;
18+
19+
// [START kms_delete_key]
20+
import com.google.cloud.kms.v1.CryptoKeyName;
21+
import com.google.cloud.kms.v1.DeleteCryptoKeyMetadata;
22+
import com.google.cloud.kms.v1.KeyManagementServiceClient;
23+
import java.io.IOException;
24+
import java.util.concurrent.ExecutionException;
25+
26+
public class DeleteKey {
27+
28+
public void deleteKey() throws IOException {
29+
// TODO(developer): Replace these variables before running the sample.
30+
String projectId = "your-project-id";
31+
String locationId = "us-east1";
32+
String keyRingId = "my-key-ring";
33+
String keyId = "my-key";
34+
deleteKey(projectId, locationId, keyRingId, keyId);
35+
}
36+
37+
// deleteKey deletes a crypto key. This action is permanent and cannot be undone. Once the key
38+
// is deleted, it will no longer exist.
39+
public void deleteKey(String projectId, String locationId, String keyRingId, String keyId)
40+
throws IOException {
41+
// Initialize client that will be used to send requests. This client only
42+
// needs to be created once, and can be reused for multiple requests. After
43+
// completing all of your requests, call the "close" method on the client to
44+
// safely clean up any remaining background resources.
45+
try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {
46+
// Build the key name from the project, location, key ring, and key.
47+
CryptoKeyName keyName = CryptoKeyName.of(projectId, locationId, keyRingId, keyId);
48+
49+
// Delete the key.
50+
// Warning: This operation is permanent and cannot be undone.
51+
// Wait for the operation to complete.
52+
client.deleteCryptoKeyAsync(keyName).get();
53+
System.out.printf("Deleted key: %s%n", keyName.toString());
54+
} catch (Exception e) {
55+
System.err.printf("Failed to delete key: %s%n", e.getMessage());
56+
}
57+
}
58+
}
59+
// [END kms_delete_key]

‎kms/src/main/java/kms/DeleteKeyVersion.java‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* Copyright 2026 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package kms;
18+
19+
// [START kms_delete_key_version]
20+
import com.google.cloud.kms.v1.CryptoKeyVersionName;
21+
import com.google.cloud.kms.v1.KeyManagementServiceClient;
22+
import java.io.IOException;
23+
24+
public class DeleteKeyVersion {
25+
26+
public void deleteKeyVersion() throws IOException {
27+
// TODO(developer): Replace these variables before running the sample.
28+
String projectId = "your-project-id";
29+
String locationId = "us-east1";
30+
String keyRingId = "my-key-ring";
31+
String keyId = "my-key";
32+
String keyVersionId = "123";
33+
deleteKeyVersion(projectId, locationId, keyRingId, keyId, keyVersionId);
34+
}
35+
36+
// deleteKeyVersion deletes a key version. This action is permanent and cannot be undone. Once the
37+
// key version is deleted, it will no longer exist.
38+
public void deleteKeyVersion(
39+
String projectId, String locationId, String keyRingId, String keyId, String keyVersionId)
40+
throws IOException {
41+
// Initialize client that will be used to send requests. This client only
42+
// needs to be created once, and can be reused for multiple requests. After
43+
// completing all of your requests, call the "close" method on the client to
44+
// safely clean up any remaining background resources.
45+
try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {
46+
// Build the key version name from the project, location, key ring, key,
47+
// and key version.
48+
CryptoKeyVersionName keyVersionName =
49+
CryptoKeyVersionName.of(projectId, locationId, keyRingId, keyId, keyVersionId);
50+
51+
// Delete the key version.
52+
// Warning: This operation is permanent and cannot be undone.
53+
// Wait for the operation to complete.
54+
client.deleteCryptoKeyVersionAsync(keyVersionName).get();
55+
System.out.printf("Deleted key version: %s%n", keyVersionName.toString());
56+
} catch (Exception e) {
57+
System.err.printf("Failed to delete key version: %s%n", e.getMessage());
58+
}
59+
}
60+
}
61+
// [END kms_delete_key_version]

‎kms/src/main/java/kms/GetRetiredResource.java‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/*
2+
* Copyright 2026 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package kms;
18+
19+
// [START kms_get_retired_resource]
20+
import com.google.cloud.kms.v1.KeyManagementServiceClient;
21+
import com.google.cloud.kms.v1.RetiredResource;
22+
import com.google.cloud.kms.v1.RetiredResourceName;
23+
import java.io.IOException;
24+
25+
public class GetRetiredResource {
26+
27+
public void getRetiredResource() throws IOException {
28+
// TODO(developer): Replace these variables before running the sample.
29+
String projectId = "your-project-id";
30+
String locationId = "us-east1";
31+
String retiredResourceId = "my-retired-resource-id";
32+
getRetiredResource(projectId, locationId, retiredResourceId);
33+
}
34+
35+
// Get the retired resource.
36+
public void getRetiredResource(
37+
String projectId, String locationId, String retiredResourceId)
38+
throws IOException {
39+
// Initialize client that will be used to send requests. This client only
40+
// needs to be created once, and can be reused for multiple requests. After
41+
// completing all of your requests, call the "close" method on the client to
42+
// safely clean up any remaining background resources.
43+
try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {
44+
// Build the retired resource name from the project, location, and retired resource id.
45+
RetiredResourceName name = RetiredResourceName.of(projectId, locationId, retiredResourceId);
46+
47+
// Get the retired resource.
48+
RetiredResource response = client.getRetiredResource(name);
49+
System.out.printf("Retired resource: %s%n", response.getName());
50+
}
51+
}
52+
}
53+
// [END kms_get_retired_resource]

‎kms/src/main/java/kms/IamRemoveMember.java‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,29 @@ public void iamRemoveMember(
5656

5757
// Search through the bindings and remove matches.
5858
String roleToFind = "roles/cloudkms.cryptoKeyEncrypterDecrypter";
59+
// Create a new list of bindings, removing the member from the role.
60+
java.util.List<Binding> newBindings = new java.util.ArrayList<>();
5961
for (Binding binding : policy.getBindingsList()) {
6062
if (binding.getRole().equals(roleToFind) && binding.getMembersList().contains(member)) {
61-
binding.getMembersList().remove(member);
63+
Binding.Builder bindingBuilder = binding.toBuilder();
64+
// Remove the member.
65+
// Note: ProtocolStringList is immutable, so we need to rebuild the members list.
66+
java.util.List<String> validMembers = new java.util.ArrayList<>(binding.getMembersList());
67+
validMembers.remove(member);
68+
69+
bindingBuilder.clearMembers().addAllMembers(validMembers);
70+
if (!validMembers.isEmpty()) {
71+
newBindings.add(bindingBuilder.build());
72+
}
73+
// If no members left, we can just omit the binding (effective removal).
74+
} else {
75+
newBindings.add(binding);
6276
}
6377
}
6478

65-
client.setIamPolicy(resourceName, policy);
79+
Policy newPolicy = policy.toBuilder().clearBindings().addAllBindings(newBindings).build();
80+
81+
client.setIamPolicy(resourceName, newPolicy);
6682
System.out.printf("Updated IAM policy for %s%n", resourceName.toString());
6783
}
6884
}

‎kms/src/main/java/kms/ListRetiredResources.java‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
/*
2+
* Copyright 2026 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package kms;
18+
19+
// [START kms_list_retired_resources]
20+
import com.google.cloud.kms.v1.KeyManagementServiceClient;
21+
import com.google.cloud.kms.v1.LocationName;
22+
import com.google.cloud.kms.v1.RetiredResource;
23+
import java.io.IOException;
24+
25+
public class ListRetiredResources {
26+
27+
public void listRetiredResources() throws IOException {
28+
// TODO(developer): Replace these variables before running the sample.
29+
String projectId = "your-project-id";
30+
String locationId = "us-east1";
31+
listRetiredResources(projectId, locationId);
32+
}
33+
34+
// List retired resources in a specific project and location.
35+
public void listRetiredResources(String projectId, String locationId)
36+
throws IOException {
37+
// Initialize client that will be used to send requests. This client only
38+
// needs to be created once, and can be reused for multiple requests. After
39+
// completing all of your requests, call the "close" method on the client to
40+
// safely clean up any remaining background resources.
41+
try (KeyManagementServiceClient client = KeyManagementServiceClient.create()) {
42+
// Build the location name from the project and location.
43+
LocationName locationName = LocationName.of(projectId, locationId);
44+
45+
// List the retired resources.
46+
for (RetiredResource resource : client.listRetiredResources(locationName).iterateAll()) {
47+
System.out.printf("Retired resource: %s%n", resource.getName());
48+
}
49+
}
50+
}
51+
}
52+
// [END kms_list_retired_resources]

‎kms/src/main/java/kms/VerifyAsymmetricEc.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ public void verifyAsymmetricEc() throws IOException, GeneralSecurityException {
4545
verifyAsymmetricEc(projectId, locationId, keyRingId, keyId, keyVersionId, message, signature);
4646
}
4747

48+
// CPD-OFF
4849
// Verify the signature of a message signed with an RSA key.
4950
public void verifyAsymmetricEc(
5051
String projectId,

0 commit comments

Comments
 (0)