Add support for encrypting individual bucket objects with KMS keys

[mattayes]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

Cloud Storage allows users to encrypt an object with a KMS key that differs from the default bucket key. I'd like to be able to do this via Terraform. Here's an example workflow:

resource "google_kms_key_ring" "ring" {
  name = "my-key-ring"
  location = "global"
}

resource "google_kms_crypto_key" "key" {
  name = "my-key"
  key_ring = google_kms_key_ring.ring.self_link
}

resource "google_storage_bucket_object" "obj" {
  name = "my-obj"
  bucket = "my-bucket"
  content = "lorem ipsum"
  encryption_key = google_kms_crypto_key.key.self_link
}

New or Affected Resource(s)

• google_storage_bucket_object (both data and resource)

Potential Terraform Configuration

resource "google_storage_bucket_object" "obj" {
  name = "my-obj"
  bucket = "my-bucket"
  content = "lorem ipsum"
  encryption_key = "projects/my-project/locations/global/keyRings/my-key-ring/cryptoKeys/my-key"
}

References

• Add support for GCS bucket encryption parameter #1828 (similar request at bucket-level)

[mattayes]

Thanks @slevenick!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!