Getting error while generating crypto keys using GCloud KMS to access private repo as dependency

user_6633346 0
Viewed 9171

I'm trying to add encrypted ssh keys to google KMS using this documentation for accessing private repository as a dependency on Google App Engine (Node.JS project).

I have successfully generated Cloud KMS KeyRing and CryptoKey but I'm facing an error while encrypting the key.

(gcloud.kms.encrypt) PERMISSION_DENIED: Permission 'cloudkms.cryptoKeyVersions.useToEncrypt' denied for resource 'projects/test/locations/global/keyRings/my-keyring/cryptoKeys/key'.

Need some help to setup this so can I can use this ssh key on GAE.

gcloud node.js google-cloud-platform google-app-engine javascript
2 Answers

You do not have IAM permissions to use to encrypt feature.

Advice: do not practice on your SSH real keys. Make a copy of them into a different directory. Then learn how to use IAM and KMS on the copies.

Need some help to setup this so can I can use this ssh key on GAE.

I not sure what you are trying accomplish with KMS encrypting SSH keys for use on GAE.

To allow a user or service account to use a key to encrypt or decrypt using a particular key, they must have the cloudkms.cryptoKeyEncrypterDecrypter, cloudkms.cryptoKeyEncrypter, cloudkms.cryptoKeyDecrypter, or owner role, as per the chart in Permissions and Roles.

Example command to grant a service account permissions:

gcloud kms keys add-iam-policy-binding \
  golden-egg --location global --keyring golden-goose \
  --member serviceAccount:my-service-account@my-project.iam.gserviceaccount.com \
  --role roles/cloudkms.cryptoKeyEncrypterDecrypter

Similar command to grant a user permissions:

gcloud kms keys add-iam-policy-binding \
  golden-egg --location global --keyring golden-goose \
  --member user:sillygoose@gmail.com \
  --role roles/cloudkms.cryptoKeyEncrypterDecrypter

Granting permissions to use keys

Permissions and Roles

user_80167200

Enable settings on CloudBuild

Cloud Build -> settings > Cloud KMS - Cloud KMS CryptoKey Decrypter -> enabled

Its worked to me

user_65293760
Related