resource_service_keys

Creates, updates, deletes, gets or lists a resource_service_keys resource.

Overview

Name	`resource_service_keys`
Type	Resource
Id	`ovh.okms.resource_service_keys`

Fields

The following fields are returned by SELECT queries:

get
list

successful operation

Name	Datatype	Description
`id`	`string (uuid)`	Key ID
`name`	`string`	Key name
`always_sensitive`	`boolean`	Whether the key has always been sensitive since creation (wire: alwaysSensitive)
`class`	`string`	Class of the key (KEY_PAIR, PUBLIC_KEY, SECRET_KEY)
`consumer_count`	`integer`	Number of declared consumers (wire: consumerCount)
`consumers`	`array`	List of declared consumers of the key
`created_at`	`string (date-time)`	Creation time of the key (wire: createdAt)
`curve`	`string`	Curve type for Elliptic Curve (EC) keys (P-256, P-384, P-521)
`extractable`	`boolean`	Whether the key material can be extracted from the KMS
`iam`	`object`	IAM resource metadata
`keys`	`array`	The key in JWK format
`keys_pem`	`array`	The key in PEM format (wire: keysPEM)
`never_extractable`	`boolean`	Whether the key has never been extractable at any point in its lifetime (wire: neverExtractable)
`operations`	`array`	The operations for which the key is intended to be used
`protection_level`	`string`	Key protection level (HSM, SOFTWARE) (wire: protectionLevel)
`sensitive`	`boolean`	Whether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form.
`size`	`integer`	Size of the key (128, 192, 256, 384, 521, 2048, 3072, 4096)
`state`	`string`	State of the key (ACTIVE, ALL, COMPROMISED, DEACTIVATED, DESTROYED, DESTROYED_COMPROMISED, PRE_ACTIVE)
`type`	`string`	Key type (EC, RSA, oct)

An OKMS service key

Name	Datatype	Description
`id`	`string (uuid)`	Key ID
`name`	`string`	Key name
`always_sensitive`	`boolean`	Whether the key has always been sensitive since creation (wire: alwaysSensitive)
`class`	`string`	Class of the key (KEY_PAIR, PUBLIC_KEY, SECRET_KEY)
`consumer_count`	`integer`	Number of declared consumers (wire: consumerCount)
`consumers`	`array`	List of declared consumers of the key
`created_at`	`string (date-time)`	Creation time of the key (wire: createdAt)
`curve`	`string`	Curve type for Elliptic Curve (EC) keys (P-256, P-384, P-521)
`extractable`	`boolean`	Whether the key material can be extracted from the KMS
`iam`	`object`	IAM resource metadata
`keys`	`array`	The key in JWK format
`keys_pem`	`array`	The key in PEM format (wire: keysPEM)
`never_extractable`	`boolean`	Whether the key has never been extractable at any point in its lifetime (wire: neverExtractable)
`operations`	`array`	The operations for which the key is intended to be used
`protection_level`	`string`	Key protection level (HSM, SOFTWARE) (wire: protectionLevel)
`sensitive`	`boolean`	Whether the key material can be exposed in plaintext. If true, extraction is only allowed in wrapped form.
`size`	`integer`	Size of the key (128, 192, 256, 384, 521, 2048, 3072, 4096)
`state`	`string`	State of the key (ACTIVE, ALL, COMPROMISED, DEACTIVATED, DESTROYED, DESTROYED_COMPROMISED, PRE_ACTIVE)
`type`	`string`	Key type (EC, RSA, oct)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
`get`	`select`	`key_id`, `okms_id`	`format`	Returns one service key and its metadata. Pass optional `format` to also export the key material as JWK or PEM, when the key is extractable.
`list`	`select`	`okms_id`	`x_pagination_cursor`, `x_pagination_size`, `iam_tags`	Returns the service keys of the service, with their metadata.
`create`	`insert`	`okms_id`		To create a new service key, omit the key material from the request. The KMS generates it from the type, size, curve and operations you specify.<br /><br />To import an existing service key, supply its key material in the request. The key is stored in the KMS with the attributes you provide.<br /><br />For a secure BYOK import, send the key material encrypted in `wrappedKeys` (RSA wrap) instead of in cleartext. The KMS unwraps it with the referenced transport key and stores the resulting service key.
`update`	`update`	`key_id`, `okms_id`		Updates the key's name or extractability.<br /><br />You can also change the key state to activate, deactivate, or mark it as compromised. Deactivation requires `deactivationReason`.<br /><br />A deactivated key keeps its material in the KMS and can be reactivated later.
`delete`	`delete`	`key_id`, `okms_id`	`force`	Permanently deletes the key and its material from the KMS. Once deleted, the key cannot be recovered.<br /><br />The key must already be deactivated, unless `force` is set.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`api_host`	`string`	The OVHcloud API host. Selected by OVH_ENDPOINT (ovh-eu, ovh-ca or ovh-us; default ovh-eu). (default: api.eu.ovhcloud.com, x-stackQL-envVarSelector: {"envVar":"OVH_ENDPOINT","default":"ovh-eu","values":{"ovh-eu":"api.eu.ovhcloud.com","ovh-ca":"api.ca.ovhcloud.com","ovh-us":"api.us.ovhcloud.com"}})
`key_id`	`string (uuid)`	Key ID (wire: keyId)
`okms_id`	`string (uuid)`	Okms ID (wire: okmsId)
`force`	`boolean`	Force deletion of the key
`format`	`string`	Optional additional output format of the key
`iam_tags`	`object`	Filter resources on IAM tags (wire: iamTags)
`x_pagination_cursor`	`string`	Pagination cursor (wire: X-Pagination-Cursor)
`x_pagination_size`	`integer`	Pagination size (wire: X-Pagination-Size)

`SELECT` examples

get
list

Returns one service key and its metadata. Pass optional format to also export the key material as JWK or PEM, when the key is extractable.

SELECT
id,
name,
always_sensitive,
class,
consumer_count,
consumers,
created_at,
curve,
extractable,
iam,
keys,
keys_pem,
never_extractable,
operations,
protection_level,
sensitive,
size,
state,
type
FROM ovh.okms.resource_service_keys
WHERE key_id = '{{ key_id }}' -- required
AND okms_id = '{{ okms_id }}' -- required
AND format = '{{ format }}'
;

Returns the service keys of the service, with their metadata.

SELECT
id,
name,
always_sensitive,
class,
consumer_count,
consumers,
created_at,
curve,
extractable,
iam,
keys,
keys_pem,
never_extractable,
operations,
protection_level,
sensitive,
size,
state,
type
FROM ovh.okms.resource_service_keys
WHERE okms_id = '{{ okms_id }}' -- required
AND x_pagination_cursor = '{{ x_pagination_cursor }}'
AND x_pagination_size = '{{ x_pagination_size }}'
AND iam_tags = '{{ iam_tags }}'
;

`INSERT` examples

create
Manifest

To create a new service key, omit the key material from the request. The KMS generates it from the type, size, curve and operations you specify. To import an existing service key, supply its key material in the request. The key is stored in the KMS with the attributes you provide. For a secure BYOK import, send the key material encrypted in wrappedKeys (RSA wrap) instead of in cleartext. The KMS unwraps it with the referenced transport key and stores the resulting service key.

INSERT INTO ovh.okms.resource_service_keys (
context,
curve,
extractable,
keys,
name,
operations,
protection_level,
size,
type,
okms_id
)
SELECT 
'{{ context }}',
'{{ curve }}',
{{ extractable }},
'{{ keys }}',
'{{ name }}',
'{{ operations }}',
'{{ protection_level }}',
{{ size }},
'{{ type }}',
'{{ okms_id }}'
RETURNING
id,
name,
always_sensitive,
class,
consumer_count,
consumers,
created_at,
curve,
extractable,
keys,
keys_pem,
never_extractable,
operations,
protection_level,
sensitive,
size,
state,
type
;

# Description fields are for documentation purposes
- name: resource_service_keys
props:
  - name: okms_id
    value: "{{ okms_id }}"
    description: Required parameter for the resource_service_keys resource.
  - name: context
    value: "{{ context }}"
    description: |
      Context of the key
  - name: curve
    value: "{{ curve }}"
    description: |
      Curve type for Elliptic Curve (EC) keys
    valid_values: ['P-256', 'P-384', 'P-521']
  - name: extractable
    value: {{ extractable }}
    description: |
      Whether the key material can be extracted from the KMS. Defaults to false.
  - name: keys
    description: |
      Set of JSON Web Keys in case of import, incompatible with type,size,curve and operations
    value:
      - alg: "{{ alg }}"
        crv: "{{ crv }}"
        d: "{{ d }}"
        dp: "{{ dp }}"
        dq: "{{ dq }}"
        e: "{{ e }}"
        k: "{{ k }}"
        key_ops: "{{ key_ops }}"
        kid: "{{ kid }}"
        kty: "{{ kty }}"
        n: "{{ n }}"
        p: "{{ p }}"
        q: "{{ q }}"
        qi: "{{ qi }}"
        use: "{{ use }}"
        x: "{{ x }}"
        y: "{{ y }}"
  - name: name
    value: "{{ name }}"
    description: |
      Key name
  - name: operations
    value:
      - "{{ operations }}"
    description: |
      The operations for which the key is intended to be used
  - name: protection_level
    value: "{{ protection_level }}"
    description: |
      Key protection level
    valid_values: ['HSM', 'SOFTWARE']
  - name: size
    value: {{ size }}
    description: |
      Size of the key to be created
    valid_values: ['128', '192', '256', '384', '521', '2048', '3072', '4096']
  - name: type
    value: "{{ type }}"
    description: |
      Type of the key to be created
    valid_values: ['EC', 'RSA', 'oct']

`UPDATE` examples

update

Updates the key's name or extractability. You can also change the key state to activate, deactivate, or mark it as compromised. Deactivation requires deactivationReason. A deactivated key keeps its material in the KMS and can be reactivated later.

UPDATE ovh.okms.resource_service_keys
SET 
deactivation_reason = '{{ deactivation_reason }}',
extractable = {{ extractable }},
name = '{{ name }}',
state = '{{ state }}'
WHERE 
key_id = '{{ key_id }}' --required
AND okms_id = '{{ okms_id }}' --required
RETURNING
id,
name,
always_sensitive,
class,
consumer_count,
consumers,
created_at,
curve,
extractable,
keys,
keys_pem,
never_extractable,
operations,
protection_level,
sensitive,
size,
state,
type;

`DELETE` examples

delete

Permanently deletes the key and its material from the KMS. Once deleted, the key cannot be recovered. The key must already be deactivated, unless force is set.

DELETE FROM ovh.okms.resource_service_keys
WHERE key_id = '{{ key_id }}' --required
AND okms_id = '{{ okms_id }}' --required
AND force = '{{ force }}'
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​