EncryptionInfo

  • The EncryptionInfo object provides information about the encryption used for ingested data.

  • GcpWrappedKeyInfo is a type of wrapped key information specific to Google Cloud Platform.

  • GcpWrappedKeyInfo includes details such as the key type, Workload Identity pool provider, KMS resource ID, and the base64 encoded encrypted data encryption key.

  • The KeyType enum specifies the algorithm used for encryption, with XCHACHA20_POLY1305 being one of the defined types.

Encryption information for the data being ingested.

JSON representation 
{

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "gcpWrappedKeyInfo": {
    object (GcpWrappedKeyInfo)
  },
  "awsWrappedKeyInfo": {
    object (AwsWrappedKeyInfo)
  },
  "coordinatorKeyInfo": {
    object (CoordinatorKeyInfo)
  }
  // End of mutually exclusive fields.
}
Fields
The wrapped key used to encrypt the data. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
gcpWrappedKeyInfo

object (GcpWrappedKeyInfo)

Google Cloud Platform wrapped key information.
awsWrappedKeyInfo

object (AwsWrappedKeyInfo)

Amazon Web Services wrapped key information.
coordinatorKeyInfo

object (CoordinatorKeyInfo)

Key information for the chosen coordinator key.

This is not supported for the events.ingest, audienceMembers.ingest, and audienceMembers.remove methods.
End of mutually exclusive fields.

GcpWrappedKeyInfo

Information about the Google Cloud Platform wrapped key.

JSON representation 
{
  "keyType": enum (KeyType),
  "wipProvider": string,
  "kekUri": string,
  "encryptedDek": string
}
Fields
keyType

enum (KeyType)

Required. The type of algorithm used to encrypt the data.
wipProvider

string

Required. The Workload Identity pool provider required to use KEK.
kekUri

string

Required. Google Cloud Platform Cloud Key Management Service resource ID. Should be in the format of projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{key} or gcp-kms://projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{key}
encryptedDek

string

Required. The base64 encoded encrypted data encryption key.

KeyType

The type of algorithm used to encrypt the data.

Enums
KEY_TYPE_UNSPECIFIED Unspecified key type. Should never be used.
XCHACHA20_POLY1305 Algorithm XChaCha20-Poly1305

AwsWrappedKeyInfo

A data encryption key wrapped by an AWS KMS key.

JSON representation 
{
  "keyType": enum (KeyType),
  "roleArn": string,
  "kekUri": string,
  "encryptedDek": string
}
Fields
keyType

enum (KeyType)

Required. The type of algorithm used to encrypt the data.
roleArn

string

Required. The Amazon Resource Name of the IAM Role to assume for KMS decryption access. Should be in the format of arn:{partition}:iam::{accountId}:role/{role_name}
kekUri

string

Required. The URI of the AWS KMS key used to decrypt the DEK. Should be in the format of arn:{partition}:kms:{region}:{accountId}:key/{keyId} or aws-kms://arn:{partition}:kms:{region}:{accountId}:key/{keyId}
encryptedDek

string

Required. The base64 encoded encrypted data encryption key.

KeyType

The type of algorithm used to encrypt the data.

Enums
KEY_TYPE_UNSPECIFIED Unspecified key type. Should never be used.
XCHACHA20_POLY1305 Algorithm XChaCha20-Poly1305

CoordinatorKeyInfo

Information about the coordinator key.

JSON representation 
{
  "keyId": string
}
Fields
keyId

string

Required. The ID of the chosen coordinator key.