export declare const AuditLogConfigLogType: {
    /**
     * Default case. Should never be this.
     */
    readonly LogTypeUnspecified: "LOG_TYPE_UNSPECIFIED";
    /**
     * Admin reads. Example: CloudIAM getIamPolicy
     */
    readonly AdminRead: "ADMIN_READ";
    /**
     * Data writes. Example: CloudSQL Users create
     */
    readonly DataWrite: "DATA_WRITE";
    /**
     * Data reads. Example: CloudSQL Users list
     */
    readonly DataRead: "DATA_READ";
};
/**
 * The log type that this config enables.
 */
export type AuditLogConfigLogType = (typeof AuditLogConfigLogType)[keyof typeof AuditLogConfigLogType];
export declare const CryptoKeyPurpose: {
    /**
     * Not specified.
     */
    readonly CryptoKeyPurposeUnspecified: "CRYPTO_KEY_PURPOSE_UNSPECIFIED";
    /**
     * CryptoKeys with this purpose may be used with Encrypt and Decrypt.
     */
    readonly EncryptDecrypt: "ENCRYPT_DECRYPT";
    /**
     * CryptoKeys with this purpose may be used with AsymmetricSign and GetPublicKey.
     */
    readonly AsymmetricSign: "ASYMMETRIC_SIGN";
    /**
     * CryptoKeys with this purpose may be used with AsymmetricDecrypt and GetPublicKey.
     */
    readonly AsymmetricDecrypt: "ASYMMETRIC_DECRYPT";
    /**
     * CryptoKeys with this purpose may be used with RawEncrypt and RawDecrypt. This purpose is meant to be used for interoperable symmetric encryption and does not support automatic CryptoKey rotation.
     */
    readonly RawEncryptDecrypt: "RAW_ENCRYPT_DECRYPT";
    /**
     * CryptoKeys with this purpose may be used with MacSign.
     */
    readonly Mac: "MAC";
};
/**
 * Immutable. The immutable purpose of this CryptoKey.
 */
export type CryptoKeyPurpose = (typeof CryptoKeyPurpose)[keyof typeof CryptoKeyPurpose];
export declare const CryptoKeyVersionState: {
    /**
     * Not specified.
     */
    readonly CryptoKeyVersionStateUnspecified: "CRYPTO_KEY_VERSION_STATE_UNSPECIFIED";
    /**
     * This version is still being generated. It may not be used, enabled, disabled, or destroyed yet. Cloud KMS will automatically mark this version ENABLED as soon as the version is ready.
     */
    readonly PendingGeneration: "PENDING_GENERATION";
    /**
     * This version may be used for cryptographic operations.
     */
    readonly Enabled: "ENABLED";
    /**
     * This version may not be used, but the key material is still available, and the version can be placed back into the ENABLED state.
     */
    readonly Disabled: "DISABLED";
    /**
     * This version is destroyed, and the key material is no longer stored. This version may only become ENABLED again if this version is reimport_eligible and the original key material is reimported with a call to KeyManagementService.ImportCryptoKeyVersion.
     */
    readonly Destroyed: "DESTROYED";
    /**
     * This version is scheduled for destruction, and will be destroyed soon. Call RestoreCryptoKeyVersion to put it back into the DISABLED state.
     */
    readonly DestroyScheduled: "DESTROY_SCHEDULED";
    /**
     * This version is still being imported. It may not be used, enabled, disabled, or destroyed yet. Cloud KMS will automatically mark this version ENABLED as soon as the version is ready.
     */
    readonly PendingImport: "PENDING_IMPORT";
    /**
     * This version was not imported successfully. It may not be used, enabled, disabled, or destroyed. The submitted key material has been discarded. Additional details can be found in CryptoKeyVersion.import_failure_reason.
     */
    readonly ImportFailed: "IMPORT_FAILED";
    /**
     * This version was not generated successfully. It may not be used, enabled, disabled, or destroyed. Additional details can be found in CryptoKeyVersion.generation_failure_reason.
     */
    readonly GenerationFailed: "GENERATION_FAILED";
    /**
     * This version was destroyed, and it may not be used or enabled again. Cloud KMS is waiting for the corresponding key material residing in an external key manager to be destroyed.
     */
    readonly PendingExternalDestruction: "PENDING_EXTERNAL_DESTRUCTION";
    /**
     * This version was destroyed, and it may not be used or enabled again. However, Cloud KMS could not confirm that the corresponding key material residing in an external key manager was destroyed. Additional details can be found in CryptoKeyVersion.external_destruction_failure_reason.
     */
    readonly ExternalDestructionFailed: "EXTERNAL_DESTRUCTION_FAILED";
};
/**
 * The current state of the CryptoKeyVersion.
 */
export type CryptoKeyVersionState = (typeof CryptoKeyVersionState)[keyof typeof CryptoKeyVersionState];
export declare const CryptoKeyVersionTemplateAlgorithm: {
    /**
     * Not specified.
     */
    readonly CryptoKeyVersionAlgorithmUnspecified: "CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED";
    /**
     * Creates symmetric encryption keys.
     */
    readonly GoogleSymmetricEncryption: "GOOGLE_SYMMETRIC_ENCRYPTION";
    /**
     * AES-GCM (Galois Counter Mode) using 128-bit keys.
     */
    readonly Aes128Gcm: "AES_128_GCM";
    /**
     * AES-GCM (Galois Counter Mode) using 256-bit keys.
     */
    readonly Aes256Gcm: "AES_256_GCM";
    /**
     * AES-CBC (Cipher Block Chaining Mode) using 128-bit keys.
     */
    readonly Aes128Cbc: "AES_128_CBC";
    /**
     * AES-CBC (Cipher Block Chaining Mode) using 256-bit keys.
     */
    readonly Aes256Cbc: "AES_256_CBC";
    /**
     * AES-CTR (Counter Mode) using 128-bit keys.
     */
    readonly Aes128Ctr: "AES_128_CTR";
    /**
     * AES-CTR (Counter Mode) using 256-bit keys.
     */
    readonly Aes256Ctr: "AES_256_CTR";
    /**
     * RSASSA-PSS 2048 bit key with a SHA256 digest.
     */
    readonly RsaSignPss2048Sha256: "RSA_SIGN_PSS_2048_SHA256";
    /**
     * RSASSA-PSS 3072 bit key with a SHA256 digest.
     */
    readonly RsaSignPss3072Sha256: "RSA_SIGN_PSS_3072_SHA256";
    /**
     * RSASSA-PSS 4096 bit key with a SHA256 digest.
     */
    readonly RsaSignPss4096Sha256: "RSA_SIGN_PSS_4096_SHA256";
    /**
     * RSASSA-PSS 4096 bit key with a SHA512 digest.
     */
    readonly RsaSignPss4096Sha512: "RSA_SIGN_PSS_4096_SHA512";
    /**
     * RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
     */
    readonly RsaSignPkcs12048Sha256: "RSA_SIGN_PKCS1_2048_SHA256";
    /**
     * RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
     */
    readonly RsaSignPkcs13072Sha256: "RSA_SIGN_PKCS1_3072_SHA256";
    /**
     * RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
     */
    readonly RsaSignPkcs14096Sha256: "RSA_SIGN_PKCS1_4096_SHA256";
    /**
     * RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
     */
    readonly RsaSignPkcs14096Sha512: "RSA_SIGN_PKCS1_4096_SHA512";
    /**
     * RSASSA-PKCS1-v1_5 signing without encoding, with a 2048 bit key.
     */
    readonly RsaSignRawPkcs12048: "RSA_SIGN_RAW_PKCS1_2048";
    /**
     * RSASSA-PKCS1-v1_5 signing without encoding, with a 3072 bit key.
     */
    readonly RsaSignRawPkcs13072: "RSA_SIGN_RAW_PKCS1_3072";
    /**
     * RSASSA-PKCS1-v1_5 signing without encoding, with a 4096 bit key.
     */
    readonly RsaSignRawPkcs14096: "RSA_SIGN_RAW_PKCS1_4096";
    /**
     * RSAES-OAEP 2048 bit key with a SHA256 digest.
     */
    readonly RsaDecryptOaep2048Sha256: "RSA_DECRYPT_OAEP_2048_SHA256";
    /**
     * RSAES-OAEP 3072 bit key with a SHA256 digest.
     */
    readonly RsaDecryptOaep3072Sha256: "RSA_DECRYPT_OAEP_3072_SHA256";
    /**
     * RSAES-OAEP 4096 bit key with a SHA256 digest.
     */
    readonly RsaDecryptOaep4096Sha256: "RSA_DECRYPT_OAEP_4096_SHA256";
    /**
     * RSAES-OAEP 4096 bit key with a SHA512 digest.
     */
    readonly RsaDecryptOaep4096Sha512: "RSA_DECRYPT_OAEP_4096_SHA512";
    /**
     * RSAES-OAEP 2048 bit key with a SHA1 digest.
     */
    readonly RsaDecryptOaep2048Sha1: "RSA_DECRYPT_OAEP_2048_SHA1";
    /**
     * RSAES-OAEP 3072 bit key with a SHA1 digest.
     */
    readonly RsaDecryptOaep3072Sha1: "RSA_DECRYPT_OAEP_3072_SHA1";
    /**
     * RSAES-OAEP 4096 bit key with a SHA1 digest.
     */
    readonly RsaDecryptOaep4096Sha1: "RSA_DECRYPT_OAEP_4096_SHA1";
    /**
     * ECDSA on the NIST P-256 curve with a SHA256 digest. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms
     */
    readonly EcSignP256Sha256: "EC_SIGN_P256_SHA256";
    /**
     * ECDSA on the NIST P-384 curve with a SHA384 digest. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms
     */
    readonly EcSignP384Sha384: "EC_SIGN_P384_SHA384";
    /**
     * ECDSA on the non-NIST secp256k1 curve. This curve is only supported for HSM protection level. Other hash functions can also be used: https://cloud.google.com/kms/docs/create-validate-signatures#ecdsa_support_for_other_hash_algorithms
     */
    readonly EcSignSecp256k1Sha256: "EC_SIGN_SECP256K1_SHA256";
    /**
     * HMAC-SHA256 signing with a 256 bit key.
     */
    readonly HmacSha256: "HMAC_SHA256";
    /**
     * HMAC-SHA1 signing with a 160 bit key.
     */
    readonly HmacSha1: "HMAC_SHA1";
    /**
     * HMAC-SHA384 signing with a 384 bit key.
     */
    readonly HmacSha384: "HMAC_SHA384";
    /**
     * HMAC-SHA512 signing with a 512 bit key.
     */
    readonly HmacSha512: "HMAC_SHA512";
    /**
     * HMAC-SHA224 signing with a 224 bit key.
     */
    readonly HmacSha224: "HMAC_SHA224";
    /**
     * Algorithm representing symmetric encryption by an external key manager.
     */
    readonly ExternalSymmetricEncryption: "EXTERNAL_SYMMETRIC_ENCRYPTION";
};
/**
 * Required. Algorithm to use when creating a CryptoKeyVersion based on this template. For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both this field is omitted and CryptoKey.purpose is ENCRYPT_DECRYPT.
 */
export type CryptoKeyVersionTemplateAlgorithm = (typeof CryptoKeyVersionTemplateAlgorithm)[keyof typeof CryptoKeyVersionTemplateAlgorithm];
export declare const CryptoKeyVersionTemplateProtectionLevel: {
    /**
     * Not specified.
     */
    readonly ProtectionLevelUnspecified: "PROTECTION_LEVEL_UNSPECIFIED";
    /**
     * Crypto operations are performed in software.
     */
    readonly Software: "SOFTWARE";
    /**
     * Crypto operations are performed in a Hardware Security Module.
     */
    readonly Hsm: "HSM";
    /**
     * Crypto operations are performed by an external key manager.
     */
    readonly External: "EXTERNAL";
    /**
     * Crypto operations are performed in an EKM-over-VPC backend.
     */
    readonly ExternalVpc: "EXTERNAL_VPC";
};
/**
 * ProtectionLevel to use when creating a CryptoKeyVersion based on this template. Immutable. Defaults to SOFTWARE.
 */
export type CryptoKeyVersionTemplateProtectionLevel = (typeof CryptoKeyVersionTemplateProtectionLevel)[keyof typeof CryptoKeyVersionTemplateProtectionLevel];
export declare const EkmConnectionKeyManagementMode: {
    /**
     * Not specified.
     */
    readonly KeyManagementModeUnspecified: "KEY_MANAGEMENT_MODE_UNSPECIFIED";
    /**
     * EKM-side key management operations on CryptoKeys created with this EkmConnection must be initiated from the EKM directly and cannot be performed from Cloud KMS. This means that: * When creating a CryptoKeyVersion associated with this EkmConnection, the caller must supply the key path of pre-existing external key material that will be linked to the CryptoKeyVersion. * Destruction of external key material cannot be requested via the Cloud KMS API and must be performed directly in the EKM. * Automatic rotation of key material is not supported.
     */
    readonly Manual: "MANUAL";
    /**
     * All CryptoKeys created with this EkmConnection use EKM-side key management operations initiated from Cloud KMS. This means that: * When a CryptoKeyVersion associated with this EkmConnection is created, the EKM automatically generates new key material and a new key path. The caller cannot supply the key path of pre-existing external key material. * Destruction of external key material associated with this EkmConnection can be requested by calling DestroyCryptoKeyVersion. * Automatic rotation of key material is supported.
     */
    readonly CloudKms: "CLOUD_KMS";
};
/**
 * Optional. Describes who can perform control plane operations on the EKM. If unset, this defaults to MANUAL.
 */
export type EkmConnectionKeyManagementMode = (typeof EkmConnectionKeyManagementMode)[keyof typeof EkmConnectionKeyManagementMode];
export declare const ImportJobImportMethod: {
    /**
     * Not specified.
     */
    readonly ImportMethodUnspecified: "IMPORT_METHOD_UNSPECIFIED";
    /**
     * This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping scheme defined in the PKCS #11 standard. In summary, this involves wrapping the raw key with an ephemeral AES key, and wrapping the ephemeral AES key with a 3072 bit RSA key. For more details, see [RSA AES key wrap mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
     */
    readonly RsaOaep3072Sha1Aes256: "RSA_OAEP_3072_SHA1_AES_256";
    /**
     * This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping scheme defined in the PKCS #11 standard. In summary, this involves wrapping the raw key with an ephemeral AES key, and wrapping the ephemeral AES key with a 4096 bit RSA key. For more details, see [RSA AES key wrap mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
     */
    readonly RsaOaep4096Sha1Aes256: "RSA_OAEP_4096_SHA1_AES_256";
    /**
     * This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping scheme defined in the PKCS #11 standard. In summary, this involves wrapping the raw key with an ephemeral AES key, and wrapping the ephemeral AES key with a 3072 bit RSA key. For more details, see [RSA AES key wrap mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
     */
    readonly RsaOaep3072Sha256Aes256: "RSA_OAEP_3072_SHA256_AES_256";
    /**
     * This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping scheme defined in the PKCS #11 standard. In summary, this involves wrapping the raw key with an ephemeral AES key, and wrapping the ephemeral AES key with a 4096 bit RSA key. For more details, see [RSA AES key wrap mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
     */
    readonly RsaOaep4096Sha256Aes256: "RSA_OAEP_4096_SHA256_AES_256";
    /**
     * This ImportMethod represents RSAES-OAEP with a 3072 bit RSA key. The key material to be imported is wrapped directly with the RSA key. Due to technical limitations of RSA wrapping, this method cannot be used to wrap RSA keys for import.
     */
    readonly RsaOaep3072Sha256: "RSA_OAEP_3072_SHA256";
    /**
     * This ImportMethod represents RSAES-OAEP with a 4096 bit RSA key. The key material to be imported is wrapped directly with the RSA key. Due to technical limitations of RSA wrapping, this method cannot be used to wrap RSA keys for import.
     */
    readonly RsaOaep4096Sha256: "RSA_OAEP_4096_SHA256";
};
/**
 * Required. Immutable. The wrapping method to be used for incoming key material.
 */
export type ImportJobImportMethod = (typeof ImportJobImportMethod)[keyof typeof ImportJobImportMethod];
export declare const ImportJobProtectionLevel: {
    /**
     * Not specified.
     */
    readonly ProtectionLevelUnspecified: "PROTECTION_LEVEL_UNSPECIFIED";
    /**
     * Crypto operations are performed in software.
     */
    readonly Software: "SOFTWARE";
    /**
     * Crypto operations are performed in a Hardware Security Module.
     */
    readonly Hsm: "HSM";
    /**
     * Crypto operations are performed by an external key manager.
     */
    readonly External: "EXTERNAL";
    /**
     * Crypto operations are performed in an EKM-over-VPC backend.
     */
    readonly ExternalVpc: "EXTERNAL_VPC";
};
/**
 * Required. Immutable. The protection level of the ImportJob. This must match the protection_level of the version_template on the CryptoKey you attempt to import into.
 */
export type ImportJobProtectionLevel = (typeof ImportJobProtectionLevel)[keyof typeof ImportJobProtectionLevel];