---
layout: docs
page_title: GCP Cloud KMS configuration
description: >-
  Learn about using the GCP Cloud KMS for key management and configuring parameters and authentication. View an example gcpkms configuration.
---

⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
> [!IMPORTANT]  
> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com.
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️

# `gcpckms` KMS

The GCP Cloud KMS configures Boundary to use GCP Cloud KMS for key management.

The GCP Cloud KMS seal is activated by the presence of a `seal "gcpckms"` block in Boundary's configuration file.

## `gcpckms` example

This example shows configuring GCP Cloud KMS through the Boundary
configuration file by providing all the required values:

```hcl
kms "gcpckms" {
  purpose     = "root"
  credentials = "/usr/boundary/boundary-project-user-creds.json"
  project     = "boundary-project"
  region      = "global"
  key_ring    = "boundary-keyring"
  crypto_key  = "boundary-key"
  key_id      = "global_worker-auth"
}
```

## `gcpckms` parameters

These parameters apply to the `kms` stanza in the Boundary configuration file:

- `purpose` - Purpose of this KMS, acceptable values are: `worker-auth`, `worker-auth-storage`,
   `root`, `previous-root`, `recovery`, `bsr`, or `config`.

- `credentials` `(string: <required>)`: The path to the credentials JSON file
  to use. May be also specified by the `GOOGLE_CREDENTIALS` or
  `GOOGLE_APPLICATION_CREDENTIALS` environment variable or set automatically if
  running under Google App Engine, Google Compute Engine or Google Kubernetes
  Engine.

- `project` `(string: <required>)`: The GCP project ID to use. May also be
  specified by the `GOOGLE_PROJECT` environment variable.

- `region` `(string: "us-east-1")`: The GCP region/location where the key ring
  lives. May also be specified by the `GOOGLE_REGION` environment variable.

- `key_ring` `(string: <required>)`: The GCP CKMS key ring to use. May also be specified
  by the `GCPCKMS_WRAPPER_KEY_RING` environment variable.

- `crypto_key` `(string: <required>)`: The GCP CKMS crypto key to use for
  encryption and decryption. May also be specified by the `GCPCKMS_WRAPPER_CRYPTO_KEY`
  environment variable.

- `key_id` - The unique name of this key.
It is used to identify the key when you perform a root key migration.
You can use the `key_id` field with all KMS stanzas.

## Authentication &amp; permissions

Authentication-related values must be provided, either as environment
variables or as configuration parameters.

GCP authentication values:

- `GOOGLE_CREDENTIALS` or `GOOGLE_APPLICATION_CREDENTIALS`
- `GOOGLE_PROJECT`
- `GOOGLE_REGION`
