Search by

symfony / google-cloud-key-management

fabpot

Symfony Google Cloud Key Management Bridge

Package info

github.com/symfony/google-cloud-key-management

Homepage

Type:symfony-key-management-bridge

pkg:composer/symfony/google-cloud-key-management

Security

Advisories: 0

Aikido package health analysis

Transparency log

Fund package maintenance!

fabpot

nicolas-grekas

symfony.com/sponsor

Tidelift

Statistics

Installs: 0

Dependents: 0

Suggesters: 0

Stars: 0

8.2.x-dev 2026-09-14 08:33 UTC

Requires

Requires (Dev)

None

Suggests

None

Provides

None

Conflicts

None

Replaces

None

MIT eced94260153686d43c2e3d15de3f78993941a91

googleencryptiongcpkmscloud kms

Published on Packagist.org on 2026-09-14 08:46 UTC

This package is auto-updated.

Last update: 2026-09-14 08:46:03 UTC

README

Provides an implementation of Symfony\Component\KeyManagement\EncrypterInterface, Symfony\Component\KeyManagement\DecrypterInterface and Symfony\Component\KeyManagement\DataKeyGeneratorInterface backed by Google Cloud KMS over its REST API. Encryption, decryption and data-key wrapping never expose the master key: Cloud KMS performs them server-side.

This Bridge is experimental. Experimental features are not covered by Symfony's Backward Compatibility Promise.

use Symfony\Component\HttpClient\HttpClient;
use Symfony\Component\KeyManagement\Bridge\GoogleCloudKms\GoogleCloudKms;
use Symfony\Component\KeyManagement\Bridge\GoogleCloudKms\ServiceAccountTokenProvider;

$client = HttpClient::createForBaseUri('https://cloudkms.googleapis.com/v1/');
$tokens = ServiceAccountTokenProvider::fromJsonFile($client, '/path/to/service-account.json');

$kms = new GoogleCloudKms($client, $tokens);

// $keyId is the Cloud KMS resource name; pin a version with
// `.../cryptoKeyVersions/<n>` if needed.
$ciphertext = $kms->encrypt(
    'projects/my-project/locations/global/keyRings/app/cryptoKeys/master',
    'hello world',
);
$plaintext = $kms->decrypt($ciphertext);

$dataKey = $kms->generateDataKey(
    'projects/my-project/locations/global/keyRings/app/cryptoKeys/master',
    32,
);
$result = $dataKey->use(fn (string $dek): string => /* local AEAD encrypt */);

Authentication

The bundled ServiceAccountTokenProvider covers the most common case: a JSON service-account key downloaded from the GCP console. The provider signs a JWT with the account's RSA private key (RS256) and exchanges it for an OAuth2 access token at the Google token endpoint, caching the result until 60s before expiration.

For Application Default Credentials, the GCE/GKE/Cloud Run metadata server, Workload Identity Federation, or any other flow, implement TokenProviderInterface against your platform.

DSN scheme

gcp-kms://default?credentials=/path/to/service-account.json

The host default selects the public Cloud KMS endpoint (https://cloudkms.googleapis.com/v1/); any other host is treated as a custom endpoint. The credentials option must point at a service-account JSON key file.

AAD support

The $aad argument maps to Cloud KMS's additionalAuthenticatedData, which is integrity-protected through the AEAD cipher used by the master key. AAD is treated as opaque bytes; structured callers should serialize to a stable form (e.g. canonical JSON) themselves.

Resources