Skip to content

Python KMS Apiary P1 samples #779

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dpebot merged 22 commits into from
Feb 7, 2017
Merged

Python KMS Apiary P1 samples #779

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
9f67a99
Draft of first half of KMS samples
ryanmats Jan 31, 2017
6d82309
reversed wrong change
ryanmats Jan 31, 2017
5529d40
KMS Apiary Python samples - P1
ryanmats Feb 2, 2017
13c7c74
Merge branch 'master' of https://github.com/GoogleCloudPlatform/pytho…
ryanmats Feb 2, 2017
491b6d9
Few minor style issues
ryanmats Feb 2, 2017
21f812c
Adding back in space i accidentally deleted
ryanmats Feb 2, 2017
2a92880
Addressed all code review comments
ryanmats Feb 3, 2017
17c735c
Merge branch 'master' of https://github.com/GoogleCloudPlatform/pytho…
ryanmats Feb 3, 2017
9cf08a4
Renamed api directory to api-client
ryanmats Feb 3, 2017
d8d15db
Merge branch 'master' of https://github.com/GoogleCloudPlatform/pytho…
ryanmats Feb 6, 2017
816877a
Addressed more code review comments
ryanmats Feb 6, 2017
51ef300
Formatting change
ryanmats Feb 7, 2017
1be099c
Fix quickstart test
Feb 7, 2017
eb07c44
Merge branch 'python-kms-samples' of github.com:GoogleCloudPlatform/p…
Feb 7, 2017
8e9f3d0
Update readme
Feb 7, 2017
14fb5c0
Add readme
Feb 7, 2017
b44fdfd
Added parsers
ryanmats Feb 7, 2017
6ee4bd9
Merge branch 'python-kms-samples' of https://github.com/GoogleCloudPl…
ryanmats Feb 7, 2017
ce75417
Final minor changes to parsers
ryanmats Feb 7, 2017
842af60
Added autogenerated README
ryanmats Feb 7, 2017
599341f
Merge branch 'master' of https://github.com/GoogleCloudPlatform/pytho…
ryanmats Feb 7, 2017
1c53533
Changed snippets_test keyring name and cryptokey name
ryanmats Feb 7, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Addressed all code review comments
  • Loading branch information
@ryanmats
ryanmats committed Feb 3, 2017
commit 2a92880fb2ca6e5d8505c584823d0e97bce3689c
177 changes: 98 additions & 79 deletions kms/api/functions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,15 @@

import argparse
import base64
import io

# Imports the Google APIs client library
from googleapiclient import discovery


# [START kms_create_keyring]
def create_keyring(project_id, location, keyring):

@theacodes theacodes Feb 2, 2017

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

docstrings throughout, please.

e.g.:

"""Creates a keyring in the given location."""

I might be useful to list the locations that are available.

@ryanmats ryanmats Feb 3, 2017

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

"""Creates a KeyRing in the given location. Potential locations include:
global, asia-east1, europe-west1, us-central1, and us-east1."""

# Creates an API client for the KMS API.
kms_client = discovery.build('cloudkms', 'v1beta1')
Expand All @@ -34,12 +36,13 @@ def create_keyring(project_id, location, keyring):
parent=parent, body={}, keyRingId=keyring)

@theacodes theacodes Feb 2, 2017

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is body empty here?

@ryanmats ryanmats Feb 3, 2017

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need body for the request, where one can include optional specification fields (https://developers.google.com/resources/api-libraries/documentation/cloudkms/v1beta1/python/latest/cloudkms_v1beta1.projects.locations.keyRings.cryptoKeys.html#create). The canonical sample doesn't include any of the optional fields.

response = request.execute()

print 'Created KeyRing {}.'.format(response["name"])
print('Created KeyRing {}.'.format(response["name"]))
# [END kms_create_keyring]


# [START kms_create_cryptokey]
def create_cryptokey(project_id, location, keyring, cryptokey):
"""Creates a CrytoKey within a KeyRing in the given location."""

# Creates an API client for the KMS API.
kms_client = discovery.build('cloudkms', 'v1beta1')
Expand All @@ -54,12 +57,16 @@ def create_cryptokey(project_id, location, keyring, cryptokey):
cryptoKeyId=cryptokey)
response = request.execute()

print 'Created CryptoKey {}.'.format(response["name"])
print('Created CryptoKey {}.'.format(response["name"]))
# [END kms_create_cryptokey]


# [START kms_encrypt]
def encrypt(project_id, location, keyring, cryptokey, infile, outfile):
def encrypt(project_id, location, keyring, cryptokey, plaintext_file_name,
encrypted_file_name):
"""Encrypts data from a plaintext_file_name using the provided CryptoKey
and saves it to an encrypted_file_name so it can only be recovered with a
call to decrypt."""

# Creates an API client for the KMS API.
kms_client = discovery.build('cloudkms', 'v1beta1')
Expand All @@ -68,27 +75,31 @@ def encrypt(project_id, location, keyring, cryptokey, infile, outfile):
name = 'projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}'.format(
project_id, location, keyring, cryptokey)

# Read text from input file.
i = open(infile, 'r')
text = i.read()
i.close()
encoded_text = base64.b64encode(text)
# Read text from the input file.
with io.open(plaintext_file_name, 'rb') as plaintext_file:
plaintext = plaintext_file.read()
encoded_text = base64.b64encode(plaintext)

# Use the KMS API to encrypt the text.
request = kms_client.projects().locations().keyRings().cryptoKeys().encrypt(name=name, body={"plaintext": encoded_text})
response = request.execute()
# Use the KMS API to encrypt the text.
cryptokeys = kms_client.projects().locations().keyRings().cryptoKeys()
request = cryptokeys.encrypt(
name=name, body={"plaintext": encoded_text.decode('utf-8')})
response = request.execute()

# Write the encrypted text to a file.
o = open(outfile, 'w')
o.write(response["ciphertext"])
o.close()
# Write the encrypted text to a file.
with io.open(encrypted_file_name, 'wb') as encrypted_file:
encrypted_file.write(response["ciphertext"].encode('utf-8'))

print 'Saved encrypted text to {}.'.format(outfile)
print('Saved encrypted text to {}.'.format(encrypted_file_name))
# [END kms_encrypt]


# [START kms_decrypt]
def decrypt(project_id, location, keyring, cryptokey, infile, outfile):
def decrypt(project_id, location, keyring, cryptokey, encrypted_file_name,
decrypted_file_name):
"""Decrypts data from encrypted_file_name that was previously encrypted
using the CryptoKey with a call to encrypt. Outputs decrypted data to
decrpyted_file_name."""

# Creates an API client for the KMS API.
kms_client = discovery.build('cloudkms', 'v1beta1')
Expand All @@ -97,64 +108,81 @@ def decrypt(project_id, location, keyring, cryptokey, infile, outfile):
name = 'projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}'.format(
project_id, location, keyring, cryptokey)

# Read cipher text from input file.
i = open(infile, 'r')
cipher_text = i.read()
i.close()
# Read cipher text from the input file.
with io.open(encrypted_file_name, 'rb') as encrypted_file:
cipher_text = encrypted_file.read()

# Use the KMS API to decrypt the text.
request = kms_client.projects().locations().keyRings().cryptoKeys().decrypt(name=name, body={"ciphertext": cipher_text})
response = request.execute()
# Use the KMS API to decrypt the text.
cryptokeys = kms_client.projects().locations().keyRings().cryptoKeys()
request = cryptokeys.decrypt(
name=name, body={"ciphertext": cipher_text.decode('utf-8')})
response = request.execute()

# Write the plain text to a file.
o = open(outfile, 'w')
plaintext_encoded = response["plaintext"]
plaintext_decoded = base64.b64decode(plaintext_encoded)
o.write(plaintext_decoded)
o.close()
# Write the plain text to a file.
with io.open(decrypted_file_name, 'wb') as decrypted_file:
plaintext_encoded = response["plaintext"]
plaintext_decoded = base64.b64decode(plaintext_encoded)
decrypted_file.write(plaintext_decoded)

print 'Saved decrypted text to {}.'.format(outfile)
print('Saved decrypted text to {}.'.format(decrypted_file_name))
# [END kms_decrypt]


# [START kms_disable_cryptokey_version]
def disable_cryptokey_version(project_id, location, keyring, cryptokey, version):
def disable_cryptokey_version(project_id, location, keyring, cryptokey,
version):
"""Disables a CryptoKeyVersion associated with a given CryptoKey and
KeyRing."""

# Creates an API client for the KMS API.
kms_client = discovery.build('cloudkms', 'v1beta1')

# The resource name of the CryptoKeyVersion.
name = 'projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}/cryptoKeyVersions/{}'.format(project_id, location, keyring, cryptokey, version)
# Construct the resource name of the CryptoKeyVersion.
name = 'projects/{}/locations/{}/'.format(project_id, location)
name += 'keyRings/{}/cryptoKeys/{}/'.format(keyring, cryptokey)
name += 'cryptoKeyVersions/{}'.format(version)

# Use the KMS API to disable the CryptoKeyVersion.
request = kms_client.projects().locations().keyRings().cryptoKeys().cryptoKeyVersions().patch(name=name, body={"state": 'DISABLED'}, updateMask="state")
cryptokeys = kms_client.projects().locations().keyRings().cryptoKeys()
request = cryptokeys.cryptoKeyVersions().patch(
name=name, body={"state": 'DISABLED'}, updateMask="state")
response = request.execute()

print 'CryptoKeyVersion {}\'s state has been set to {}.'.format(
name, response["state"])
print('CryptoKeyVersion {}\'s state has been set to {}.'.format(
name, response["state"]))
# [END kms_disable_cryptokey_version]


# [START kms_destroy_cryptokey_version]
def destroy_cryptokey_version(
project_id, location, keyring, cryptokey, version):
"""Schedules a CryptoKeyVersion associated with a given CryptoKey and
KeyRing for destruction 24 hours in the future."""

# Creates an API client for the KMS API.
kms_client = discovery.build('cloudkms', 'v1beta1')

# The resource name of the CryptoKeyVersion.
name = 'projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}/cryptoKeyVersions/{}'.format(project_id, location, keyring, cryptokey, version)
# Construct the resource name of the CryptoKeyVersion.
name = 'projects/{}/locations/{}/'.format(project_id, location)
name += 'keyRings/{}/cryptoKeys/{}/'.format(keyring, cryptokey)
name += 'cryptoKeyVersions/{}'.format(version)

# Use the KMS API to schedule the CryptoKeyVersion for destruction.
request = kms_client.projects().locations().keyRings().cryptoKeys().cryptoKeyVersions().destroy(name=name, body={})
cryptokeys = kms_client.projects().locations().keyRings().cryptoKeys()
request = cryptokeys.cryptoKeyVersions().destroy(name=name, body={})
response = request.execute()

print 'CryptoKeyVersion {}\'s state has been set to {}.'.format(
name, response["state"])
print('CryptoKeyVersion {}\'s state has been set to {}.'.format(
name, response["state"]))
# [END kms_destroy_cryptokey_version]


# [START kms_add_member_to_cryptokey_policy]
def add_member_to_cryptokey_policy(
project_id, location, keyring, cryptokey, member, role):
"""Adds a member with a given role to the Identity and Access Management
(IAM) policy for a given CryptoKey associated with a KeyRing."""

# Creates an API client for the KMS API.
kms_client = discovery.build('cloudkms', 'v1beta1')

Expand All @@ -163,46 +191,37 @@ def add_member_to_cryptokey_policy(
project_id, location, keyring, cryptokey)

# Get the current IAM policy and add the new member to it.
policy_request = kms_client.projects().locations().keyRings().cryptoKeys().getIamPolicy(resource=parent)
cryptokeys = kms_client.projects().locations().keyRings().cryptoKeys()
policy_request = cryptokeys.getIamPolicy(resource=parent)
policy_response = policy_request.execute()
bindings = []
if 'bindings' in policy_response.keys():
role_already_exists = False
for binding in policy_response['bindings']:
if binding['role'] == role:
role_already_exists = True
member_already_exists = False
for user in binding['members']:
if user == member:
member_already_exists = True
if not member_already_exists:
binding['members'].append(member)
if not role_already_exists:
members = []
members.append(member)
binding = dict()
binding['role'] = role
binding['members'] = members
policy_response['bindings'].append(binding)
else:
members = []
members.append(member)
binding = dict()
binding['role'] = role
binding['members'] = members
bindings = []
bindings.append(binding)
policy_response['bindings'] = bindings
bindings = policy_response['bindings']
members = []
members.append(member)
new_binding = dict()
new_binding['role'] = role
new_binding['members'] = members
bindings.append(new_binding)
policy_response['bindings'] = bindings

# Set the new IAM Policy.
request = kms_client.projects().locations().keyRings().cryptoKeys().setIamPolicy(resource=parent, body={"policy": policy_response})
cryptokeys = kms_client.projects().locations().keyRings().cryptoKeys()
request = cryptokeys.setIamPolicy(
resource=parent, body={"policy": policy_response})
request.execute()

print 'Member {} added with role {} to policy for CryptoKey {} in KeyRing {}'.format(member, role, cryptokey, keyring)
print_msg = 'Member {} added with role {} to policy'.format(member, role)
print_msg += ' for CryptoKey {} in KeyRing {}'.format(cryptokey, keyring)
print(print_msg)
# [END kms_add_member_to_cryptokey_policy]


# [START kms_get_keyring_policy]
def get_keyring_policy(project_id, location, keyring):
"""Gets the Identity and Access Management (IAM) policy for a given KeyRing
and prints out roles and the members assigned to those roles."""

# Creates an API client for the KMS API.
kms_client = discovery.build('cloudkms', 'v1beta1')

Expand All @@ -216,16 +235,16 @@ def get_keyring_policy(project_id, location, keyring):
response = request.execute()

if 'bindings' in response.keys():
print 'Printing IAM policy for resource {}:'.format(parent)
print('Printing IAM policy for resource {}:'.format(parent))
for binding in response['bindings']:
print ''
print 'Role: {}'.format(binding['role'])
print 'Members:'
print('')
print('Role: {}'.format(binding['role']))
print('Members:')
for member in binding['members']:
print member
print ''
print(member)
print('')
else:
print 'No roles found for resource {}.'.format(parent)
print('No roles found for resource {}.'.format(parent))
# [END kms_get_keyring_policy]


Expand Down
Loading