Google Cloud v9.4.0, Nov 4 25

Google Cloud v9.4.0 published on Tuesday, Nov 4, 2025 by Pulumi

gcp.kms.FolderKajPolicyConfig

Start a Neo task

Explain and create a gcp.kms.FolderKajPolicyConfig resource

Google Cloud v9.4.0 published on Tuesday, Nov 4, 2025 by Pulumi

pulumi/pulumi-gcp

Example Usage

Kms Folder Kaj Policy Config Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as random from "@pulumi/random";
import * as time from "@pulumiverse/time";

// Create Folder in GCP Organization.
const kajFolder = new gcp.organizations.Folder("kaj_folder", {
    displayName: "my-folder",
    parent: "organizations/123456789",
    deletionProtection: false,
});
const projectSuffix = new random.RandomId("project_suffix", {byteLength: 4});
// Create a project for enabling KMS API.
const kmsProject = new gcp.organizations.Project("kms_project", {
    projectId: pulumi.interpolate`kms-api-project${projectSuffix.hex}`,
    name: pulumi.interpolate`kms-api-project${projectSuffix.hex}`,
    folderId: kajFolder.folderId,
    billingAccount: "000000-0000000-0000000-000000",
    deletionPolicy: "DELETE",
}, {
    dependsOn: [kajFolder],
});
// Enable the Cloud KMS API.
const kmsApiService = new gcp.projects.Service("kms_api_service", {
    service: "cloudkms.googleapis.com",
    project: kmsProject.projectId,
    disableDependentServices: true,
}, {
    dependsOn: [kmsProject],
});
const waitEnableServiceApi = new time.Sleep("wait_enable_service_api", {createDuration: "30s"}, {
    dependsOn: [kmsApiService],
});
// Update folder level KAJ default policy
const example = new gcp.kms.FolderKajPolicyConfig("example", {
    folder: kajFolder.folderId,
    defaultKeyAccessJustificationPolicy: {
        allowedAccessReasons: [
            "CUSTOMER_INITIATED_ACCESS",
            "GOOGLE_INITIATED_SYSTEM_OPERATION",
        ],
    },
}, {
    dependsOn: [waitEnableServiceApi],
});

import pulumi
import pulumi_gcp as gcp
import pulumi_random as random
import pulumiverse_time as time

# Create Folder in GCP Organization.
kaj_folder = gcp.organizations.Folder("kaj_folder",
    display_name="my-folder",
    parent="organizations/123456789",
    deletion_protection=False)
project_suffix = random.RandomId("project_suffix", byte_length=4)
# Create a project for enabling KMS API.
kms_project = gcp.organizations.Project("kms_project",
    project_id=project_suffix.hex.apply(lambda hex: f"kms-api-project{hex}"),
    name=project_suffix.hex.apply(lambda hex: f"kms-api-project{hex}"),
    folder_id=kaj_folder.folder_id,
    billing_account="000000-0000000-0000000-000000",
    deletion_policy="DELETE",
    opts = pulumi.ResourceOptions(depends_on=[kaj_folder]))
# Enable the Cloud KMS API.
kms_api_service = gcp.projects.Service("kms_api_service",
    service="cloudkms.googleapis.com",
    project=kms_project.project_id,
    disable_dependent_services=True,
    opts = pulumi.ResourceOptions(depends_on=[kms_project]))
wait_enable_service_api = time.Sleep("wait_enable_service_api", create_duration="30s",
opts = pulumi.ResourceOptions(depends_on=[kms_api_service]))
# Update folder level KAJ default policy
example = gcp.kms.FolderKajPolicyConfig("example",
    folder=kaj_folder.folder_id,
    default_key_access_justification_policy={
        "allowed_access_reasons": [
            "CUSTOMER_INITIATED_ACCESS",
            "GOOGLE_INITIATED_SYSTEM_OPERATION",
        ],
    },
    opts = pulumi.ResourceOptions(depends_on=[wait_enable_service_api]))

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/projects"
	"github.com/pulumi/pulumi-random/sdk/v4/go/random"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-time/sdk/go/time"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create Folder in GCP Organization.
		kajFolder, err := organizations.NewFolder(ctx, "kaj_folder", &organizations.FolderArgs{
			DisplayName:        pulumi.String("my-folder"),
			Parent:             pulumi.String("organizations/123456789"),
			DeletionProtection: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		projectSuffix, err := random.NewRandomId(ctx, "project_suffix", &random.RandomIdArgs{
			ByteLength: pulumi.Int(4),
		})
		if err != nil {
			return err
		}
		// Create a project for enabling KMS API.
		kmsProject, err := organizations.NewProject(ctx, "kms_project", &organizations.ProjectArgs{
			ProjectId: projectSuffix.Hex.ApplyT(func(hex string) (string, error) {
				return fmt.Sprintf("kms-api-project%v", hex), nil
			}).(pulumi.StringOutput),
			Name: projectSuffix.Hex.ApplyT(func(hex string) (string, error) {
				return fmt.Sprintf("kms-api-project%v", hex), nil
			}).(pulumi.StringOutput),
			FolderId:       kajFolder.FolderId,
			BillingAccount: pulumi.String("000000-0000000-0000000-000000"),
			DeletionPolicy: pulumi.String("DELETE"),
		}, pulumi.DependsOn([]pulumi.Resource{
			kajFolder,
		}))
		if err != nil {
			return err
		}
		// Enable the Cloud KMS API.
		kmsApiService, err := projects.NewService(ctx, "kms_api_service", &projects.ServiceArgs{
			Service:                  pulumi.String("cloudkms.googleapis.com"),
			Project:                  kmsProject.ProjectId,
			DisableDependentServices: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			kmsProject,
		}))
		if err != nil {
			return err
		}
		waitEnableServiceApi, err := time.NewSleep(ctx, "wait_enable_service_api", &time.SleepArgs{
			CreateDuration: pulumi.String("30s"),
		}, pulumi.DependsOn([]pulumi.Resource{
			kmsApiService,
		}))
		if err != nil {
			return err
		}
		// Update folder level KAJ default policy
		_, err = kms.NewFolderKajPolicyConfig(ctx, "example", &kms.FolderKajPolicyConfigArgs{
			Folder: kajFolder.FolderId,
			DefaultKeyAccessJustificationPolicy: &kms.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs{
				AllowedAccessReasons: pulumi.StringArray{
					pulumi.String("CUSTOMER_INITIATED_ACCESS"),
					pulumi.String("GOOGLE_INITIATED_SYSTEM_OPERATION"),
				},
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			waitEnableServiceApi,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Random = Pulumi.Random;
using Time = Pulumiverse.Time;

return await Deployment.RunAsync(() => 
{
    // Create Folder in GCP Organization.
    var kajFolder = new Gcp.Organizations.Folder("kaj_folder", new()
    {
        DisplayName = "my-folder",
        Parent = "organizations/123456789",
        DeletionProtection = false,
    });

    var projectSuffix = new Random.RandomId("project_suffix", new()
    {
        ByteLength = 4,
    });

    // Create a project for enabling KMS API.
    var kmsProject = new Gcp.Organizations.Project("kms_project", new()
    {
        ProjectId = projectSuffix.Hex.Apply(hex => $"kms-api-project{hex}"),
        Name = projectSuffix.Hex.Apply(hex => $"kms-api-project{hex}"),
        FolderId = kajFolder.FolderId,
        BillingAccount = "000000-0000000-0000000-000000",
        DeletionPolicy = "DELETE",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kajFolder,
        },
    });

    // Enable the Cloud KMS API.
    var kmsApiService = new Gcp.Projects.Service("kms_api_service", new()
    {
        ServiceName = "cloudkms.googleapis.com",
        Project = kmsProject.ProjectId,
        DisableDependentServices = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kmsProject,
        },
    });

    var waitEnableServiceApi = new Time.Sleep("wait_enable_service_api", new()
    {
        CreateDuration = "30s",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kmsApiService,
        },
    });

    // Update folder level KAJ default policy
    var example = new Gcp.Kms.FolderKajPolicyConfig("example", new()
    {
        Folder = kajFolder.FolderId,
        DefaultKeyAccessJustificationPolicy = new Gcp.Kms.Inputs.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
        {
            AllowedAccessReasons = new[]
            {
                "CUSTOMER_INITIATED_ACCESS",
                "GOOGLE_INITIATED_SYSTEM_OPERATION",
            },
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            waitEnableServiceApi,
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.Folder;
import com.pulumi.gcp.organizations.FolderArgs;
import com.pulumi.random.RandomId;
import com.pulumi.random.RandomIdArgs;
import com.pulumi.gcp.organizations.Project;
import com.pulumi.gcp.organizations.ProjectArgs;
import com.pulumi.gcp.projects.Service;
import com.pulumi.gcp.projects.ServiceArgs;
import com.pulumiverse.time.Sleep;
import com.pulumiverse.time.SleepArgs;
import com.pulumi.gcp.kms.FolderKajPolicyConfig;
import com.pulumi.gcp.kms.FolderKajPolicyConfigArgs;
import com.pulumi.gcp.kms.inputs.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Create Folder in GCP Organization.
        var kajFolder = new Folder("kajFolder", FolderArgs.builder()
            .displayName("my-folder")
            .parent("organizations/123456789")
            .deletionProtection(false)
            .build());

        var projectSuffix = new RandomId("projectSuffix", RandomIdArgs.builder()
            .byteLength(4)
            .build());

        // Create a project for enabling KMS API.
        var kmsProject = new Project("kmsProject", ProjectArgs.builder()
            .projectId(projectSuffix.hex().applyValue(_hex -> String.format("kms-api-project%s", _hex)))
            .name(projectSuffix.hex().applyValue(_hex -> String.format("kms-api-project%s", _hex)))
            .folderId(kajFolder.folderId())
            .billingAccount("000000-0000000-0000000-000000")
            .deletionPolicy("DELETE")
            .build(), CustomResourceOptions.builder()
                .dependsOn(kajFolder)
                .build());

        // Enable the Cloud KMS API.
        var kmsApiService = new Service("kmsApiService", ServiceArgs.builder()
            .service("cloudkms.googleapis.com")
            .project(kmsProject.projectId())
            .disableDependentServices(true)
            .build(), CustomResourceOptions.builder()
                .dependsOn(kmsProject)
                .build());

        var waitEnableServiceApi = new Sleep("waitEnableServiceApi", SleepArgs.builder()
            .createDuration("30s")
            .build(), CustomResourceOptions.builder()
                .dependsOn(kmsApiService)
                .build());

        // Update folder level KAJ default policy
        var example = new FolderKajPolicyConfig("example", FolderKajPolicyConfigArgs.builder()
            .folder(kajFolder.folderId())
            .defaultKeyAccessJustificationPolicy(FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs.builder()
                .allowedAccessReasons(                
                    "CUSTOMER_INITIATED_ACCESS",
                    "GOOGLE_INITIATED_SYSTEM_OPERATION")
                .build())
            .build(), CustomResourceOptions.builder()
                .dependsOn(waitEnableServiceApi)
                .build());

    }
}

resources:
  # Create Folder in GCP Organization.
  kajFolder:
    type: gcp:organizations:Folder
    name: kaj_folder
    properties:
      displayName: my-folder
      parent: organizations/123456789
      deletionProtection: false
  projectSuffix:
    type: random:RandomId
    name: project_suffix
    properties:
      byteLength: 4
  # Create a project for enabling KMS API.
  kmsProject:
    type: gcp:organizations:Project
    name: kms_project
    properties:
      projectId: kms-api-project${projectSuffix.hex}
      name: kms-api-project${projectSuffix.hex}
      folderId: ${kajFolder.folderId}
      billingAccount: 000000-0000000-0000000-000000
      deletionPolicy: DELETE
    options:
      dependsOn:
        - ${kajFolder}
  # Enable the Cloud KMS API.
  kmsApiService:
    type: gcp:projects:Service
    name: kms_api_service
    properties:
      service: cloudkms.googleapis.com
      project: ${kmsProject.projectId}
      disableDependentServices: true
    options:
      dependsOn:
        - ${kmsProject}
  waitEnableServiceApi:
    type: time:Sleep
    name: wait_enable_service_api
    properties:
      createDuration: 30s
    options:
      dependsOn:
        - ${kmsApiService}
  # Update folder level KAJ default policy
  example:
    type: gcp:kms:FolderKajPolicyConfig
    properties:
      folder: ${kajFolder.folderId}
      defaultKeyAccessJustificationPolicy:
        allowedAccessReasons:
          - CUSTOMER_INITIATED_ACCESS
          - GOOGLE_INITIATED_SYSTEM_OPERATION
    options:
      dependsOn:
        - ${waitEnableServiceApi}

Create FolderKajPolicyConfig Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new FolderKajPolicyConfig(name: string, args: FolderKajPolicyConfigArgs, opts?: CustomResourceOptions);

@overload
def FolderKajPolicyConfig(resource_name: str,
                          args: FolderKajPolicyConfigArgs,
                          opts: Optional[ResourceOptions] = None)

@overload
def FolderKajPolicyConfig(resource_name: str,
                          opts: Optional[ResourceOptions] = None,
                          folder: Optional[str] = None,
                          default_key_access_justification_policy: Optional[FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs] = None)

func NewFolderKajPolicyConfig(ctx *Context, name string, args FolderKajPolicyConfigArgs, opts ...ResourceOption) (*FolderKajPolicyConfig, error)

public FolderKajPolicyConfig(string name, FolderKajPolicyConfigArgs args, CustomResourceOptions? opts = null)

public FolderKajPolicyConfig(String name, FolderKajPolicyConfigArgs args)
public FolderKajPolicyConfig(String name, FolderKajPolicyConfigArgs args, CustomResourceOptions options)

type: gcp:kms:FolderKajPolicyConfig
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args FolderKajPolicyConfigArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args FolderKajPolicyConfigArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args FolderKajPolicyConfigArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args FolderKajPolicyConfigArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args FolderKajPolicyConfigArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var folderKajPolicyConfigResource = new Gcp.Kms.FolderKajPolicyConfig("folderKajPolicyConfigResource", new()
{
    Folder = "string",
    DefaultKeyAccessJustificationPolicy = new Gcp.Kms.Inputs.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    {
        AllowedAccessReasons = new[]
        {
            "string",
        },
    },
});

example, err := kms.NewFolderKajPolicyConfig(ctx, "folderKajPolicyConfigResource", &kms.FolderKajPolicyConfigArgs{
	Folder: pulumi.String("string"),
	DefaultKeyAccessJustificationPolicy: &kms.FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs{
		AllowedAccessReasons: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
})

var folderKajPolicyConfigResource = new FolderKajPolicyConfig("folderKajPolicyConfigResource", FolderKajPolicyConfigArgs.builder()
    .folder("string")
    .defaultKeyAccessJustificationPolicy(FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs.builder()
        .allowedAccessReasons("string")
        .build())
    .build());

folder_kaj_policy_config_resource = gcp.kms.FolderKajPolicyConfig("folderKajPolicyConfigResource",
    folder="string",
    default_key_access_justification_policy={
        "allowed_access_reasons": ["string"],
    })

const folderKajPolicyConfigResource = new gcp.kms.FolderKajPolicyConfig("folderKajPolicyConfigResource", {
    folder: "string",
    defaultKeyAccessJustificationPolicy: {
        allowedAccessReasons: ["string"],
    },
});

type: gcp:kms:FolderKajPolicyConfig
properties:
    defaultKeyAccessJustificationPolicy:
        allowedAccessReasons:
            - string
    folder: string

FolderKajPolicyConfig Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The FolderKajPolicyConfig resource accepts the following input properties:

Folder string: The numeric folder number for which to retrieve config.
DefaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.

Folder string: The numeric folder number for which to retrieve config.
DefaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.

folder String: The numeric folder number for which to retrieve config.
defaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.

folder string: The numeric folder number for which to retrieve config.
defaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.

folder str: The numeric folder number for which to retrieve config.
default_key_access_justification_policy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.

folder String: The numeric folder number for which to retrieve config.
defaultKeyAccessJustificationPolicy Property Map: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.

Outputs

All input properties are implicitly available as output properties. Additionally, the FolderKajPolicyConfig resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing FolderKajPolicyConfig Resource

Get an existing FolderKajPolicyConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: FolderKajPolicyConfigState, opts?: CustomResourceOptions): FolderKajPolicyConfig

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        default_key_access_justification_policy: Optional[FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs] = None,
        folder: Optional[str] = None) -> FolderKajPolicyConfig

func GetFolderKajPolicyConfig(ctx *Context, name string, id IDInput, state *FolderKajPolicyConfigState, opts ...ResourceOption) (*FolderKajPolicyConfig, error)

public static FolderKajPolicyConfig Get(string name, Input<string> id, FolderKajPolicyConfigState? state, CustomResourceOptions? opts = null)

public static FolderKajPolicyConfig get(String name, Output<String> id, FolderKajPolicyConfigState state, CustomResourceOptions options)

resources:  _:    type: gcp:kms:FolderKajPolicyConfig    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

DefaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
Folder string: The numeric folder number for which to retrieve config.

DefaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
Folder string: The numeric folder number for which to retrieve config.

defaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
folder String: The numeric folder number for which to retrieve config.

defaultKeyAccessJustificationPolicy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
folder string: The numeric folder number for which to retrieve config.

default_key_access_justification_policy FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
folder str: The numeric folder number for which to retrieve config.

defaultKeyAccessJustificationPolicy Property Map: The default key access justification policy used when a CryptoKey is created in this folder. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
folder String: The numeric folder number for which to retrieve config.

Supporting Types

FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy, FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs

AllowedAccessReasons List<string>: A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.

AllowedAccessReasons []string: A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.

allowedAccessReasons List<String>: A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.

allowedAccessReasons string[]: A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.

allowed_access_reasons Sequence[str]: A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.

allowedAccessReasons List<String>: A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.

Import

FolderKajPolicyConfig can be imported using any of these accepted formats:

folders/{{folder}}/kajPolicyConfig
{{folder}}

When using the pulumi import command, FolderKajPolicyConfig can be imported using one of the formats above. For example:

$ pulumi import gcp:kms/folderKajPolicyConfig:FolderKajPolicyConfig default folders/{{folder}}/kajPolicyConfig

$ pulumi import gcp:kms/folderKajPolicyConfig:FolderKajPolicyConfig default {{folder}}

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: Google Cloud (GCP) Classic pulumi/pulumi-gcp
License: Apache-2.0
Notes: This Pulumi package is based on the google-beta Terraform Provider.

Google Cloud v9.4.0 published on Tuesday, Nov 4, 2025 by Pulumi

pulumi/pulumi-gcp

gcp.kms.FolderKajPolicyConfig

On this page

On this page

Example Usage

Kms Folder Kaj Policy Config Basic

Create FolderKajPolicyConfig Resource

Constructor syntax

Parameters

Constructor example

FolderKajPolicyConfig Resource Properties

Inputs

Outputs

Look up Existing FolderKajPolicyConfig Resource

Supporting Types

FolderKajPolicyConfigDefaultKeyAccessJustificationPolicy, FolderKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs

Import

Package Details

On this page

On this page