google-cloud-kms

import os from google.cloud import kms import base64 project_id = os.environ.get('GCP_PROJECT_ID', 'your-project-id') location_id = os.environ.get('KMS_KEY_LOCATION', 'global') # e.g., 'global', 'us-central1' key_ring_id = os.environ.get('KMS_KEY_RING_ID', 'my-key-ring') key_id = os.environ.get('KMS_KEY_ID', 'my-symmetric-key') # Construct the key resource name key_name = ( f"projects/{project_id}/locations/{location_id}/keyRings/" f"{key_ring_id}/cryptoKeys/{key_id}" ) # Initialize the KMS client try: client = kms.KeyManagementServiceClient() print("KMS client initialized.") except Exception as e: print(f"Error initializing KMS client: {e}") print("Ensure GOOGLE_APPLICATION_CREDENTIALS is set or running in a GCP environment.") exit(1) # Data to encrypt plaintext = b"This is a super secret message." try: # Encrypt the plaintext encrypt_response = client.encrypt(request={'name': key_name, 'plaintext': plaintext}) ciphertext = encrypt_response.ciphertext print(f"Plaintext encrypted. Ciphertext (base64): {base64.b64encode(ciphertext).decode('utf-8')}") # Decrypt the ciphertext decrypt_response = client.decrypt(request={'name': key_name, 'ciphertext': ciphertext}) decrypted_text = decrypt_response.plaintext print(f"Ciphertext decrypted. Decrypted text: {decrypted_text.decode('utf-8')}") assert plaintext == decrypted_text print("Encryption and decryption successful!") except Exception as e: print(f"An error occurred during KMS operation: {e}") print("Make sure the key exists, has appropriate IAM permissions, and billing is enabled.")