Copy a table with customer-managed encryption keys (CMEK)

  import 
  
 ( 
  
 "context" 
  
 "fmt" 
  
 "cloud.google.com/go/bigquery" 
 ) 
 // copyTableWithCMEK demonstrates creating a copy of a table and ensuring the copied data is 
 // protected with a customer managed encryption key. 
 func 
  
 copyTableWithCMEK 
 ( 
 projectID 
 , 
  
 datasetID 
 , 
  
 tableID 
  
 string 
 ) 
  
 error 
  
 { 
  
 // projectID := "my-project-id" 
  
 // datasetID := "mydataset" 
  
 // tableID := "mytable" 
  
 ctx 
  
 := 
  
 context 
 . 
 Background 
 () 
  
 client 
 , 
  
 err 
  
 := 
  
 bigquery 
 . 
 NewClient 
 ( 
 ctx 
 , 
  
 projectID 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "bigquery.NewClient: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 defer 
  
 client 
 . 
 Close 
 () 
  
 srcTable 
  
 := 
  
 client 
 . 
  DatasetInProject 
 
 ( 
 "bigquery-public-data" 
 , 
  
 "samples" 
 ). 
 Table 
 ( 
 "shakespeare" 
 ) 
  
 copier 
  
 := 
  
 client 
 . 
 Dataset 
 ( 
 datasetID 
 ). 
 Table 
 ( 
 tableID 
 ). 
  CopierFrom 
 
 ( 
 srcTable 
 ) 
  
 copier 
 . 
 DestinationEncryptionConfig 
  
 = 
  
& bigquery 
 . 
  EncryptionConfig 
 
 { 
  
 // TODO: Replace this key with a key you have created in Cloud KMS. 
  
 KMSKeyName 
 : 
  
 "projects/cloud-samples-tests/locations/us-central1/keyRings/test/cryptoKeys/test" 
 , 
  
 } 
  
 job 
 , 
  
 err 
  
 := 
  
 copier 
 . 
 Run 
 ( 
 ctx 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 err 
  
 } 
  
 status 
 , 
  
 err 
  
 := 
  
 job 
 . 
 Wait 
 ( 
 ctx 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 err 
  
 } 
  
 if 
  
 err 
  
 := 
  
 status 
 . 
  Err 
 
 (); 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 err 
  
 } 
  
 return 
  
 nil 
 } 
 

  import 
  
 com.google.cloud.bigquery. BigQuery 
 
 ; 
 import 
  
 com.google.cloud.bigquery. BigQueryException 
 
 ; 
 import 
  
 com.google.cloud.bigquery. BigQueryOptions 
 
 ; 
 import 
  
 com.google.cloud.bigquery. CopyJobConfiguration 
 
 ; 
 import 
  
 com.google.cloud.bigquery. EncryptionConfiguration 
 
 ; 
 import 
  
 com.google.cloud.bigquery. Job 
 
 ; 
 import 
  
 com.google.cloud.bigquery. JobInfo 
 
 ; 
 import 
  
 com.google.cloud.bigquery. TableId 
 
 ; 
 // Sample to copy a cmek table 
 public 
  
 class 
 CopyTableCmek 
  
 { 
  
 public 
  
 static 
  
 void 
  
 main 
 ( 
 String 
 [] 
  
 args 
 ) 
  
 { 
  
 // TODO(developer): Replace these variables before running the sample. 
  
 String 
  
 destinationDatasetName 
  
 = 
  
 "MY_DESTINATION_DATASET_NAME" 
 ; 
  
 String 
  
 destinationTableId 
  
 = 
  
 "MY_DESTINATION_TABLE_NAME" 
 ; 
  
 String 
  
 sourceDatasetName 
  
 = 
  
 "MY_SOURCE_DATASET_NAME" 
 ; 
  
 String 
  
 sourceTableId 
  
 = 
  
 "MY_SOURCE_TABLE_NAME" 
 ; 
  
 String 
  
 kmsKeyName 
  
 = 
  
 "MY_KMS_KEY_NAME" 
 ; 
  
  EncryptionConfiguration 
 
  
 encryption 
  
 = 
  
  EncryptionConfiguration 
 
 . 
 newBuilder 
 (). 
 setKmsKeyName 
 ( 
 kmsKeyName 
 ). 
 build 
 (); 
  
 copyTableCmek 
 ( 
  
 sourceDatasetName 
 , 
  
 sourceTableId 
 , 
  
 destinationDatasetName 
 , 
  
 destinationTableId 
 , 
  
 encryption 
 ); 
  
 } 
  
 public 
  
 static 
  
 void 
  
 copyTableCmek 
 ( 
  
 String 
  
 sourceDatasetName 
 , 
  
 String 
  
 sourceTableId 
 , 
  
 String 
  
 destinationDatasetName 
 , 
  
 String 
  
 destinationTableId 
 , 
  
  EncryptionConfiguration 
 
  
 encryption 
 ) 
  
 { 
  
 try 
  
 { 
  
 // Initialize client that will be used to send requests. This client only needs to be created 
  
 // once, and can be reused for multiple requests. 
  
  BigQuery 
 
  
 bigquery 
  
 = 
  
  BigQueryOptions 
 
 . 
 getDefaultInstance 
 (). 
 getService 
 (); 
  
  TableId 
 
  
 sourceTable 
  
 = 
  
  TableId 
 
 . 
 of 
 ( 
 sourceDatasetName 
 , 
  
 sourceTableId 
 ); 
  
  TableId 
 
  
 destinationTable 
  
 = 
  
  TableId 
 
 . 
 of 
 ( 
 destinationDatasetName 
 , 
  
 destinationTableId 
 ); 
  
 // For more information on CopyJobConfiguration see: 
  
 // https://googleapis.dev/java/google-cloud-clients/latest/com/google/cloud/bigquery/JobConfiguration.html 
  
  CopyJobConfiguration 
 
  
 configuration 
  
 = 
  
  CopyJobConfiguration 
 
 . 
 newBuilder 
 ( 
 destinationTable 
 , 
  
 sourceTable 
 ) 
  
 . 
 setDestinationEncryptionConfiguration 
 ( 
 encryption 
 ) 
  
 . 
 build 
 (); 
  
 // For more information on Job see: 
  
 // https://googleapis.dev/java/google-cloud-clients/latest/index.html?com/google/cloud/bigquery/package-summary.html 
  
  Job 
 
  
 job 
  
 = 
  
 bigquery 
 . 
  create 
 
 ( 
 JobInfo 
 . 
 of 
 ( 
 configuration 
 )); 
  
 // Blocks until this job completes its execution, either failing or succeeding. 
  
  Job 
 
  
 completedJob 
  
 = 
  
 job 
 . 
  waitFor 
 
 (); 
  
 if 
  
 ( 
 completedJob 
  
 == 
  
 null 
 ) 
  
 { 
  
 System 
 . 
 out 
 . 
 println 
 ( 
 "Job not executed since it no longer exists." 
 ); 
  
 return 
 ; 
  
 } 
  
 else 
  
 if 
  
 ( 
 completedJob 
 . 
 getStatus 
 (). 
 getError 
 () 
  
 != 
  
 null 
 ) 
  
 { 
  
 System 
 . 
 out 
 . 
 println 
 ( 
  
 "BigQuery was unable to copy table due to an error: \n" 
  
 + 
  
 job 
 . 
 getStatus 
 (). 
 getError 
 ()); 
  
 return 
 ; 
  
 } 
  
 System 
 . 
 out 
 . 
 println 
 ( 
 "Table cmek copied successfully." 
 ); 
  
 } 
  
 catch 
  
 ( 
  BigQueryException 
 
  
 | 
  
 InterruptedException 
  
 e 
 ) 
  
 { 
  
 System 
 . 
 out 
 . 
 println 
 ( 
 "Table cmek copying job was interrupted. \n" 
  
 + 
  
 e 
 . 
 toString 
 ()); 
  
 } 
  
 } 
 } 
 

  from 
  
 google.cloud 
  
 import 
  bigquery 
 
 # Construct a BigQuery client object. 
 client 
 = 
  bigquery 
 
 . 
  Client 
 
 () 
 # TODO(developer): Set dest_table_id to the ID of the destination table. 
 # dest_table_id = "your-project.your_dataset.your_table_name" 
 # TODO(developer): Set orig_table_id to the ID of the original table. 
 # orig_table_id = "your-project.your_dataset.your_table_name" 
 # Set the encryption key to use for the destination. 
 # TODO(developer): Replace this key with a key you have created in KMS. 
 # kms_key_name = "projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}".format( 
 #     your-project, location, your-ring, your-key 
 # ) 
 job_config 
 = 
  bigquery 
 
 . 
  CopyJobConfig 
 
 ( 
 destination_encryption_configuration 
 = 
  bigquery 
 
 . 
  EncryptionConfiguration 
 
 ( 
 kms_key_name 
 = 
 kms_key_name 
 ) 
 ) 
 job 
 = 
 client 
 . 
  copy_table 
 
 ( 
 orig_table_id 
 , 
 dest_table_id 
 , 
 job_config 
 = 
 job_config 
 ) 
  job 
 
 . 
 result 
 () 
 # Wait for the job to complete. 
 dest_table 
 = 
 client 
 . 
  get_table 
 
 ( 
 dest_table_id 
 ) 
 # Make an API request. 
 if 
 dest_table 
 . 
 encryption_configuration 
 . 
  kms_key_name 
 
 == 
 kms_key_name 
 : 
 print 
 ( 
 "A copy of the table created" 
 )