gcloud: Fri Mar 24 11:31:22 UTC 2023

gcloud/kms/ekm-config/add-iam-policy-binding

@@ -0,0 +1,123 @@
+NAME
+    gcloud kms ekm-config add-iam-policy-binding - add IAM policy binding to an
+        EkmConfig
+
+SYNOPSIS
+    gcloud kms ekm-config add-iam-policy-binding --location=LOCATION
+        --member=PRINCIPAL --role=ROLE
+        [--condition=[KEY=VALUE,...]
+          | --condition-from-file=CONDITION_FROM_FILE] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Adds a policy binding to the IAM policy of a kms EkmConfig. A binding
+    consists of at least one member, a role, and an optional condition.
+
+EXAMPLES
+    To add an IAM policy binding for the role of 'roles/editor' for the user
+    test-user@gmail.com on the EkmConfig with location us-central1, run:
+
+        $ gcloud kms ekm-config add-iam-policy-binding \
+            --location='us-central1' --member='user:test-user@gmail.com' \
+            --role='roles/editor'
+
+    To add an IAM policy binding which expires at the end of the year 2022 for
+    the role of 'roles/editor' and the user test-user@gmail.com and location
+    us-central1, run:
+
+        $ gcloud kms ekm-config add-iam-policy-binding \
+            --location='us-central1' --member='user:test-user@gmail.com' \
+            --role='roles/editor' --condition='expression=request.time <
+        timestamp("2023-01-01T00:00:00Z"),title=expires_end_of_2022,description=Expires
+        at midnight on 2022-12-31'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+REQUIRED FLAGS
+     Location resource - The KMS location resource. This represents a Cloud
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+     --member=PRINCIPAL
+        The principal to add the binding for. Should be of the form
+        user|group|serviceAccount:email or domain:domain.
+
+        Examples: user:test-user@gmail.com, group:admins@example.com,
+        serviceAccount:test123@example.domain.com, or
+        domain:example.domain.com.
+
+        Some resources also accept the following special values:
+        ◆ allUsers - Special identifier that represents anyone who is on the
+          internet, with or without a Google account.
+        ◆ allAuthenticatedUsers - Special identifier that represents anyone
+          who is authenticated with a Google account or a service account.
+
+     --role=ROLE
+        Role name to assign to the principal. The role name is the complete
+        path of a predefined role, such as roles/logging.viewer, or the role ID
+        for a custom role, such as
+        organizations/{ORGANIZATION_ID}/roles/logging.viewer.
+
+OPTIONAL FLAGS
+     At most one of these can be specified:
+
+       --condition=[KEY=VALUE,...]
+          A condition to include in the binding. When the condition is
+          explicitly specified as None (--condition=None), a binding without a
+          condition is added. When the condition is specified and is not None,
+          --role cannot be a basic role. Basic roles are roles/editor,
+          roles/owner, and roles/viewer. For more on conditions, refer to the
+          conditions overview guide:
+          https://cloud.google.com/iam/docs/conditions-overview
+
+          When using the --condition flag, include the following key-value
+          pairs:
+
+           expression
+              (Required) Condition expression that evaluates to True or False.
+              This uses a subset of Common Expression Language syntax.
+
+              If the condition expression includes a comma, use a different
+              delimiter to separate the key-value pairs. Specify the delimiter
+              before listing the key-value pairs. For example, to specify a
+              colon (:) as the delimiter, do the following:
+              --condition=^:^title=TITLE:expression=EXPRESSION. For more
+              information, see
+              https://cloud.google.com/sdk/gcloud/reference/topic/escaping.
+
+           title
+              (Required) A short string describing the purpose of the
+              expression.
+
+           description
+              (Optional) Additional description for the expression.
+
+       --condition-from-file=CONDITION_FROM_FILE
+          Path to a local JSON or YAML file that defines the condition. To see
+          available fields, see the help for --condition.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha kms ekm-config add-iam-policy-binding
+
+        $ gcloud beta kms ekm-config add-iam-policy-binding
+

gcloud/kms/ekm-config/describe

@@ -0,0 +1,51 @@
+NAME
+    gcloud kms ekm-config describe - describe the EkmConfig
+
+SYNOPSIS
+    gcloud kms ekm-config describe --location=LOCATION [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud kms ekm-config describe can be used to retrieve the EkmConfig.
+
+EXAMPLES
+    The following command retrieves the EkmConfig in us-east1 for the current
+    project:
+
+        $ gcloud kms ekm-config describe --location=us-east1
+
+    The following command retrieves the EkmConfig for its project foo and
+    location us-east1:
+
+        $ gcloud kms ekm-config describe \
+            --location="projects/foo/locations/us-east1"
+
+REQUIRED FLAGS
+     Location resource - The KMS location resource. This represents a Cloud
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha kms ekm-config describe
+
+        $ gcloud beta kms ekm-config describe
+

gcloud/kms/ekm-config/get-iam-policy

@@ -0,0 +1,75 @@
+NAME
+    gcloud kms ekm-config get-iam-policy - get the IAM policy for an EkmConfig
+
+SYNOPSIS
+    gcloud kms ekm-config get-iam-policy --location=LOCATION
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Gets the IAM policy for the given location.
+
+    Returns an empty policy if the resource does not have a policy set.
+
+EXAMPLES
+    The following command gets the IAM policy for the EkmConfig within the
+    location us-central1:
+
+        $ gcloud kms ekm-config get-iam-policy --location=us-central1
+
+REQUIRED FLAGS
+     Location resource - The KMS location resource. This represents a Cloud
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha kms ekm-config get-iam-policy
+
+        $ gcloud beta kms ekm-config get-iam-policy
+

gcloud/kms/ekm-config/help

@@ -0,0 +1,44 @@
+NAME
+    gcloud kms ekm-config - update and retrieve the EkmConfig
+
+SYNOPSIS
+    gcloud kms ekm-config COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    EkmConfig is a singleton resource that represents configuration parameters
+    that apply to all CryptoKeys and CryptoKeyVersions of EXTERNAL_VPC
+    protecion level.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-iam-policy-binding
+        Add IAM policy binding to an EkmConfig.
+
+     describe
+        Describe the EkmConfig.
+
+     get-iam-policy
+        Get the IAM policy for an EkmConfig.
+
+     remove-iam-policy-binding
+        Remove IAM policy binding from an EkmConfig.
+
+     set-iam-policy
+        Set the IAM policy for an EkmConfig.
+
+     update
+        Update the EkmConfig.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha kms ekm-config
+
+        $ gcloud beta kms ekm-config
+

gcloud/kms/ekm-config/remove-iam-policy-binding

@@ -0,0 +1,138 @@
+NAME
+    gcloud kms ekm-config remove-iam-policy-binding - remove IAM policy binding
+        from an EkmConfig
+
+SYNOPSIS
+    gcloud kms ekm-config remove-iam-policy-binding --location=LOCATION
+        --member=PRINCIPAL --role=ROLE
+        [--all | --condition=[KEY=VALUE,...]
+          | --condition-from-file=CONDITION_FROM_FILE] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Removes a policy binding from the IAM policy of a kms EkmConfig. A binding
+    consists of at least one member, a role, and an optional condition.
+
+EXAMPLES
+    To remove an IAM policy binding for the role of 'roles/editor' for the user
+    'test-user@gmail.com' on the EkmConfig with location us-central1, run:
+
+        $ gcloud kms ekm-config remove-iam-policy-binding \
+            --location='us-central1' --member='user:test-user@gmail.com' \
+            --role='roles/editor'
+
+    To remove an IAM policy binding with a condition of
+    expression='request.time < timestamp("2023-01-01T00:00:00Z")',
+    title='expires_end_of_2022', and description='Expires at midnight on
+    2022-12-31' for the role of 'roles/editor' for the user
+    'test-user@gmail.com' on the EkmConfig with location us-central1, run:
+
+        $ gcloud kms ekm-config remove-iam-policy-binding \
+            --location='us-central1' --member='user:test-user@gmail.com' \
+            --role='roles/editor' --condition='expression=request.time <
+        timestamp("2023-01-01T00:00:00Z"),title=expires_end_of_2022,description=Expires
+        at midnight on 2022-12-31'
+
+    To remove all IAM policy bindings regardless of the condition for the role
+    of 'roles/editor' and for the user 'test-user@gmail.com' on the EkmConfig
+    with location us-central1, run:
+
+        $ gcloud kms ekm-config remove-iam-policy-binding laplace \
+            --location='us-central1' --member='user:test-user@gmail.com' \
+            --role='roles/editor' --all
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+REQUIRED FLAGS
+     Location resource - The KMS location resource. This represents a Cloud
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+     --member=PRINCIPAL
+        The principal to remove the binding for. Should be of the form
+        user|group|serviceAccount:email or domain:domain.
+
+        Examples: user:test-user@gmail.com, group:admins@example.com,
+        serviceAccount:test123@example.domain.com, or
+        domain:example.domain.com.
+
+        Deleted principals have an additional deleted: prefix and a ?uid=UID
+        suffix, where UID is a unique identifier for the principal. Example:
+        deleted:user:test-user@gmail.com?uid=123456789012345678901.
+
+        Some resources also accept the following special values:
+        ◆ allUsers - Special identifier that represents anyone who is on the
+          internet, with or without a Google account.
+        ◆ allAuthenticatedUsers - Special identifier that represents anyone
+          who is authenticated with a Google account or a service account.
+
+     --role=ROLE
+        The role to remove the principal from.
+
+OPTIONAL FLAGS
+     At most one of these can be specified:
+
+       --all
+          Remove all bindings with this role and principal, irrespective of any
+          conditions.
+
+       --condition=[KEY=VALUE,...]
+          The condition of the binding that you want to remove. When the
+          condition is explicitly specified as None (--condition=None), a
+          binding without a condition is removed. Otherwise, only a binding
+          with a condition that exactly matches the specified condition
+          (including the optional description) is removed. For more on
+          conditions, refer to the conditions overview guide:
+          https://cloud.google.com/iam/docs/conditions-overview
+
+          When using the --condition flag, include the following key-value
+          pairs:
+
+           expression
+              (Required) Condition expression that evaluates to True or False.
+              This uses a subset of Common Expression Language syntax.
+
+              If the condition expression includes a comma, use a different
+              delimiter to separate the key-value pairs. Specify the delimiter
+              before listing the key-value pairs. For example, to specify a
+              colon (:) as the delimiter, do the following:
+              --condition=^:^title=TITLE:expression=EXPRESSION. For more
+              information, see
+              https://cloud.google.com/sdk/gcloud/reference/topic/escaping.
+
+           title
+              (Required) A short string describing the purpose of the
+              expression.
+
+           description
+              (Optional) Additional description for the expression.
+
+       --condition-from-file=CONDITION_FROM_FILE
+          Path to a local JSON or YAML file that defines the condition. To see
+          available fields, see the help for --condition.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha kms ekm-config remove-iam-policy-binding
+
+        $ gcloud beta kms ekm-config remove-iam-policy-binding
+

gcloud/kms/ekm-config/set-iam-policy

@@ -0,0 +1,55 @@
+NAME
+    gcloud kms ekm-config set-iam-policy - set the IAM policy for an EkmConfig
+
+SYNOPSIS
+    gcloud kms ekm-config set-iam-policy POLICY_FILE --location=LOCATION
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Sets the IAM policy for the EkmConfig in a location as defined in a JSON or
+    YAML file.
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of the
+    policy file format and contents.
+
+EXAMPLES
+    The following command will read am IAM policy defined in a JSON file
+    'policy.json' and set it for the EkmConfig with location us-central1:
+
+        $ gcloud kms ekm-config set-iam-policy policy.json \
+            --location=us-central1
+
+POSITIONAL ARGUMENTS
+     POLICY_FILE
+        JSON or YAML file with the IAM policy
+
+REQUIRED FLAGS
+     Location resource - The KMS location resource. This represents a Cloud
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha kms ekm-config set-iam-policy
+
+        $ gcloud beta kms ekm-config set-iam-policy
+

gcloud/kms/ekm-config/update

@@ -0,0 +1,63 @@
+NAME
+    gcloud kms ekm-config update - update the EkmConfig
+
+SYNOPSIS
+    gcloud kms ekm-config update --location=LOCATION
+        [--default-ekm-connection=DEFAULT_EKM_CONNECTION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud kms ekm-config update can be used to update the EkmConfig. Applies
+    to all CryptoKeys and CryptoKeyVersions with a protection level of external
+    vpc.
+
+EXAMPLES
+    The following command sets the default ekm-connection to laplace for its
+    project foo and location us-east1:
+
+        $ gcloud kms ekm-config update --location=us-east1 \
+            --default-ekm-connection="projects/foo/locations/us-east1/ekmCon\
+        nections/laplace"
+
+    The following command removes the default-ekm-connection in us-east1 for
+    the current project:
+
+        $ gcloud kms ekm-config update --location=us-east1 \
+            --default-ekm-connection=""
+
+REQUIRED FLAGS
+     Location resource - The KMS location resource. This represents a Cloud
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+OPTIONAL FLAGS
+     --default-ekm-connection=DEFAULT_EKM_CONNECTION
+        The resource name of the EkmConnection to be used as the default
+        EkmConnection for all external-vpc CryptoKeys in a project and
+        location. Can be an empty string to remove the default EkmConnection.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha kms ekm-config update
+
+        $ gcloud beta kms ekm-config update
+

gcloud/kms/ekm-connections/create

@@ -6,7 +6,9 @@ SYNOPSIS
         --hostname=HOSTNAME
         --server-certificates-files=[SERVER_CERTIFICATES,...]
         --service-directory-service=SERVICE_DIRECTORY_SERVICE
-        [--endpoint-filter=ENDPOINT_FILTER] [GCLOUD_WIDE_FLAG ...]
+        [--endpoint-filter=ENDPOINT_FILTER]
+        [--crypto-space-path=CRYPTO_SPACE_PATH
+          --key-management-mode=KEY_MANAGEMENT_MODE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Creates a new connection within the given location.
@@ -20,6 +22,16 @@ EXAMPLES
             --endpoint-filter="foo > bar" --hostname="hostname.foo" \
             --server-certificates-files=foo.pem,bar.pem
 
+    The following command creates an ekm connection named laplace within the
+    location us-central1 in cloud-kms key management mode with the required
+    crypto-space-path :
+
+        $ gcloud kms ekm-connections create laplace --location=us-central1 \
+            --service-directory-service="foo" \
+            --endpoint-filter="foo > bar" --hostname="hostname.foo" \
+            --key-management-mode=cloud-kms --crypto-space-path="foo" \
+            --server-certificates-files=foo.pem,bar.pem
+
 POSITIONAL ARGUMENTS
      Ekmconnection resource - The KMS ekm connection resource. The arguments in
      this group can be used to specify the attributes of this resource. (NOTE)
@@ -64,6 +76,22 @@ OPTIONAL FLAGS
         The filter applied to the endpoints of the resolved service. If no
         filter is specified, all endpoints will be considered.
 
+     Specifies the key management mode for the EkmConnection and associated
+     fields.
+
+       --crypto-space-path=CRYPTO_SPACE_PATH
+          Crypto space path for the EkmConnection. Required during
+          EkmConnection creation if --key-management-mode=cloud-kms.
+
+       --key-management-mode=KEY_MANAGEMENT_MODE
+          Key management mode of the ekm connection. An EkmConnection in
+          cloud-kms mode means Cloud KMS will attempt to create and manage the
+          key material that resides on the EKM for crypto keys created with
+          this EkmConnection. An EkmConnection in manual mode means the
+          external key material will not be managed by Cloud KMS. Omitting the
+          flag defaults to manual. KEY_MANAGEMENT_MODE must be one of: manual,
+          cloud-kms.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,

gcloud/kms/ekm-connections/update

@@ -6,7 +6,8 @@ SYNOPSIS
         [--endpoint-filter=ENDPOINT_FILTER] [--hostname=HOSTNAME]
         [--server-certificates-files=[SERVER_CERTIFICATES,...]]
         [--service-directory-service=SERVICE_DIRECTORY_SERVICE]
-        [GCLOUD_WIDE_FLAG ...]
+        [--crypto-space-path=CRYPTO_SPACE_PATH
+          --key-management-mode=KEY_MANAGEMENT_MODE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     gcloud kms ekm-connections update can be used to update the ekmconnection.
@@ -17,7 +18,7 @@ EXAMPLES
     resolver's hostname within location us-east1:
 
         $ gcloud kms ekm-connections update laplace --location=us-east1 \
-            --hostname=newhostname.foo \
+            --hostname=newhostname.foo
 
     The following command updates an ekm-connection named laplace service
     resolver's service_directory_service, endpoint_filter, hostname, and
@@ -28,6 +29,12 @@ EXAMPLES
             --endpoint-filter="foo > bar" --hostname="newhostname.foo" \
             --server-certificates-files=foo.pem,bar.pem
 
+    The following command updates an ekm-connection named laplace
+    key_management_mode within location us-east1:
+
+        $ gcloud kms ekm-connections update laplace --location=us-east1 \
+            --key-management-mode=manual
+
 POSITIONAL ARGUMENTS
      Ekmconnection resource - The KMS ekm connection resource. The arguments in
      this group can be used to specify the attributes of this resource. (NOTE)
@@ -71,6 +78,22 @@ FLAGS
         The resource name of the Service Directory service pointing to an EKM
         replica.
 
+     Specifies the key management mode for the EkmConnection and associated
+     fields.
+
+       --crypto-space-path=CRYPTO_SPACE_PATH
+          Crypto space path for the EkmConnection. Required during
+          EkmConnection creation if --key-management-mode=cloud-kms.
+
+       --key-management-mode=KEY_MANAGEMENT_MODE
+          Key management mode of the ekm connection. An EkmConnection in
+          cloud-kms mode means Cloud KMS will attempt to create and manage the
+          key material that resides on the EKM for crypto keys created with
+          this EkmConnection. An EkmConnection in manual mode means the
+          external key material will not be managed by Cloud KMS. Omitting the
+          flag defaults to manual. KEY_MANAGEMENT_MODE must be one of: manual,
+          cloud-kms.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,

gcloud/kms/help

@@ -28,6 +28,9 @@ GCLOUD WIDE FLAGS
 GROUPS
     GROUP is one of the following:
 
+     ekm-config
+        Update and retrieve the EkmConfig.
+
      ekm-connections
         Create and manage ekm connections.