AnImportJobcan be used to createCryptoKeysandCryptoKeyVersionsusing
pre-existing key material, generated outside of Cloud KMS.
When anImportJobis created, Cloud
KMS will generate a "wrapping key", which is a public/private key
pair. You use the wrapping key to encrypt (also known as wrap) the
pre-existing key material to protect it during the import process.
The nature of the wrapping key depends on the choice ofimport_method. When
the wrapping key generation is complete, thestatewill be set toACTIVEand
thepublic_keycan be
fetched. The fetched public key can then be used to wrap your
pre-existing key material.
Once the key material is wrapped, it can be imported into a newCryptoKeyVersionin an
existingCryptoKeyby callingImportCryptoKeyVersion.
MultipleCryptoKeyVersionscan be imported with a singleImportJob. Cloud KMS uses the
private key portion of the wrapping key to unwrap the key material.
Only Cloud KMS has access to the private key.
AnImportJobexpires 3 days after
it is created. Once expired, Cloud KMS will no longer be able to
import or unwrap any key material that was wrapped with theImportJob's public key.
For more information, seeImporting a
key <https://cloud.google.com/kms/docs/importing-a-key>__.
Attributes
Name
Description
name
str Output only. The resource name for thisImportJobin the formatprojects/*/locations/*/keyRings/*/importJobs/*.
google.cloud.kms_v1.types.ProtectionLevel Required. Immutable. The protection level of theImportJob. This must match
theprotection_levelof theversion_templateon theCryptoKeyyou
attempt to import into.
create_time
google.protobuf.timestamp_pb2.Timestamp Output only. The time at which thisImportJobwas created.
generate_time
google.protobuf.timestamp_pb2.Timestamp Output only. The time thisImportJob's key material
was generated.
expire_time
google.protobuf.timestamp_pb2.Timestamp Output only. The time at which thisImportJobis scheduled for
expiration and can no longer be used to import key material.
expire_event_time
google.protobuf.timestamp_pb2.Timestamp Output only. The time thisImportJobexpired. Only
present ifstateisEXPIRED.
google.cloud.kms_v1.types.KeyOperationAttestation Output only. Statement that was generated and signed by the
key creator (for example, an HSM) at key creation time. Use
this statement to verify attributes of the key as stored on
the HSM, independently of Google. Only present if the chosenImportMethodis one with a protection level ofHSM.
Classes
ImportJobState
ImportJobState(value)
The state of theImportJob,
indicating if it can be used.
ImportMethod
ImportMethod(value)
ImportMethoddescribes
the key wrapping method chosen for thisImportJob.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,["# Class ImportJob (3.5.1)\n\nVersion latestkeyboard_arrow_down\n\n- [3.5.1 (latest)](/python/docs/reference/cloudkms/latest/google.cloud.kms_v1.types.ImportJob)\n- [3.5.0](/python/docs/reference/cloudkms/3.5.0/google.cloud.kms_v1.types.ImportJob)\n- [3.4.0](/python/docs/reference/cloudkms/3.4.0/google.cloud.kms_v1.types.ImportJob)\n- [3.3.1](/python/docs/reference/cloudkms/3.3.1/google.cloud.kms_v1.types.ImportJob)\n- [3.2.2](/python/docs/reference/cloudkms/3.2.2/google.cloud.kms_v1.types.ImportJob)\n- [3.1.1](/python/docs/reference/cloudkms/3.1.1/google.cloud.kms_v1.types.ImportJob)\n- [3.0.0](/python/docs/reference/cloudkms/3.0.0/google.cloud.kms_v1.types.ImportJob)\n- [2.24.2](/python/docs/reference/cloudkms/2.24.2/google.cloud.kms_v1.types.ImportJob)\n- [2.23.0](/python/docs/reference/cloudkms/2.23.0/google.cloud.kms_v1.types.ImportJob)\n- [2.22.0](/python/docs/reference/cloudkms/2.22.0/google.cloud.kms_v1.types.ImportJob)\n- [2.21.4](/python/docs/reference/cloudkms/2.21.4/google.cloud.kms_v1.types.ImportJob)\n- [2.20.0](/python/docs/reference/cloudkms/2.20.0/google.cloud.kms_v1.types.ImportJob)\n- [2.19.2](/python/docs/reference/cloudkms/2.19.2/google.cloud.kms_v1.types.ImportJob)\n- [2.18.0](/python/docs/reference/cloudkms/2.18.0/google.cloud.kms_v1.types.ImportJob)\n- [2.17.0](/python/docs/reference/cloudkms/2.17.0/google.cloud.kms_v1.types.ImportJob)\n- [2.16.1](/python/docs/reference/cloudkms/2.16.1/google.cloud.kms_v1.types.ImportJob)\n- [2.15.0](/python/docs/reference/cloudkms/2.15.0/google.cloud.kms_v1.types.ImportJob)\n- [2.14.1](/python/docs/reference/cloudkms/2.14.1/google.cloud.kms_v1.types.ImportJob)\n- [2.13.0](/python/docs/reference/cloudkms/2.13.0/google.cloud.kms_v1.types.ImportJob)\n- [2.12.3](/python/docs/reference/cloudkms/2.12.3/google.cloud.kms_v1.types.ImportJob)\n- [2.11.2](/python/docs/reference/cloudkms/2.11.2/google.cloud.kms_v1.types.ImportJob)\n- [2.10.1](/python/docs/reference/cloudkms/2.10.1/google.cloud.kms_v1.types.ImportJob)\n- [2.9.0](/python/docs/reference/cloudkms/2.9.0/google.cloud.kms_v1.types.ImportJob)\n- [2.8.0](/python/docs/reference/cloudkms/2.8.0/google.cloud.kms_v1.types.ImportJob)\n- [2.7.0](/python/docs/reference/cloudkms/2.7.0/google.cloud.kms_v1.types.ImportJob)\n- [2.6.1](/python/docs/reference/cloudkms/2.6.1/google.cloud.kms_v1.types.ImportJob)\n- [2.5.0](/python/docs/reference/cloudkms/2.5.0/google.cloud.kms_v1.types.ImportJob)\n- [2.4.3](/python/docs/reference/cloudkms/2.4.3/google.cloud.kms_v1.types.ImportJob)\n- [2.3.0](/python/docs/reference/cloudkms/2.3.0/google.cloud.kms_v1.types.ImportJob)\n- [2.2.0](/python/docs/reference/cloudkms/2.2.0/google.cloud.kms_v1.types.ImportJob)\n- [2.1.0](/python/docs/reference/cloudkms/2.1.0/google.cloud.kms_v1.types.ImportJob)\n- [2.0.1](/python/docs/reference/cloudkms/2.0.1/google.cloud.kms_v1.types.ImportJob)\n- [1.4.2](/python/docs/reference/cloudkms/1.4.2/google.cloud.kms_v1.types.ImportJob)\n- [1.3.0](/python/docs/reference/cloudkms/1.3.0/google.cloud.kms_v1.types.ImportJob)\n- [1.2.1](/python/docs/reference/cloudkms/1.2.1/google.cloud.kms_v1.types.ImportJob)\n- [1.1.0](/python/docs/reference/cloudkms/1.1.0/google.cloud.kms_v1.types.ImportJob) \n\n ImportJob(mapping=None, *, ignore_unknown_fields=False, **kwargs)\n\nAn ImportJob can be used to create\nCryptoKeys and\nCryptoKeyVersions using\npre-existing key material, generated outside of Cloud KMS.\n\nWhen an ImportJob is created, Cloud\nKMS will generate a \"wrapping key\", which is a public/private key\npair. You use the wrapping key to encrypt (also known as wrap) the\npre-existing key material to protect it during the import process.\nThe nature of the wrapping key depends on the choice of\nimport_method. When\nthe wrapping key generation is complete, the\nstate will be set to\nACTIVE and\nthe public_key can be\nfetched. The fetched public key can then be used to wrap your\npre-existing key material.\n\nOnce the key material is wrapped, it can be imported into a new\nCryptoKeyVersion in an\nexisting CryptoKey by calling\nImportCryptoKeyVersion.\nMultiple CryptoKeyVersions\ncan be imported with a single\nImportJob. Cloud KMS uses the\nprivate key portion of the wrapping key to unwrap the key material.\nOnly Cloud KMS has access to the private key.\n\nAn ImportJob expires 3 days after\nit is created. Once expired, Cloud KMS will no longer be able to\nimport or unwrap any key material that was wrapped with the\nImportJob's public key.\n\nFor more information, see `Importing a\nkey \u003chttps://cloud.google.com/kms/docs/importing-a-key\u003e`__.\n\nClasses\n-------\n\n### ImportJobState\n\n ImportJobState(value)\n\nThe state of the ImportJob,\nindicating if it can be used.\n\n### ImportMethod\n\n ImportMethod(value)\n\nImportMethod describes\nthe key wrapping method chosen for this\nImportJob.\n\n### WrappingPublicKey\n\n WrappingPublicKey(mapping=None, *, ignore_unknown_fields=False, **kwargs)\n\nThe public key component of the wrapping key. For details of the\ntype of key this public key corresponds to, see the\nImportMethod."]]
