Method: projects.locations.keyRings.cryptoKeys.getProtectedResourcesSummary

Returns aggregate information about the resources protected by the given Cloud KMS CryptoKey. By default, summary of resources within the same Cloud organization as the key will be returned, which requires the KMS organization service account to be configured; see https://docs.cloud.google.com/kms/help/key-usage/required-roles. If the KMS organization service account is not configured or key's project is not part of an organization, set fallbackScope to FALLBACK_SCOPE_PROJECT to retrieve a summary of protected resources within the key's project.

HTTP request

GET https://kmsinventory.googleapis.com/v1/{name=projects/*/locations/*/keyRings/*/cryptoKeys/**}/protectedResourcesSummary

The URL uses gRPC Transcoding syntax.

Path parameters

Parameters
name

string

Required. The resource name of the CryptoKey.

Authorization requires the following IAM permission on the specified resource name:

  • cloudkms.cryptoKeys.get

Query parameters

Parameters
fallbackScope

enum (FallbackScope)

Optional. The scope to use if the kms organization service account is not configured.

Request body

The request body must be empty.

Response body

Aggregate information about the resources protected by a Cloud KMS key in the same Cloud organization or project as the key.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "name": string,
  "resourceCount": string,
  "projectCount": integer,
  "resourceTypes": {
    string: string,
    ...
  },
  "cloudProducts": {
    string: string,
    ...
  },
  "locations": {
    string: string,
    ...
  },
  "warnings": [
    {
      object (Warning)
    }
  ]
}
Fields
name

string

The full name of the ProtectedResourcesSummary resource. Example: projects/test-project/locations/us/keyRings/test-keyring/cryptoKeys/test-key/protectedResourcesSummary
resourceCount

string (int64 format)

The total number of protected resources in the same Cloud organization as the key.
projectCount

integer

The number of distinct Cloud projects in the same Cloud organization as the key that have resources protected by the key.
resourceTypes

map (key: string, value: string (int64 format))

The number of resources protected by the key grouped by resource type.
cloudProducts

map (key: string, value: string (int64 format))

The number of resources protected by the key grouped by Cloud product.
locations

map (key: string, value: string (int64 format))

The number of resources protected by the key grouped by region.
warnings[]

object (Warning)

Warning messages for the state of response ProtectedResourcesSummary For example, if the organization service account is not configured, INSUFFICIENT_PERMISSIONS_PARTIAL_DATA warning will be returned.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

FallbackScope

Specifies the scope to use if the organization service agent is not configured.

Enums
FALLBACK_SCOPE_UNSPECIFIED Unspecified scope type.
FALLBACK_SCOPE_PROJECT If set to FALLBACK_SCOPE_PROJECT, the API will fall back to using key's project as request scope if the kms organization service account is not configured.

Warning

A warning message that indicates potential problems with the response data.

JSON representation 
{
  "warningCode": enum (WarningCode),
  "displayMessage": string
}
Fields
warningCode

enum (WarningCode)

The specific warning code for the displayed message.
displayMessage

string

The literal message providing context and details about the warnings.

WarningCode

Different types of warnings that can be returned to the user. The displayMessage contains detailed information regarding the warningCode.

Enums
WARNING_CODE_UNSPECIFIED Default value. This value is unused.
INSUFFICIENT_PERMISSIONS_PARTIAL_DATA Indicates that the caller or service agent lacks necessary permissions to view some of the requested data. The response may be partial. Example: - KMS organization service agent {service_agent_name} lacks the cloudasset.assets.searchAllResources permission on the scope.
RESOURCE_LIMIT_EXCEEDED_PARTIAL_DATA Indicates that a resource limit has been exceeded, resulting in partial data. Example: - The project has more than 10,000 assets (resources, crypto keys, key handles, IAM policies, etc).
ORG_LESS_PROJECT_PARTIAL_DATA Indicates that the project exists outside of an organization resource. Thus the analysis is only done for the project level data and results might be partial.