import * as pulumi from "@pulumi/pulumi";
/**
 * Describes the customer-managed encryption key (CMEK) settings associated with a project.
 *
 * To get more information about Service, see:
 *
 * * [API documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/projects/getCmekSettings)
 * * [Enable CMEK](https://cloud.google.com/logging/docs/routing/managed-encryption-storage#enable).
 *
 * ## Example Usage
 *
 * ### Logging Project Cmek Settings Basic
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const cmekSettings = gcp.logging.getProjectCmekSettings({
 *     project: "my-project-name",
 * });
 * ```
 */
export declare function getProjectCmekSettings(args: GetProjectCmekSettingsArgs, opts?: pulumi.InvokeOptions): Promise<GetProjectCmekSettingsResult>;
/**
 * A collection of arguments for invoking getProjectCmekSettings.
 */
export interface GetProjectCmekSettingsArgs {
    /**
     * The resource name for the configured Cloud KMS key.
     * KMS key name format:
     * `'projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]'`
     * To enable CMEK for the bucket, set this field to a valid kmsKeyName for which the associated service account has the required cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key.
     * The Cloud KMS key used by the bucket can be updated by changing the kmsKeyName to a new valid key name. Encryption operations that are in progress will be completed with the key that was in use when they started. Decryption operations will be completed using the key that was used at the time of encryption unless access to that key has been revoked.
     * See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.
     */
    kmsKeyName?: string;
    /**
     * The ID of the project.
     */
    project: string;
}
/**
 * A collection of values returned by getProjectCmekSettings.
 */
export interface GetProjectCmekSettingsResult {
    /**
     * The provider-assigned unique ID for this managed resource.
     */
    readonly id: string;
    /**
     * The resource name for the configured Cloud KMS key.
     * KMS key name format:
     * `'projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]'`
     * To enable CMEK for the bucket, set this field to a valid kmsKeyName for which the associated service account has the required cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key.
     * The Cloud KMS key used by the bucket can be updated by changing the kmsKeyName to a new valid key name. Encryption operations that are in progress will be completed with the key that was in use when they started. Decryption operations will be completed using the key that was used at the time of encryption unless access to that key has been revoked.
     * See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.
     */
    readonly kmsKeyName?: string;
    /**
     * The CryptoKeyVersion resource name for the configured Cloud KMS key.
     * KMS key name format:
     * `'projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[VERSION]'`
     * For example:
     * "projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key/cryptoKeyVersions/1"
     * This is a read-only field used to convey the specific configured CryptoKeyVersion of kmsKey that has been configured. It will be populated in cases where the CMEK settings are bound to a single key version.
     */
    readonly kmsKeyVersionName: string;
    /**
     * The resource name of the CMEK settings.
     */
    readonly name: string;
    readonly project: string;
    /**
     * The service account associated with a project for which CMEK will apply.
     * Before enabling CMEK for a logging bucket, you must first assign the cloudkms.cryptoKeyEncrypterDecrypter role to the service account associated with the project for which CMEK will apply. Use [v2.getCmekSettings](https://cloud.google.com/logging/docs/reference/v2/rest/v2/TopLevel/getCmekSettings#google.logging.v2.ConfigServiceV2.GetCmekSettings) to obtain the service account ID.
     * See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.
     */
    readonly serviceAccountId: string;
}
/**
 * Describes the customer-managed encryption key (CMEK) settings associated with a project.
 *
 * To get more information about Service, see:
 *
 * * [API documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/projects/getCmekSettings)
 * * [Enable CMEK](https://cloud.google.com/logging/docs/routing/managed-encryption-storage#enable).
 *
 * ## Example Usage
 *
 * ### Logging Project Cmek Settings Basic
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as gcp from "@pulumi/gcp";
 *
 * const cmekSettings = gcp.logging.getProjectCmekSettings({
 *     project: "my-project-name",
 * });
 * ```
 */
export declare function getProjectCmekSettingsOutput(args: GetProjectCmekSettingsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetProjectCmekSettingsResult>;
/**
 * A collection of arguments for invoking getProjectCmekSettings.
 */
export interface GetProjectCmekSettingsOutputArgs {
    /**
     * The resource name for the configured Cloud KMS key.
     * KMS key name format:
     * `'projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]'`
     * To enable CMEK for the bucket, set this field to a valid kmsKeyName for which the associated service account has the required cloudkms.cryptoKeyEncrypterDecrypter roles assigned for the key.
     * The Cloud KMS key used by the bucket can be updated by changing the kmsKeyName to a new valid key name. Encryption operations that are in progress will be completed with the key that was in use when they started. Decryption operations will be completed using the key that was used at the time of encryption unless access to that key has been revoked.
     * See [Enabling CMEK for Logging Buckets](https://cloud.google.com/logging/docs/routing/managed-encryption-storage) for more information.
     */
    kmsKeyName?: pulumi.Input<string>;
    /**
     * The ID of the project.
     */
    project: pulumi.Input<string>;
}