1. Packages
  2. Google Cloud (GCP) Classic
  3. API Docs
  4. kms
  5. ProjectKajPolicyConfig
Google Cloud v9.4.0 published on Tuesday, Nov 4, 2025 by Pulumi
pulumi/pulumi-gcp

gcp.kms.ProjectKajPolicyConfig

Start a Neo task
Explain and create a gcp.kms.ProjectKajPolicyConfig resource
gcp logo
Google Cloud v9.4.0 published on Tuesday, Nov 4, 2025 by Pulumi
pulumi/pulumi-gcp

    Example Usage

    Kms Project Kaj Policy Config Basic

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as time from "@pulumiverse/time";

// Create a project
const kmsProject = new gcp.organizations.Project("kms_project", {
    projectId: "my-project",
    name: "my-project",
    orgId: "123456789",
    billingAccount: "000000-0000000-0000000-000000",
    deletionPolicy: "DELETE",
});
// Enable the Cloud KMS API.
const kmsApiService = new gcp.projects.Service("kms_api_service", {
    service: "cloudkms.googleapis.com",
    project: kmsProject.projectId,
    disableDependentServices: true,
}, {
    dependsOn: [kmsProject],
});
const waitEnableServiceApi = new time.Sleep("wait_enable_service_api", {createDuration: "30s"}, {
    dependsOn: [kmsApiService],
});
const example = new gcp.kms.ProjectKajPolicyConfig("example", {
    project: kmsProject.projectId,
    defaultKeyAccessJustificationPolicy: {
        allowedAccessReasons: [
            "CUSTOMER_INITIATED_ACCESS",
            "GOOGLE_INITIATED_SYSTEM_OPERATION",
        ],
    },
}, {
    dependsOn: [waitEnableServiceApi],
});

    import pulumi
import pulumi_gcp as gcp
import pulumiverse_time as time

# Create a project
kms_project = gcp.organizations.Project("kms_project",
    project_id="my-project",
    name="my-project",
    org_id="123456789",
    billing_account="000000-0000000-0000000-000000",
    deletion_policy="DELETE")
# Enable the Cloud KMS API.
kms_api_service = gcp.projects.Service("kms_api_service",
    service="cloudkms.googleapis.com",
    project=kms_project.project_id,
    disable_dependent_services=True,
    opts = pulumi.ResourceOptions(depends_on=[kms_project]))
wait_enable_service_api = time.Sleep("wait_enable_service_api", create_duration="30s",
opts = pulumi.ResourceOptions(depends_on=[kms_api_service]))
example = gcp.kms.ProjectKajPolicyConfig("example",
    project=kms_project.project_id,
    default_key_access_justification_policy={
        "allowed_access_reasons": [
            "CUSTOMER_INITIATED_ACCESS",
            "GOOGLE_INITIATED_SYSTEM_OPERATION",
        ],
    },
    opts = pulumi.ResourceOptions(depends_on=[wait_enable_service_api]))

    package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/projects"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-time/sdk/go/time"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create a project
		kmsProject, err := organizations.NewProject(ctx, "kms_project", &organizations.ProjectArgs{
			ProjectId:      pulumi.String("my-project"),
			Name:           pulumi.String("my-project"),
			OrgId:          pulumi.String("123456789"),
			BillingAccount: pulumi.String("000000-0000000-0000000-000000"),
			DeletionPolicy: pulumi.String("DELETE"),
		})
		if err != nil {
			return err
		}
		// Enable the Cloud KMS API.
		kmsApiService, err := projects.NewService(ctx, "kms_api_service", &projects.ServiceArgs{
			Service:                  pulumi.String("cloudkms.googleapis.com"),
			Project:                  kmsProject.ProjectId,
			DisableDependentServices: pulumi.Bool(true),
		}, pulumi.DependsOn([]pulumi.Resource{
			kmsProject,
		}))
		if err != nil {
			return err
		}
		waitEnableServiceApi, err := time.NewSleep(ctx, "wait_enable_service_api", &time.SleepArgs{
			CreateDuration: pulumi.String("30s"),
		}, pulumi.DependsOn([]pulumi.Resource{
			kmsApiService,
		}))
		if err != nil {
			return err
		}
		_, err = kms.NewProjectKajPolicyConfig(ctx, "example", &kms.ProjectKajPolicyConfigArgs{
			Project: kmsProject.ProjectId,
			DefaultKeyAccessJustificationPolicy: &kms.ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs{
				AllowedAccessReasons: pulumi.StringArray{
					pulumi.String("CUSTOMER_INITIATED_ACCESS"),
					pulumi.String("GOOGLE_INITIATED_SYSTEM_OPERATION"),
				},
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			waitEnableServiceApi,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Time = Pulumiverse.Time;

return await Deployment.RunAsync(() => 
{
    // Create a project
    var kmsProject = new Gcp.Organizations.Project("kms_project", new()
    {
        ProjectId = "my-project",
        Name = "my-project",
        OrgId = "123456789",
        BillingAccount = "000000-0000000-0000000-000000",
        DeletionPolicy = "DELETE",
    });

    // Enable the Cloud KMS API.
    var kmsApiService = new Gcp.Projects.Service("kms_api_service", new()
    {
        ServiceName = "cloudkms.googleapis.com",
        Project = kmsProject.ProjectId,
        DisableDependentServices = true,
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kmsProject,
        },
    });

    var waitEnableServiceApi = new Time.Sleep("wait_enable_service_api", new()
    {
        CreateDuration = "30s",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            kmsApiService,
        },
    });

    var example = new Gcp.Kms.ProjectKajPolicyConfig("example", new()
    {
        Project = kmsProject.ProjectId,
        DefaultKeyAccessJustificationPolicy = new Gcp.Kms.Inputs.ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
        {
            AllowedAccessReasons = new[]
            {
                "CUSTOMER_INITIATED_ACCESS",
                "GOOGLE_INITIATED_SYSTEM_OPERATION",
            },
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            waitEnableServiceApi,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.Project;
import com.pulumi.gcp.organizations.ProjectArgs;
import com.pulumi.gcp.projects.Service;
import com.pulumi.gcp.projects.ServiceArgs;
import com.pulumiverse.time.Sleep;
import com.pulumiverse.time.SleepArgs;
import com.pulumi.gcp.kms.ProjectKajPolicyConfig;
import com.pulumi.gcp.kms.ProjectKajPolicyConfigArgs;
import com.pulumi.gcp.kms.inputs.ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Create a project
        var kmsProject = new Project("kmsProject", ProjectArgs.builder()
            .projectId("my-project")
            .name("my-project")
            .orgId("123456789")
            .billingAccount("000000-0000000-0000000-000000")
            .deletionPolicy("DELETE")
            .build());

        // Enable the Cloud KMS API.
        var kmsApiService = new Service("kmsApiService", ServiceArgs.builder()
            .service("cloudkms.googleapis.com")
            .project(kmsProject.projectId())
            .disableDependentServices(true)
            .build(), CustomResourceOptions.builder()
                .dependsOn(kmsProject)
                .build());

        var waitEnableServiceApi = new Sleep("waitEnableServiceApi", SleepArgs.builder()
            .createDuration("30s")
            .build(), CustomResourceOptions.builder()
                .dependsOn(kmsApiService)
                .build());

        var example = new ProjectKajPolicyConfig("example", ProjectKajPolicyConfigArgs.builder()
            .project(kmsProject.projectId())
            .defaultKeyAccessJustificationPolicy(ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs.builder()
                .allowedAccessReasons(                
                    "CUSTOMER_INITIATED_ACCESS",
                    "GOOGLE_INITIATED_SYSTEM_OPERATION")
                .build())
            .build(), CustomResourceOptions.builder()
                .dependsOn(waitEnableServiceApi)
                .build());

    }
}

    resources:
  # Create a project
  kmsProject:
    type: gcp:organizations:Project
    name: kms_project
    properties:
      projectId: my-project
      name: my-project
      orgId: '123456789'
      billingAccount: 000000-0000000-0000000-000000
      deletionPolicy: DELETE
  # Enable the Cloud KMS API.
  kmsApiService:
    type: gcp:projects:Service
    name: kms_api_service
    properties:
      service: cloudkms.googleapis.com
      project: ${kmsProject.projectId}
      disableDependentServices: true
    options:
      dependsOn:
        - ${kmsProject}
  waitEnableServiceApi:
    type: time:Sleep
    name: wait_enable_service_api
    properties:
      createDuration: 30s
    options:
      dependsOn:
        - ${kmsApiService}
  example:
    type: gcp:kms:ProjectKajPolicyConfig
    properties:
      project: ${kmsProject.projectId}
      defaultKeyAccessJustificationPolicy:
        allowedAccessReasons:
          - CUSTOMER_INITIATED_ACCESS
          - GOOGLE_INITIATED_SYSTEM_OPERATION
    options:
      dependsOn:
        - ${waitEnableServiceApi}

    Create ProjectKajPolicyConfig Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ProjectKajPolicyConfig(name: string, args?: ProjectKajPolicyConfigArgs, opts?: CustomResourceOptions);
    @overload
def ProjectKajPolicyConfig(resource_name: str,
                           args: Optional[ProjectKajPolicyConfigArgs] = None,
                           opts: Optional[ResourceOptions] = None)

@overload
def ProjectKajPolicyConfig(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           default_key_access_justification_policy: Optional[ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs] = None,
                           project: Optional[str] = None)
    func NewProjectKajPolicyConfig(ctx *Context, name string, args *ProjectKajPolicyConfigArgs, opts ...ResourceOption) (*ProjectKajPolicyConfig, error)
    public ProjectKajPolicyConfig(string name, ProjectKajPolicyConfigArgs? args = null, CustomResourceOptions? opts = null)
    public ProjectKajPolicyConfig(String name, ProjectKajPolicyConfigArgs args)
public ProjectKajPolicyConfig(String name, ProjectKajPolicyConfigArgs args, CustomResourceOptions options)

    type: gcp:kms:ProjectKajPolicyConfig
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args ProjectKajPolicyConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ProjectKajPolicyConfigArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ProjectKajPolicyConfigArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ProjectKajPolicyConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ProjectKajPolicyConfigArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var projectKajPolicyConfigResource = new Gcp.Kms.ProjectKajPolicyConfig("projectKajPolicyConfigResource", new()
{
    DefaultKeyAccessJustificationPolicy = new Gcp.Kms.Inputs.ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    {
        AllowedAccessReasons = new[]
        {
            "string",
        },
    },
    Project = "string",
});

    example, err := kms.NewProjectKajPolicyConfig(ctx, "projectKajPolicyConfigResource", &kms.ProjectKajPolicyConfigArgs{
	DefaultKeyAccessJustificationPolicy: &kms.ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs{
		AllowedAccessReasons: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	Project: pulumi.String("string"),
})

    var projectKajPolicyConfigResource = new ProjectKajPolicyConfig("projectKajPolicyConfigResource", ProjectKajPolicyConfigArgs.builder()
    .defaultKeyAccessJustificationPolicy(ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs.builder()
        .allowedAccessReasons("string")
        .build())
    .project("string")
    .build());

    project_kaj_policy_config_resource = gcp.kms.ProjectKajPolicyConfig("projectKajPolicyConfigResource",
    default_key_access_justification_policy={
        "allowed_access_reasons": ["string"],
    },
    project="string")

    const projectKajPolicyConfigResource = new gcp.kms.ProjectKajPolicyConfig("projectKajPolicyConfigResource", {
    defaultKeyAccessJustificationPolicy: {
        allowedAccessReasons: ["string"],
    },
    project: "string",
});

    type: gcp:kms:ProjectKajPolicyConfig
properties:
    defaultKeyAccessJustificationPolicy:
        allowedAccessReasons:
            - string
    project: string

    ProjectKajPolicyConfig Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ProjectKajPolicyConfig resource accepts the following input properties:

    DefaultKeyAccessJustificationPolicy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    DefaultKeyAccessJustificationPolicy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    defaultKeyAccessJustificationPolicy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    defaultKeyAccessJustificationPolicy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    default_key_access_justification_policy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    project str
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    defaultKeyAccessJustificationPolicy Property Map
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ProjectKajPolicyConfig resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing ProjectKajPolicyConfig Resource

    Get an existing ProjectKajPolicyConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ProjectKajPolicyConfigState, opts?: CustomResourceOptions): ProjectKajPolicyConfig
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        default_key_access_justification_policy: Optional[ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs] = None,
        project: Optional[str] = None) -> ProjectKajPolicyConfig
    func GetProjectKajPolicyConfig(ctx *Context, name string, id IDInput, state *ProjectKajPolicyConfigState, opts ...ResourceOption) (*ProjectKajPolicyConfig, error)
    public static ProjectKajPolicyConfig Get(string name, Input<string> id, ProjectKajPolicyConfigState? state, CustomResourceOptions? opts = null)
    public static ProjectKajPolicyConfig get(String name, Output<String> id, ProjectKajPolicyConfigState state, CustomResourceOptions options)
    resources:  _:    type: gcp:kms:ProjectKajPolicyConfig    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    DefaultKeyAccessJustificationPolicy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    DefaultKeyAccessJustificationPolicy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    Project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    defaultKeyAccessJustificationPolicy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    defaultKeyAccessJustificationPolicy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicy
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    project string
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    default_key_access_justification_policy ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    project str
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
    defaultKeyAccessJustificationPolicy Property Map
    The default key access justification policy used when a CryptoKey is created in this project. This is only used when a Key Access Justifications policy is not provided in the CreateCryptoKeyRequest. Structure is documented below.
    project String
    The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

    Supporting Types

    ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicy, ProjectKajPolicyConfigDefaultKeyAccessJustificationPolicyArgs

    AllowedAccessReasons List<string>
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    AllowedAccessReasons []string
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    allowedAccessReasons List<String>
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    allowedAccessReasons string[]
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    allowed_access_reasons Sequence[str]
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.
    allowedAccessReasons List<String>
    A KeyAccessJustificationsPolicy specifies zero or more allowed AccessReason values for encrypt, decrypt, and sign operations on a CryptoKey. Each value may be one of: CUSTOMER_INITIATED_SUPPORT, GOOGLE_INITIATED_SERVICE, THIRD_PARTY_DATA_REQUEST, GOOGLE_INITIATED_REVIEW, CUSTOMER_INITIATED_ACCESS, GOOGLE_INITIATED_SYSTEM_OPERATION, REASON_NOT_EXPECTED, MODIFIED_CUSTOMER_INITIATED_ACCESS, MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION, GOOGLE_RESPONSE_TO_PRODUCTION_ALERT, CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING.

    Import

    ProjectKajPolicyConfig can be imported using any of these accepted formats:

    • projects/{{project}}/kajPolicyConfig

    • {{project}}

    When using the pulumi import command, ProjectKajPolicyConfig can be imported using one of the formats above. For example:

    $ pulumi import gcp:kms/projectKajPolicyConfig:ProjectKajPolicyConfig default projects/{{project}}/kajPolicyConfig

    $ pulumi import gcp:kms/projectKajPolicyConfig:ProjectKajPolicyConfig default {{project}}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Google Cloud (GCP) Classic pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the google-beta Terraform Provider.
    gcp logo
    Google Cloud v9.4.0 published on Tuesday, Nov 4, 2025 by Pulumi
    pulumi/pulumi-gcp
      Meet Neo: Your AI Platform Teammate