blob: 97531502672214e46a7c969b8fccc62a4d6e1da7 [file] [log] [blame]
:mod:`airflow.contrib.hooks.gcp_kms_hook`
=========================================
.. py:module:: airflow.contrib.hooks.gcp_kms_hook
Module Contents
---------------
.. function:: _b64encode(s)
Base 64 encodes a bytes object to a string
.. function:: _b64decode(s)
Base 64 decodes a string to bytes.
.. py:class:: GoogleCloudKMSHook(gcp_conn_id='google_cloud_default', delegate_to=None)
Bases: :class:`airflow.contrib.hooks.gcp_api_base_hook.GoogleCloudBaseHook`
Interact with Google Cloud KMS. This hook uses the Google Cloud Platform
connection.
.. method:: get_conn(self)
Returns a KMS service object.
:rtype: googleapiclient.discovery.Resource
.. method:: encrypt(self, key_name, plaintext, authenticated_data=None)
Encrypts a plaintext message using Google Cloud KMS.
:param key_name: The Resource Name for the key (or key version)
to be used for encyption. Of the form
``projects/*/locations/*/keyRings/*/cryptoKeys/**``
:type key_name: str
:param plaintext: The message to be encrypted.
:type plaintext: bytes
:param authenticated_data: Optional additional authenticated data that
must also be provided to decrypt the message.
:type authenticated_data: bytes
:return: The base 64 encoded ciphertext of the original message.
:rtype: str
.. method:: decrypt(self, key_name, ciphertext, authenticated_data=None)
Decrypts a ciphertext message using Google Cloud KMS.
:param key_name: The Resource Name for the key to be used for decyption.
Of the form ``projects/*/locations/*/keyRings/*/cryptoKeys/**``
:type key_name: str
:param ciphertext: The message to be decrypted.
:type ciphertext: str
:param authenticated_data: Any additional authenticated data that was
provided when encrypting the message.
:type authenticated_data: bytes
:return: The original message.
:rtype: bytes