mariusciotir / terraform-misc

Below commands were executed manually

export KMS_PROJECT_ID="<project_id>"

gcloud beta services identity create
--service "secretmanager.googleapis.com"
--project "${KMS_PROJECT_ID}"

output : [e-mail]

gcloud kms keyrings create "secret-manager-cmek"
--project "${KMS_PROJECT_ID}"
--location "us-east1"

gcloud kms keys create "my-cmek-key"
--project "${KMS_PROJECT_ID}"
--location "us-east1"
--keyring "secret-manager-cmek"
--purpose "encryption"

gcloud kms keys add-iam-policy-binding "my-cmek-key"
--project "${KMS_PROJECT_ID}"
--location "us-east1"
--keyring "secret-manager-cmek"
--member "serviceAccount:[e-mail]"
--role "roles/cloudkms.cryptoKeyEncrypterDecrypter"

gcloud secrets replication update secret-test
--set-kms-key="projects/${KMS_PROJECT_ID}/locations/us-east1/keyRings/secret-manager-cmek/cryptoKeys/my-cmek-key"
--location=us-east1
--project "${KMS_PROJECT_ID}"