NAME
    gcloud beta kms - manage cryptographic keys in the cloud

SYNOPSIS
    gcloud beta kms GROUP | COMMAND [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
    (BETA) The gcloud kms command group lets you generate, use, rotate and
    destroy Google Cloud KMS keys.

    Cloud KMS is a cloud-hosted key management service that lets you manage
    encryption for your cloud services the same way you do on-premises. You can
    generate, use, rotate and destroy AES256 encryption keys. Cloud KMS is
    integrated with IAM and Cloud Audit Logging so that you can manage
    permissions on individual keys, and monitor how these are used. Use Cloud
    KMS to protect secrets and other sensitive data which you need to store in
    Google Cloud Platform.

    More information on Cloud KMS can be found here:
    https://cloud.google.com/kms/ and detailed documentation can be found here:
    https://cloud.google.com/kms/docs/

GCLOUD WIDE FLAGS
    These flags are available to all commands: --help.

    Run $ gcloud help for details.

GROUPS
    GROUP is one of the following:

     autokey-config
        (BETA) Update and retrieve the AutokeyConfig.

     ekm-config
        (BETA) Update and retrieve the EkmConfig.

     ekm-connections
        (BETA) Create and manage ekm connections.

     import-jobs
        (BETA) Create and manage import jobs.

     inventory
        (BETA) Manages the KMS Inventory and Key Tracking commands.

     kaj-config
        (BETA) Update and retrieve KAJ-related configs.

     kaj-enrollment
        (BETA) Retrieve KAJ enrollment configs.

     key-handles
        (BETA) Create and manage KeyHandle resources.

     keyrings
        (BETA) Create and manage keyrings.

     keys
        (BETA) Create and manage keys.

     locations
        (BETA) View locations available for a project.

     operations
        (BETA) Commands for managing operations.

     retired-resources
        (BETA) Manage retired resources.

     single-tenant-hsm
        (BETA) Commands for managing single tenant HSM instances.

COMMANDS
    COMMAND is one of the following:

     asymmetric-decrypt
        (BETA) Decrypt an input file using an asymmetric-encryption key
        version.

     asymmetric-sign
        (BETA) Sign a user input file using an asymmetric-signing key version.

     decapsulate
        (BETA) Decapsulate an input file using a key-encapsulation key version.

     decrypt
        (BETA) Decrypt a ciphertext file using a Cloud KMS key.

     encrypt
        (BETA) Encrypt a plaintext file using a key.

     mac-sign
        (BETA) Sign a user input file using a MAC key version.

     mac-verify
        (BETA) Verify a user signature file using a MAC key version.

     raw-decrypt
        (BETA) Decrypt a ciphertext file using a raw key.

     raw-encrypt
        (BETA) Encrypt a plaintext file using a raw key.

NOTES
    This command is currently in beta and might change without notice. These
    variants are also available:

        $ gcloud kms

        $ gcloud alpha kms

