Reference documentation and code samples for the Google Cloud Key Management Service v1 API enum EkmConnection.Types.KeyManagementMode.
[KeyManagementMode][google.cloud.kms.v1.EkmConnection.KeyManagementMode]
describes who can perform control plane cryptographic operations using this
[EkmConnection][google.cloud.kms.v1.EkmConnection].
All [CryptoKeys][google.cloud.kms.v1.CryptoKey] created with this
[EkmConnection][google.cloud.kms.v1.EkmConnection] use EKM-side key
management operations initiated from Cloud KMS. This means that:
When a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
associated with this [EkmConnection][google.cloud.kms.v1.EkmConnection]
is
created, the EKM automatically generates new key material and a new
key path. The caller cannot supply the key path of pre-existing
external key material.
Destruction of external key material associated with this
[EkmConnection][google.cloud.kms.v1.EkmConnection] can be requested by
calling
[DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion].
Automatic rotation of key material is supported.
Manual
EKM-side key management operations on
[CryptoKeys][google.cloud.kms.v1.CryptoKey] created with this
[EkmConnection][google.cloud.kms.v1.EkmConnection] must be initiated from
the EKM directly and cannot be performed from Cloud KMS. This means that:
When creating a
[CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] associated with
this
[EkmConnection][google.cloud.kms.v1.EkmConnection], the caller must
supply the key path of pre-existing external key material that will be
linked to the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
Destruction of external key material cannot be requested via the
Cloud KMS API and must be performed directly in the EKM.
Automatic rotation of key material is not supported.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eThis document provides reference documentation for the \u003ccode\u003eEkmConnection.Types.KeyManagementMode\u003c/code\u003e enum within the Google Cloud Key Management Service v1 API, detailing how cryptographic operations are managed.\u003c/p\u003e\n"],["\u003cp\u003eThe latest version available for \u003ccode\u003eEkmConnection.Types.KeyManagementMode\u003c/code\u003e is 3.16.0, with multiple prior versions listed, going back to version 2.2.0.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eKeyManagementMode\u003c/code\u003e enum offers three modes: \u003ccode\u003eCloudKms\u003c/code\u003e for Cloud KMS-initiated management, \u003ccode\u003eManual\u003c/code\u003e for EKM-initiated management, and \u003ccode\u003eUnspecified\u003c/code\u003e when no mode is specified.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003eCloudKms\u003c/code\u003e mode allows Cloud KMS to automatically generate and rotate key material, while \u003ccode\u003eManual\u003c/code\u003e mode requires users to provide pre-existing key material paths and manage rotation and destruction outside of Cloud KMS.\u003c/p\u003e\n"]]],[],null,["# Google Cloud Key Management Service v1 API - Enum EkmConnection.Types.KeyManagementMode (3.18.0)\n\nVersion latestkeyboard_arrow_down\n\n- [3.18.0 (latest)](/dotnet/docs/reference/Google.Cloud.Kms.V1/latest/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.17.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.17.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.16.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.16.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.15.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.15.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.14.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.14.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.13.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.13.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.12.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.12.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.11.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.11.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.10.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.10.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.9.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.9.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.8.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.8.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.7.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.7.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.6.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.6.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.5.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.5.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.4.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.4.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.3.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.3.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.2.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.2.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.1.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.1.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [3.0.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/3.0.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [2.9.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/2.9.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [2.8.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/2.8.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [2.7.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/2.7.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [2.6.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/2.6.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [2.5.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/2.5.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [2.4.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/2.4.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [2.3.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/2.3.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode)\n- [2.2.0](/dotnet/docs/reference/Google.Cloud.Kms.V1/2.2.0/Google.Cloud.Kms.V1.EkmConnection.Types.KeyManagementMode) \n\n public enum EkmConnection.Types.KeyManagementMode\n\nReference documentation and code samples for the Google Cloud Key Management Service v1 API enum EkmConnection.Types.KeyManagementMode.\n\n\\[KeyManagementMode\\]\\[google.cloud.kms.v1.EkmConnection.KeyManagementMode\\]\ndescribes who can perform control plane cryptographic operations using this\n\\[EkmConnection\\]\\[google.cloud.kms.v1.EkmConnection\\].\n\nNamespace\n---------\n\n[Google.Cloud.Kms.V1](/dotnet/docs/reference/Google.Cloud.Kms.V1/latest/Google.Cloud.Kms.V1)\n\nAssembly\n--------\n\nGoogle.Cloud.Kms.V1.dll"]]
