gcp-kms

@noy-db/at-gcp-kms · pnpm add @noy-db/at-gcp-kms Cloud-KMS sealing — the key lives in Google Cloud KMS, access controlled by IAM.

What it does

atGcpKms({ keyName }) seals and unseals the hub-generated managed-mode secret via authenticated Cloud KMS Encrypt/Decrypt calls, backed by Cloud Audit Logs recording every vault open with no extra instrumentation. Its pid is gcp-kms:<keyName> (e.g. gcp-kms:projects/my-project/locations/global/keyRings/noy-db-ring/cryptoKeys/noy-db-sealing). Credentials resolve via Application Default Credentials — an attached service account, GOOGLE_APPLICATION_CREDENTIALS, or gcloud auth application-default login; never pass raw credentials in the options — inject a pre-built client instead for tests or non-default auth.

Same seal/unseal contract as the AWS provider. Cloud KMS supports automatic key-version rotation for symmetric keys with no app-side changes — the keyName stays the same. Cross-key migration requires manual re-sealing with unseal + seal under the new key. Unlike at-aws-kms, there is no recipient-target extension.

Usage

import { atGcpKms } from '@noy-db/at-gcp-kms'

const sealingKey = atGcpKms({
  keyName: 'projects/my-project/locations/global/keyRings/noy-db-ring/cryptoKeys/noy-db-sealing',
})
sealingKey.id // → 'gcp-kms:projects/my-project/locations/global/keyRings/noy-db-ring/cryptoKeys/noy-db-sealing'

See also

• at-* family
• sealing provider id — the pid stability rule
• aws-kms — the equivalent provider for AWS KMS