GCP Key Management Service plugin requires:

• GCP Project: Active Google Cloud project with Cloud KMS API enabled
• Service Account: Service account with appropriate KMS permissions
• IAM Permissions: The service account needs the following permissions:
  • cloudkms.keyRings.list
  • cloudkms.cryptoKeys.list
  • cloudkms.cryptoKeyVersions.list
  • cloudkms.cryptoKeyVersions.get
  • cloudkms.cryptoKeyVersions.getPublicKey

Service Account Setup

1. Create a Service Account:

   gcloud iam service-accounts create kms-discovery \
     --description="Service account for KMS key discovery" \
     --display-name="KMS Discovery"
   

2. Grant KMS Permissions:

   gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
     --member="serviceAccount:kms-discovery@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
     --role="roles/cloudkms.viewer"
   

3. Generate Service Account Key:

   gcloud iam service-accounts keys create kms-discovery-key.json \
     --iam-account=kms-discovery@YOUR_PROJECT_ID.iam.gserviceaccount.com